2020西湖论剑Crypto BrokenSystem wp

题目

打开压缩包的三个文件
查看加密代码

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
from secret import flag
import os
rsa = RSA.generate(2048)
public_key = rsa.publickey().exportKey()
f=open("public.key","w")
f.write(public_key.decode())
f.close()

rsakey=RSA.importKey(open("public.key","r").read())
rsa = PKCS1_OAEP.new(rsakey)
msg=rsa.encrypt(flag.encode())
f=open("message","wb")
f.write(msg)
f.close()

即生成一个公钥写入文件
再根据公钥加密flag后写入message
所以我们可以读出公钥对(n,e)

op1 = open('public.key','rb').read()
pub = RSA.importKey(op1)
e = int(pub.e)
n = int(pub.n)

n = 24493816160588971749455534346389861269947121809901305744877671102517333076424951483888863597563544011725032585417200878377314372325231470164799594965293350352923195632229495874587039720317200655351788887974047948082357232348155828924230567816817425104960545706688263839042183224681231800805037117758927837949941052360649778743187012198508745207332696876463490071925421229447425456903529626946628855874075846839745388326224970202749994059533831664092151570836853681204646481502222112116971464211748086292930029540995987019610460396057955900244074999111267618452967579699626655472948383601391620012180211885979095636919
e = 3683191938452247871641914583009119792552938079110383367782698429399084083048335018186915282465581498846777124014232879019914546010406868697694661244001972931366227108140590201194336470785929194895915077935083045957890179080332615291089360169761324533970721460473221959270664692795701362942487885620152952927112838769014944652059440137350285198702402612151501564899791870051001152984815689187374906618917967106000628810361686645504356294175173529719443860140795170776862320812544438211122891112138748710073230404456268507750721647637959502454394140328030018450883598342764577147457231373121223878829298942493059211583

发现e非常大，故考虑wiener攻击
得到d后需要得到p,q
需使用以下算法：

#get p or q
def getpq(n,e,d):
    while True:
        k = e * d - 1
        g = random.randint(1, n)
        while k%2==0:
            k=k//2
            temp=gmpy2.powmod(g,k,n)-1
            if gmpy2.gcd(temp,n)>1 and temp!=0:
                return gmpy2.gcd(temp,n)

我是在Wiener工具包里运行的该exp
wiener attack
git clone https://github.com/pablocelayes/rsa-wiener-attack.git

exp:

import gmpy2
import random
from Crypto.Cipher import PKCS1_OAEP
from RSAwienerHacker import hack_RSA
from Crypto.PublicKey import RSA


op1 = open('public.key','rb').read()
pub = RSA.importKey(op1)
e = int(pub.e)
n = int(pub.n)
print(n)
print(e)
d = hack_RSA(e,n)


def getpq(n,e,d):
    while True:
        k = e * d - 1
        g = random.randint(1, n)
        while k%2==0:
            k=k//2
            temp=gmpy2.powmod(g,k,n)-1
            if gmpy2.gcd(temp,n)>1 and temp!=0:
                return gmpy2.gcd(temp,n)

p = int(getpq(n,e,d))
q = int(n//p)
print(p)
print(q)


#p = 149604112324264915811376746906108325951188179904814259006959765070266946659481820938211689946210254302179197289522748397160602946376246768419310765669852537378426700376878745285639531531077237124655345323906476180103106894642043615024716862503414785057646920410083538192951872861366496901158348770066798098371
#q = 163724217068973025857079545677048587508164102644298632911494474022224582218067057349189211462632427829087720476013052665037199232658015194718500750961261016558605363103092187533086949903145449057015220561698195502163792192055762108803714387175594231859738263839090338762578040513451585421537323416472060788989

key=RSA.construct((n, e, d, p, q))
cipher = PKCS1_OAEP.new(key)

op2 = open('message','rb').read()

flag = cipher.decrypt(op2)
print(flag)