Cryptohack刷题记录(五) RSA部分 STARTER writeup

Mr_AgNO3

已于 2022-11-18 23:36:58 修改

阅读量653

点赞数

文章标签： python

于 2022-11-14 23:02:21 首次发布

本文链接：https://blog.csdn.net/u010883831/article/details/127853541

版权

文章目录

RSA

STARTER

这部分没啥好些的，但万一有纯新手找到这里来，我还是写一写
orz

RSA Starter 1

Find the solution to $101^{17} \mod 22663$

>>> pow(101,17,22663)
19906

RSA Starter 2

“Encrypt” the number 12 using the exponent e = 65537 and the primes p = 17 and q = 23. What number do you get as the ciphertext?

>>> e = 0x10001
>>> m = 12
>>> p,q = 17,23
>>> n = p*q
>>> c = pow(m,e,n)
>>> c
301

RSA Starter 3

Given N = p*q and two primes:
p = 857504083339712752489993810777
q = 1029224947942998075080348647219
What is the totient of N?

求 $\varphi(n)$

>>> from Crypto.Util.number import *
>>> p = 857504083339712752489993810777;q = 1029224947942998075080348647219
>>> assert isPrime(p) and isPrime(q)
>>> phin = p*q-p-q+1
>>> phin
882564595536224140639625987657529300394956519977044270821168

RSA Starter 4

Given the two primes:
p = 857504083339712752489993810777
q = 1029224947942998075080348647219
and the exponent:
e = 65537
What is the private key d?

已知p,q,e求d

>>> p = 857504083339712752489993810777
>>> q = 1029224947942998075080348647219
>>> e = 65537
>>> phin = p*q-p-q+1
>>> d = pow(e,-1,phin)
>>> d
121832886702415731577073962957377780195510499965398469843281

RSA Starter 5

N = 882564595536224140639625987659416029426239230804614613279163
e = 65537
Use the private key that you found for these parameters in the previous challenge to decrypt this ciphertext:
c = 77578995801157823671636298847186723593814843845525223303932

这里的N和前几道题是一样的，直接使用上一道题计算出的d即可

>>> d
121832886702415731577073962957377780195510499965398469843281
>>> c = 77578995801157823671636298847186723593814843845525223303932
>>> N = 882564595536224140639625987659416029426239230804614613279163
>>> pow(c,d,N)
13371337

RSA Starter 6

RSA签名

Imagine you write a message M. You encrypt this message with your friend’s public key: $C = M^e\mod N_0$ .
To sign this message, you calculate the hash of the message: H(M) and “encrypt” this with your private key: S = $H(M)^d\mod N_1$ .
Now by computing $H (m)$ and comparing it to s: assert H(m) == s, they can ensure that the message you sent them, is the message that they received!
Sign the flag crypto{Immut4ble_m3ssag1ng} using your private key and the SHA256 hash function.

from hashlib import sha256

N = 15216583654836731327639981224133918855895948374072384050848479908982286890731769486609085918857664046075375253168955058743185664390273058074450390236774324903305663479046566232967297765731625328029814055635316002591227570271271445226094919864475407884459980489638001092788574811554149774028950310695112688723853763743238753349782508121985338746755237819373178699343135091783992299561827389745132880022259873387524273298850340648779897909381979714026837172003953221052431217940632552930880000919436507245150726543040714721553361063311954285289857582079880295199632757829525723874753306371990452491305564061051059885803
d = 11175901210643014262548222473449533091378848269490518850474399681690547281665059317155831692300453197335735728459259392366823302405685389586883670043744683993709123180805154631088513521456979317628012721881537154107239389466063136007337120599915456659758559300673444689263854921332185562706707573660658164991098457874495054854491474065039621922972671588299315846306069845169959451250821044417886630346229021305410340100401530146135418806544340908355106582089082980533651095594192031411679866134256418292249592135441145384466261279428795408721990564658703903787956958168449841491667690491585550160457893350536334242689
m = b'crypto{Immut4ble_m3ssag1ng}'
H = int(sha256(m).hexdigest(),16)
s = pow(H,d,N)
print(hex(s))

