BUUCTF-RSA签到题第二弹,有意思或者有难度的RSA题目单独放在专栏里了BUUCTF RSA专栏_晓寒的博客-CSDN博客
文章目录
Dangerous RSA(低加密指数攻击)
题目
n=0x52d483c27cd806550fbe0e37a61af2e7cf5e0efb723dfc81174c918a27627779b21fa3c851e9e94188eaee3d5cd6f752406a43fbecb53e80836ff1e185d3ccd7782ea846c2e91a7b0808986666e0bdadbfb7bdd65670a589a4d2478e9adcafe97c6ee23614bcb2ecc23580f4d2e3cc1ecfec25c50da4bc754dde6c8bfd8d1fc16956c74d8e9196046a01dc9f3024e11461c294f29d7421140732fedacac97b8fe50999117d27943c953f18c4ff4f8c258d839764078d4b6ef6e8591e0ff5563b31a39e6374d0d41c8c46921c25e5904a817ef8e39e5c9b71225a83269693e0b7e3218fc5e5a1e8412ba16e588b3d6ac536dce39fcdfce81eec79979ea6872793L
e=0x3
c=0x10652cdfaa6b63f6d7bd1109da08181e500e5643f5b240a9024bfa84d5f2cac9310562978347bb232d63e7289283871efab83d84ff5a7b64a94a79d34cfbd4ef121723ba1f663e514f83f6f01492b4e13e1bb4296d96ea5a353d3bf2edd2f449c03c4a3e995237985a596908adc741f32365
so,how to get the message?
解题思路
题目只给出了n,e,c,且模数n很大,难以分解
但是我们注意到公钥e = 3,这就给加密带来了很大的不安全性
利用这一点可以针对小加密指数进行攻击:
- 若me < n,则m可以由c直接开3次方得到
- 若me > n,令me = c + kn,则m可以由(c+kn)开3次方得到,这里对k进行遍历
附上代码:
import gmpy2
import binascii
n=0x52d483c27cd806550fbe0e37a61af2e7cf5e0efb723dfc81174c918a27627779b21fa3c851e9e94188eaee3d5cd6f752406a43fbecb53e80836ff1e185d3ccd7782ea846c2e91a7b0808986666e0bdadbfb7bdd65670a589a4d2478e9adcafe97c6ee23614bcb2ecc23580f4d2e3cc1ecfec25c50da4bc754dde6c8bfd8d1fc16956c74d8e9196046a01dc9f3024e11461c294f29d7421140732fedacac97b8fe50999117d27943c953f18c4ff4f8c258d839764078d4b6ef6e8591e0ff5563b31a39e6374d0d41c8c46921c25e5904a817ef8e39e5c9b71225a83269693e0b7e3218fc5e5a1e8412ba16e588b3d6ac536dce39fcdfce81eec79979ea6872793
e=0x3
c=0x10652cdfaa6b63f6d7bd1109da08181e500e5643f5b240a9024bfa84d5f2cac9310562978347bb232d63e7289283871efab83d84ff5a7b64a94a79d34cfbd4ef121723ba1f663e514f83f6f01492b4e13e1bb4296d96ea5a353d3bf2edd2f449c03c4a3e995237985a596908adc741f32365
k = 0
while(True):
#gmpy2.iroot(x,n) x开n次方根
#返回值m为开方计算结果,f为bool变量,标识x能否被开方
m, f = gmpy2.iroot(c+k*n, e)
if f:
m = hex(m)[2:]
print("明文数据为:0x" + m)
flag = binascii.unhexlify(m)
print(flag) #flag{25df8caf006ee5db94d48144c33b2c3b}
break
k += 1
此题中,直接开方就得到了结果
flag
flag{25df8caf006ee5db94d48144c33b2c3b}
[HDCTF2019]basic rsa(基础题)
题目
给我们的是一个代码文件attachment.py,内容如下
import gmpy2
from Crypto.Util.number import *
from binascii import a2b_hex,b2a_hex
flag = "*****************"
p = 262248800182277040650192055439906580479
q = 262854994239322828547925595487519915551
e = 65533
n = p*q
c = pow(int(b2a_hex(flag),16),e,n)
print c
# 27565231154623519221597938803435789010285480123476977081867877272451638645710
解题思路
先运行一下试试
这里有点坑,因为我用的python3,需要修改一些地方才能解决报错问题,修改如下:
c = pow(int(b2a_hex(bytes(flag, encoding = "utf8")),16),e,n)
print(c)
- b2a_hex()接受的参数必须为bytes类型,这里进行了强制类型转换
- print函数在python3中要加括号
分析一下代码:
b2a_hex()是将字节类型数据转换为十六进制数据,然后用int()又转换成十进制
最后用pow()函数进行模幂运算,c = flag(e) % n,也就是说把flag用RSA加密了
加密输出结果如下:
9544552122426002996962843810441848397036784063191487784065817764908998519819
嗯,完全不知道这波操作在干什么,可能在教大家如何使用RSA加密文本? (斜眼笑.jpg)
那么真正的flag在哪呢
