[HITCON CTF 2022] crypto bypass

最新推荐文章于 2024-04-30 01:19:34 发布

石氏是时试

最新推荐文章于 2024-04-30 01:19:34 发布

阅读量651

点赞数 1

分类专栏： CTF crypto 文章标签： CTF python

本文链接：https://blog.csdn.net/weixin_52640415/article/details/128104544

版权

CTF crypto 专栏收录该内容

60 篇文章 10 订阅

订阅专栏

这是个比较多人作出来的。看来也不难。

from random import SystemRandom
from Crypto.Cipher import AES
from hashlib import sha256
from secret import flag

rand = SystemRandom()


def polyeval(poly, x):
    return sum([a * x**i for i, a in enumerate(poly)])


DEGREE = 128
SHARES_FOR_YOU = 8  # I am really stingy :)

poly = [rand.getrandbits(64) for _ in range(DEGREE + 1)]
shares = []
for _ in range(SHARES_FOR_YOU):
    x = rand.getrandbits(16)
    y = polyeval(poly, x)
    shares.append((x, y))
print(shares)

secret = polyeval(poly, 0x48763)
key = sha256(str(secret).encode()).digest()[:16]
cipher = AES.new(key, AES.MODE_CTR)
print(cipher.encrypt(flag))
print(cipher.nonce)

先生成129个64位的数，然后用8个16位数组成算式

s1 = a1*v^0 + a2*v^1 + a3*v^2 ... a129*v^128

然后用另外一个数也这样运算以后作为key来加密flag。

题目看起来很简单，首先AES加密的话如果只给出密文没有交互的话只能求key没有别的方法，所以第一步产求key。而key是sha256得到的，那就得求这个式子的129项。

由于v只有16位，所以直接除是不行了，这时候就要用到中国剩余定理。先把式子转换一下

s1 = a1 + v*(...)

这样这个式子就可以通过一个余式求出a1的一个余数，通过8个余数和v通过跳转剩余定理就可以得到a1，然后减去a1再除以v进行下一步求a2

r = [a[i][1] for i in range(8)]
n = [a[i][0] for i in range(8)]
v = []
for i in range(129):
    c = [r[j]%a[j][0] for j in range(8)]
    tmp = crt(c,n)
    r = [(r[i]-tmp)//n[i] for i in range(8)]
    v.append(tmp)
print(v)

然后基本就是复制题目的代码了，不过AES_CTR模式有个nonce由于原先没用过，不清楚怎么用，网上搜的也大都没用到nonce，不过搜来搜去总会有结果。最讨厌的就是csdn的收费内容点进去还得点出来和代码天空的没有任何解释的一堆。

说来也简单，就是直接跟参数带上名字nonce就行了，

v = [16876298701281144467, 4341623479214198629, 9201397801953532306, 16204350779251421655, 7345694695627297185, 9043033823256673136, 13493545904865138327, 2528656505346190391, 5860787621291874225, 6911473480019821660, 7243049348656678008, 15582139446035944589, 4898759005642311623, 13791107940088032965, 12202568751666342068, 16987321544504012245, 81059762722874258, 7300483918734745424, 15522853686464250250, 1029559960397028677, 12494803888399693048, 3734196368338715525, 15876183448428297430, 16128996156529178645, 4948741747165821941, 14842428818718442113, 5559834054321886198, 15728109525492077240, 9769628437887116864, 9965299213511216432, 16259271979529821198, 4229013624431837547, 5351526237814543513, 6773957888903744354, 15645554050981602119, 7948327242954695525, 16879408807485088820, 4028678427431584477, 4809288965140723749, 8081529126186710847, 7560833815277423481, 17204735409055418872, 11348195481616076967, 1216578903694340432, 5872332661386383894, 13414321564692773665, 3519815358731143412, 5120611231903772726, 4274699638525163443, 1156680578665422810, 11533605743510980247, 3262872174220935935, 14556822122593458142, 14852936183989110748, 5260815632225305836, 16724519892340136538, 354608512346660782, 6315123139620427930, 2090521840274083881, 17914258078059478594, 8915266026793545520, 7633550742675101743, 9306196833324379048, 16775657501334402922, 10068962090850430903, 53746211197164712, 4153332649563623090, 2345418168814011449, 9887295388060984536, 618922458519797218, 11454815375689330253, 7951472701497910031, 13924576411140545088, 2847759873854470776, 13493139746901263185, 2449153562558820340, 17244128610087613349, 16841263615562893339, 11821681183043089029, 509027547159796581, 355856489167137322, 1690661705662377094, 3787045116088456450, 12844355662392298492, 9983113560564770896, 5069848799053711081, 11137625778284499577, 7836696626880825407, 14387144355632294030, 13040653029635159169, 8469174034864633671, 6441902548654130006, 1054167408507924626, 3297294965843274745, 4139569188640819500, 530116604287271342, 3790498327282851437, 7521471263757737841, 5547392118425333225, 1929920249747932991, 7902611611979821251, 104476927105896567, 12906275653182030863, 5475144703486940934, 10700443736925473174, 11218183961955369894, 11666617398898960015, 13807357350539883877, 5182212691681791674, 6826440877850042350, 7876617494447104127, 16565719315945899133, 3249206776894505732, 8291312543867747874, 15719222726003530388, 7543295826642959012, 13378331951002428824, 18201617500757492128, 7308172856848374280, 5422570462453015583, 9947318394966047309, 8085486783658335213, 14650296685926254303, 5491524275106992252, 1882441946478942917, 4296575711662619838, 8322461215449306738, 10191503544855118944, 2663837216318969053]

print(len(cipher))
from Crypto.Cipher import AES
from hashlib import sha256

def polyeval(poly, x):
    return sum([a * x**i for i, a in enumerate(poly)])

secret = polyeval(v, 0x48763)
key = sha256(str(secret).encode()).digest()[:16]
aes = AES.new(key, AES.MODE_CTR, nonce=nonce)
print(aes.decrypt(cipher))
#hitcon{doing_SSS_in_integers_is_not_good_:(}

能完成的基本上都难度不大。