RSA的dp泄露 [BUUCTF] RSA2

最新推荐文章于 2025-03-09 11:30:47 发布

#_##

最新推荐文章于 2025-03-09 11:30:47 发布

阅读量3.3k

点赞数 6

分类专栏： ctf wp CRYPTO 文章标签：密码学

本文链接：https://blog.csdn.net/weixin_45859850/article/details/109559190

版权

ctf wp 同时被 2 个专栏收录

24 篇文章

订阅专栏

CRYPTO

22 篇文章

订阅专栏

可以看到，不同于传统的RSA解密，这里给出了一个参数dp

首先了解一下什么是dp：

dp = d%(p-1)

在这里插入图片描述
遍历X（e+1种可能）,求出(p-1)得到p且能被n整除；接下来就是常规RSA的解法得到d

for i in range(1,e):
    if (dp*e-1)%i == 0:
        if n%(((dp*e-1)/i)+1)==0:
            p=((dp*e-1)/i)+1
            q=n/(((dp*e-1)/i)+1)
            phi = (p-1)*(q-1)
            d = gmpy2.invert(e,phi)%phi

以[WUSTCTF2020]dp_leaking_1s_very_d@angerous为例:

import gmpy2 as gp

e = 65537
n = 248254007851526241177721526698901802985832766176221609612258877371620580060433101538328030305219918697643619814200930679612109885533801335348445023751670478437073055544724280684733298051599167660303645183146161497485358633681492129668802402065797789905550489547645118787266601929429724133167768465309665906113
dp = 905074498052346904643025132879518330691925174573054004621877253318682675055421970943552016695528560364834446303196939207056642927148093290374440210503657

c = 140423670976252696807533673586209400575664282100684119784203527124521188996403826597436883766041879067494280957410201958935737360380801845453829293997433414188838725751796261702622028587211560353362847191060306578510511380965162133472698713063592621028959167072781482562673683090590521214218071160287665180751


for i in range(1,e):                   
    if(dp*e-1)%i == 0:
        if n%(((dp*e-1)//i)+1) == 0:   
            p=((dp*e-1)//i)+1
            q=n//(((dp*e-1)//i)+1)
            phi=(q-1)*(p-1)            
            d=gp.invert(e,phi)         
            m=pow(c,d,n)               
           
print(m)                              

print(bytes.fromhex(hex(m)[2:]))      
# b'flag{wow_leaking_dp_breaks_rsa?_98924743502}'