[CISCN2018]sm(矩阵)

encrypt

from Crypto.Util.number import getPrime,long_to_bytes,bytes_to_long
from Crypto.Cipher import AES
import hashlib
from random import randint
def gen512num():
    order=[]
    while len(order)!=512:
        tmp=randint(1,512)
        if tmp not in order:
            order.append(tmp)
    ps=[]
    for i in range(512):
        p=getPrime(512-order[i]+10)
        pre=bin(p)[2:][0:(512-order[i])]+"1"
        ps.append(int(pre+"0"*(512-len(pre)),2))
    return ps

def run():
    choose=getPrime(512)
    ps=gen512num()
    print "gen over"
    bchoose=bin(choose)[2:]
    r=0
    bchoose = "0"*(512-len(bchoose))+bchoose
    for i in range(512):
        if bchoose[i]=='1':
            r=r^ps[i]
    flag=open("flag","r").read()

    key=long_to_bytes(int(hashlib.md5(long_to_bytes(choose)).hexdigest(),16))
    aes_obj = AES.new(key, AES.MODE_ECB)
    ef=aes_obj.encrypt(flag).encode("base64")

    open("r", "w").write(str(r))
    open("ef","w").write(ef)
    gg=""
    for p in ps:
        gg+=str(p)+"\n"
    open("ps","w").write(gg)

run()

decrypt

题目的关键在于求出bchoose,而bchoose的比特位用来指定ps中特定的数的位进行模2加运算(也就是异或)
所以有 :
ps[i]⊕ps[j]⊕ps[k]…=r
从比特位观察我们可以得到:
r的每一位比特位对应ps中对应的比特位进行异或运算的结果,而究竟是哪些ps值则由bchoose来决定.
因此我们可以写成矩阵形式:
记ps构成的矩阵为 A 待求的bchoose 为 C r为B 则:
C*A=B => C=BA^-1
bchoose 求出后答案也就出来了.

#sage代码
ps=open('ps','r').readlines()
c=[]
for i in ps:
    c.append(eval(i.strip()