[NCTF2019]babyRSA 1(位运算、sympy.prevprime()函数、下标和值的输出)

• 题目

from Crypto.Util.number import *
from flag import flag

def nextPrime(n):
    n += 2 if n & 1 else 1
    while not isPrime(n):
        n += 2
    return n

p = getPrime(1024)
q = nextPrime(p)
n = p * q
e = 0x10001
d = inverse(e, (p-1) * (q-1))
c = pow(bytes_to_long(flag.encode()), e, n)

# d = 19275778946037899718035455438175509175723911466127462154506916564101519923603308900331427601983476886255849200332374081996442976307058597390881168155862238533018621944733299208108185814179466844504468163200369996564265921022888670062554504758512453217434777820468049494313818291727050400752551716550403647148197148884408264686846693842118387217753516963449753809860354047619256787869400297858568139700396567519469825398575103885487624463424429913017729585620877168171603444111464692841379661112075123399343270610272287865200880398193573260848268633461983435015031227070217852728240847398084414687146397303110709214913
# c = 5382723168073828110696168558294206681757991149022777821127563301413483223874527233300721180839298617076705685041174247415826157096583055069337393987892262764211225227035880754417457056723909135525244957935906902665679777101130111392780237502928656225705262431431953003520093932924375902111280077255205118217436744112064069429678632923259898627997145803892753989255615273140300021040654505901442787810653626524305706316663169341797205752938755590056568986738227803487467274114398257187962140796551136220532809687606867385639367743705527511680719955380746377631156468689844150878381460560990755652899449340045313521804

• 代码

import gmpy2
import sympy
'''
这里主要是解决p和q是相邻的素数，
题目给出
p = getPrime(1024)
q = nexPrime(p)
e * d = 1 mod phi_n
e * d - 1 = k * phi_n
这里要爆破出k，
再进一步爆破出p和q
'''

d = gmpy2.mpz(19275778946037899718035455438175509175723911466127462154506916564101519923603308900331427601983476886255849200332374081996442976307058597390881168155862238533018621944733299208108185814179466844504468163200369996564265921022888670062554504758512453217434777820468049494313818291727050400752551716550403647148197148884408264686846693842118387217753516963449753809860354047619256787869400297858568139700396567519469825398575103885487624463424429913017729585620877168171603444111464692841379661112075123399343270610272287865200880398193573260848268633461983435015031227070217852728240847398084414687146397303110709214913)
e = gmpy2.mpz(int('0x10001', 16))

# 因为p和q都是1024位二进制，phi_n就是1024 * 2位
# 这里求出这个的位数，就是为了爆破出k的位数
len_phi_n = 1024 * 2
len_e_d = len(bin(int(e * d - 1))[2:]) # 这里要注意bin()返回的是'0b'开头的，要切片
len_k = len_e_d - len_phi_n
print("k length is :%s\n"%(len_k))

# 知道了k的二进制位数，就可以求出k的最大值和最小值
# 这里直接用二进制的位运算来表示k的最大值和最小值
# 这里1 << len_k是右移了16位，
# 数字变成了10000000000000000也就是17位，
# 所以最小值应该是1 << (len_k - 1)，最大值是1 << len_k
min_k = 1 << (len_k - 1)
max_k = 1 << len_k

# 开始爆破k，
# 这里k可能有很多个数,
# 可同时爆破pq的值
k = gmpy2.mpz()
phi_n_exp = e * d - 1
for i in range(min_k, max_k):
    if phi_n_exp % i == 0:
        phi_n = phi_n_exp // i
        p = sympy.prevprime(int(gmpy2.iroot(phi_n, 2)[0]))
        q = sympy.nextprime(p)
        if (p - 1) * (q - 1) == phi_n:
            n = p * q
            my_list = [p, q, phi_n, n]
            name_list = ['p', 'q', 'phi_n', 'n']
            for index, value in enumerate(my_list):
                print(name_list[index] + " is :" + str(value) + '\n')

• 总结

位运算的是时候移位要把原来的位数算在里面，
sympy.prevprime()可以找到前一个素数，
fro index, value in enumeragte(lis): 可以找到lis的下标和值。