Cryptohack刷题记录(二) Mathematics部分 Modular Math WriteUp

MATHEMETICS

刚考完信安就忘完了…

MODULAR MATH

1. Quadratic Residues

模平方根

取$p=29,a=11$，有
$$a^2=5\mathrm{m}\mathrm{o}\mathrm{d}29$$
我们定义5在模29下的模平方根为11

We say that an integer x is a Quadratic Residue if there exists an a such that $ a^2=x\mod p$ . If there is no such solution, then the integer is a Quadratic Non-Residue.

题目：

给了$p=29,ints=[14,6,11]$，找到三个书中的QR的那一个(QR和QNR叫模平方剩余和模非平方剩余)，解出这个数的模平方根，小的一个根即flag

数值比较小，暴力解吧

>>> for t in [14,6,11]:
	for i in range(1,29):
		if pow(i,2,29) == t:
			print(f"{i} ^ 2 = {t} mod 29")

8 ^ 2 = 6 mod 29
21 ^ 2 = 6 mod 29

flag就是8

---

2. Legendre Symbol

勒让德符号

是这么个规律
$$\begin{gathered} QR\ast QR=QR \\ QR\ast QNR=QNR \\ QNR\ast QNR=QR \end{gathered}$$
勒让德符号：
$$\left(\frac{a}{p}\right)=a^{\frac{p-1}{2}}\mathrm{m}\mathrm{o}\mathrm{d}p$$
满足：

题目：

给了p和包含10个元素的数组ints

从ints中找出模p的一个二次剩余，计算这个数的模平方根，较大的那个数即flag

>>> for i in ints:
	l = pow(i,p//2,p)
	if l == p-1:
		pass
	else:print(ints.index(i))

5

>>> a = ints[5]
>>> pow(a,p//2,p)
1

接下来解方程
$$x^2\equiv a\mathrm{m}\mathrm{o}\mathrm{d}p$$
注意到p为4k+3型的素数

>>> p%4
3

刚刚计算过勒让德符号$\left(\frac{a}{p}\right)=1$

则有
$$a^{\frac{p-1}{2}}\equiv 1\mathrm{m}\mathrm{o}\mathrm{d}p$$
同余号两边同时乘以a:
$$\begin{gathered} a^{\frac{p+1}{2}}\equiv a\mathrm{m}\mathrm{o}\mathrm{d}p \\ (a^{\frac{p+1}{4}}{)}^2\equiv a\mathrm{m}\mathrm{o}\mathrm{d}p \end{gathered}$$
则 $\pm a^{\frac{p+1}{4}}$ 即方程的解

直接计算即可

>>> t = pow(a,p//4+1,p)
>>> pow(t,2,p) == a
True
>>> t
93291799125366706806545638475797430512104976066103610269938025709952247020061090804870186195285998727680200979853848718589126765742550855954805290253592144209552123062161458584575060939481368210688629862036958857604707468372384278049741369153506182660264876115428251983455344219194133033177700490981696141526

t即flag

---

3. Modular Square Root

Tonelli-Shanks算法是一种计算模平方根的算法

任何非2的素数都是 $p\equiv 1\mathrm{m}\mathrm{o}\mathrm{d}4$ 或者 $p\equiv 3\mathrm{m}\mathrm{o}\mathrm{d}4$ 的形式

上一道题已经使用过了，对于4k+3型的素数，计算模平方根的方式很简单，但对于4k+1型的素数并不能这种方法计算

对于$r^2\equiv a\mathrm{m}\mathrm{o}\mathrm{d}p$，Tonelli-Shanks算法能够计算r

该算法要计算椭圆曲线的交点，不深入讨论，但Sage已经有内置的方法实现

遂用Sage解方程

不知道他说的那个算法在Sage内是否有具体的函数实现，反正我是硬解出来了

sage: R.<x> = Zmod(p)[]
sage: f = x^2-a
sage: rr = f.roots()

sage: rr
[(28169512554311284614348161812907461395482195258388583125795498809297226147214152907614055638917789190356917578259717792167302913007927989841763977292434488782635964253677743342038748567333074043589267896292373028724763808006697707070301035339291758998923066001985927788808579330075671953036025191791621915640175242425390397212674797332132801882880223506177201168864920484993546017284338829512010922075018689505381642887042980971582058343875078178836965895987271392081926458392283354971823611423820865651283490761548053384731721391637064349021755899877224522161311561209530712702153163501623531290150340903913036821041,  1),
(2362339307683048638327773298580489298932137505520500388338271052053734747862351779647314176817953359071871560041125289919247146074907151612762640868199621186559522068338032600991311882224016021222672243139362180461232646732465848840425458257930887856583379600967761738596782877851318489355679822813155123045705285112099448146426755110160002515592418850432103641815811071548456284263507805589445073657565381850521367969675699760755310784623577076440037747681760302434924932113640061738777601194622244192758024180853916244427254065441962557282572849162772740798989647948645207349737457445440405057156897508368531939120,  1)]
sage: min(rr[0][0],rr[1][0])
2362339307683048638327773298580489298932137505520500388338271052053734747862351779647314176817953359071871560041125289919247146074907151612762640868199621186559522068338032600991311882224016021222672243139362180461232646732465848840425458257930887856583379600967761738596782877851318489355679822813155123045705285112099448146426755110160002515592418850432103641815811071548456284263507805589445073657565381850521367969675699760755310784623577076440037747681760302434924932113640061738777601194622244192758024180853916244427254065441962557282572849162772740798989647948645207349737457445440405057156897508368531939120

解出两个根，较小的一个为flag

---

4. Chisese Remainder Theorem

中国剩余定理 CRTyyds!!

对于方程组
$$\{\begin{array}{l}x\equiv a_1\mathrm{m}\mathrm{o}\mathrm{d}n1\\ x\equiv a_2\mathrm{m}\mathrm{o}\mathrm{d}n2\\ ...\\ x\equiv a_n\mathrm{m}\mathrm{o}\mathrm{d}{n}_n\end{array}$$
有唯一解 $x\equiv a\mathrm{m}\mathrm{o}\mathrm{d}N$，其中$N=\prod n_i$

题目：

已知
$$\{\begin{array}{l}x\equiv 2\mathrm{m}\mathrm{o}\mathrm{d}5\\ x\equiv 3\mathrm{m}\mathrm{o}\mathrm{d}11\\ x\equiv 5\mathrm{m}\mathrm{o}\mathrm{d}17\end{array}$$
找到满足$x\equiv a\mathrm{m}\mathrm{o}\mathrm{d}935$ 的整数 $a$

进入sage

首先对 $935$ 进行分解

sage: factor(935)
5 * 11 * 17

则

>>> a = (2*11*17*invert(11*17,5) + 3*5*17*invert(5*17,11) + 5*5*11*invert(5*11,17))%n
>>> a
mpz(872)

flag是872