# 0x6ac9bb8f110b318a40ad8d7e57defdcce2652f5928b5f9b97c1504d7096d7af1d34e477b30f1a08014e8d525b14458b709a77a5fa67d4711bd19da1446f9fb0ffd9fdedc4101bdc9a4b26dd036f11d02f6b56f4926170c643f302d59c4fe8ea678b3ca91b4bb9b2024f2a839bec1514c0242b57e1f5e77999ee67c450982730252bc2c3c35acb4ac06a6ce8b9dbf84e29df0baa7369e0fd26f6dfcfb22a464e05c5b72baba8f78dc742e96542169710918ee2947749477869cb3567180ccbdfe6fdbe85bcaca4bf6da77c8f382bb4c8cd56dee43d1290ca856318c97f1756b789e3cac0c9738f5e9f797314d39a2ededb92583d97124ec6b313c4ea3464037d3

PRIMES PART 1

Factoring

Factorise the 150-bit number 510143758735509025530880200653196460532653147 into its two constituent primes. Give the smaller one as your answer.

使用yafu分解
在这里插入图片描述
得到两个因数，较小的一个为flag
19704762736204164635843

Inferius Prime

这道题生成RSA参数的过程如下：

e = 3

# n will be 8 * (100 + 100) = 1600 bits strong which is pretty good
while True:
    p = getPrime(100)
    q = getPrime(100)
    phi = (p - 1) * (q - 1)
    d = inverse(e, phi)
    if d != -1 and GCD(e, phi) == 1:
        break

实际上n只有100+100=200bit长度
和第一题一样，直接yafu分解

from gmpy2 import *

n = 742449129124467073921545687640895127535705902454369756401331
e = 3
ct = 39207274348578481322317340648475596807303160111338236677373

# yafu分解得到因数
p = 986369682585281993933185289261
q = 752708788837165590355094155871

phin = p*q-p-q+1
d = pow(e,-1,phin)
m = pow(ct,d,n)
print(bytes.fromhex(hex(m)[2:]))
# b'crypto{N33d_b1g_pR1m35}'

Monoprime

题目描述说Why not just use one?，按时大整数n就是一个大素数
使用isPrime函数验证一下
对于一个素数 $p$ ，它的欧拉函数值 $\varphi(p)=p-1$

from Crypto.Util.number import isPrime

n = 171731371218065444125482536302245915415603318380280392385291836472299752747934607246477508507827284075763910264995326010251268493630501989810855418416643352631102434317900028697993224868629935657273062472544675693365930943308086634291936846505861203914449338007760990051788980485462592823446469606824421932591                                                                  
e = 65537
ct = 161367550346730604451454756189028938964941280347662098798775466019463375610700074840105776873791605070092554650190486030367121011578171525759600774739890458414593857709994072516290998135846956596662071379067305011746842247628316996977338024343628757374524136260758515864509435302781735938531030576289086798942

assert isPrime(n),"n is not prime"
phin = n - 1
d = pow(e,-1,phin)
print(bytes.fromhex(hex(pow(ct,d,n))[2:]))

# b'crypto{0n3_pr1m3_41n7_pr1m3_l0l}'

Square Eyes

It was taking forever to get a 2048 bit prime, so I just generated one and used it twice.

used it twice，推测是同一个素数的平方做大素数N，即 $N=p^2$ ，此时有 $\varphi(N)=p(p-1)$

from gmpy2 import iroot

N = 535860808044009550029177135708168016201451343147313565371014459027743491739422885443084705720731409713775527993719682583669164873806842043288439828071789970694759080842162253955259590552283047728782812946845160334801782088068154453021936721710269050985805054692096738777321796153384024897615594493453068138341203673749514094546000253631902991617197847584519694152122765406982133526594928685232381934742152195861380221224370858128736975959176861651044370378539093990198336298572944512738570839396588590096813217791191895941380464803377602779240663133834952329316862399581950590588006371221334128215409197603236942597674756728212232134056562716399155080108881105952768189193728827484667349378091100068224404684701674782399200373192433062767622841264055426035349769018117299620554803902490432339600566432246795818167460916180647394169157647245603555692735630862148715428791242764799469896924753470539857080767170052783918273180304835318388177089674231640910337743789750979216202573226794240332797892868276309400253925932223895530714169648116569013581643192341931800785254715083294526325980247219218364118877864892068185905587410977152737936310734712276956663192182487672474651103240004173381041237906849437490609652395748868434296753449
e = 65537
c = 222502885974182429500948389840563415291534726891354573907329512556439632810921927905220486727807436668035929302442754225952786602492250448020341217733646472982286222338860566076161977786095675944552232391481278782019346283900959677167026636830252067048759720251671811058647569724495547940966885025629807079171218371644528053562232396674283745310132242492367274184667845174514466834132589971388067076980563188513333661165819462428837210575342101036356974189393390097403614434491507672459254969638032776897417674577487775755539964915035731988499983726435005007850876000232292458554577437739427313453671492956668188219600633325930981748162455965093222648173134777571527681591366164711307355510889316052064146089646772869610726671696699221157985834325663661400034831442431209123478778078255846830522226390964119818784903330200488705212765569163495571851459355520398928214206285080883954881888668509262455490889283862560453598662919522224935145694435885396500780651530829377030371611921181207362217397805303962112100190783763061909945889717878397740711340114311597934724670601992737526668932871436226135393872881664511222789565256059138002651403875484920711316522536260604255269532161594824301047729082877262812899724246757871448545439896
assert iroot(N,2)[1]
p = iroot(N,2)[0]
phin = p*p - p
d = pow(e,-1,phin)
print(bytes.fromhex(hex(pow(c,d,N))[2:]))

# b'crypto{squar3_r00t_i5_f4st3r_th4n_f4ct0r1ng!}'

Manyprime

n由许多个小素数相乘得来，使用yafu分解，得到素数因子
在这里插入图片描述
使用欧拉公式计算 $\varphi(n)$

from functools import reduce

n = 580642391898843192929563856870897799650883152718761762932292482252152591279871421569162037190419036435041797739880389529593674485555792234900969402019055601781662044515999210032698275981631376651117318677368742867687180140048715627160641771118040372573575479330830092989800730105573700557717146251860588802509310534792310748898504394966263819959963273509119791037525504422606634640173277598774814099540555569257179715908642917355365791447508751401889724095964924513196281345665480688029639999472649549163147599540142367575413885729653166517595719991872223011969856259344396899748662101941230745601719730556631637
e = 65537
ct = 320721490534624434149993723527322977960556510750628354856260732098109692581338409999983376131354918370047625150454728718467998870322344980985635149656977787964380651868131740312053755501594999166365821315043312308622388016666802478485476059625888033017198083472976011719998333985531756978678758897472845358167730221506573817798467100023754709109274265835201757369829744113233607359526441007577850111228850004361838028842815813724076511058179239339760639518034583306154826603816927757236549096339501503316601078891287408682099750164720032975016814187899399273719181407940397071512493967454225665490162619270814464

factor = '''P20 = 13099895578757581201
P19 = 9282105380008121879
P20 = 11530534813954192171
P20 = 11282698189561966721
P20 = 11665347949879312361
P20 = 15669758663523555763
P20 = 15998365463074268941
P20 = 14523070016044624039
P19 = 9389357739583927789
P20 = 16656402470578844539
P20 = 17174065872156629921
P20 = 13572286589428162097
P20 = 12973972336777979701
P20 = 12955403765595949597
P20 = 11403460639036243901
P20 = 12132158321859677597
P20 = 10336650220878499841
P20 = 15824122791679574573
P20 = 17138336856793050757
P20 = 14100640260554622013
P20 = 16898740504023346457
P20 = 12834461276877415051
P20 = 11328768673634243077
P20 = 10638241655447339831
P19 = 9303850685953812323
P20 = 14278240802299816541
P20 = 14178869592193599187
P20 = 14963354250199553339
P20 = 11473665579512371723
P20 = 11492065299277279799
P20 = 17281246625998849649
P20 = 15364597561881860737'''

factor = list(map(int,[i.split()[-1] for i in factor.split('\n')]))
phin = reduce(lambda a,b:a*(b-1),[1] + factor)
d = pow(e,-1,phin)
print(bytes.fromhex(hex(pow(ct,d,n))[2:]))
# b'crypto{700_m4ny_5m4ll_f4c70r5}'