注意到代码最后一行注释有一串数据,尝试对其解密
附上代码:
import gmpy2
import binascii
p = 262248800182277040650192055439906580479
q = 262854994239322828547925595487519915551
e = 65533
n = p*q
c = 27565231154623519221597938803435789010285480123476977081867877272451638645710
d = gmpy2.invert(e,(p-1)*(q-1)) # 求逆元,de = 1 mod fai(n)
m = gmpy2.powmod(c,d,n)# 幂取模,求明文
flag = binascii.unhexlify(hex(m)[2:])
print(flag) #flag{B4by_Rs4}
get flag! 这行注释才是密文本文
flag
flag{B4by_Rs4}
BabyRsa(基础题)
题目
p+q : 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
(p+1)(q+1) : 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
e : 0xe6b1bee47bd63f615c7d0a43c529d219
d : 0x2dde7fbaed477f6d62838d55b0d0964868cf6efb2c282a5f13e6008ce7317a24cb57aec49ef0d738919f47cdcd9677cd52ac2293ec5938aa198f962678b5cd0da344453f521a69b2ac03647cdd8339f4e38cec452d54e60698833d67f9315c02ddaa4c79ebaa902c605d7bda32ce970541b2d9a17d62b52df813b2fb0c5ab1a5
enc_flag : 0x50ae00623211ba6089ddfae21e204ab616f6c9d294e913550af3d66e85d0c0693ed53ed55c46d8cca1d7c2ad44839030df26b70f22a8567171a759b76fe5f07b3c5a6ec89117ed0a36c0950956b9cde880c575737f779143f921d745ac3bb0e379c05d9a3cc6bf0bea8aa91e4d5e752c7eb46b2e023edbc07d24a7c460a34a9a
解题思路
这道题直接给出了私钥d,但是没给模数n,因此要从p+q和(p+1)(q+1)中求出n = pq
非常简单就能得到:
(p+1)(q+1) = pq + p + q + 1
pq = (p+1)(q+1) - (p+q) - 1
得到n之后正常解密就能拿到flag
附上代码:
import gmpy2
import binascii
#p+q = 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
#(p+1)(q+1) = 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
e = 0xe6b1bee47bd63f615c7d0a43c529d219
d = 0x2dde7fbaed477f6d62838d55b0d0964868cf6efb2c282a5f13e6008ce7317a24cb57aec49ef0d738919f47cdcd9677cd52ac2293ec5938aa198f962678b5cd0da344453f521a69b2ac03647cdd8339f4e38cec452d54e60698833d67f9315c02ddaa4c79ebaa902c605d7bda32ce970541b2d9a17d62b52df813b2fb0c5ab1a5
enc_flag = 0x50ae00623211ba6089ddfae21e204ab616f6c9d294e913550af3d66e85d0c0693ed53ed55c46d8cca1d7c2ad44839030df26b70f22a8567171a759b76fe5f07b3c5a6ec89117ed0a36c0950956b9cde880c575737f779143f921d745ac3bb0e379c05d9a3cc6bf0bea8aa91e4d5e752c7eb46b2e023edbc07d24a7c460a34a9a
a = 0x1232fecb92adead91613e7d9ae5e36fe6bb765317d6ed38ad890b4073539a6231a6620584cea5730b5af83a3e80cf30141282c97be4400e33307573af6b25e2ea
b = 0x5248becef1d925d45705a7302700d6a0ffe5877fddf9451a9c1181c4d82365806085fd86fbaab08b6fc66a967b2566d743c626547203b34ea3fdb1bc06dd3bb765fd8b919e3bd2cb15bc175c9498f9d9a0e216c2dde64d81255fa4c05a1ee619fc1fc505285a239e7bc655ec6605d9693078b800ee80931a7a0c84f33c851740
n = b - a - 1 #计算模数n
m = gmpy2.powmod(enc_flag, d, n) #解密
print("明文数据为:" + hex(m))
flag = binascii.unhexlify(hex(m)[2:])
print(flag)
flag
flag{cc7490e-78ab-11e9-b422-8ba97e5da1fd}
RSA5(多N分解)
题目
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-C6X6udkC-1626313465179)(C:\Users\xiao_han\AppData\Roaming\Typora\typora-user-images\image-20210709092753224.png)]
给出了加密指数e,以及不同模数n对应的加密结果c,一共给出20组nc
解题思路
由于这道题中e不是小指数,因此不能像RSA4一样用中国剩余定理求解
因为我们手上一共有20个模数n,尝试一下是否会有某两个n的大素数因子相同
因为p,q都为素数,所以n的因子只有{1, p, q, n}
直接计算两个n的公约数,若大于1则必定是p或者q中的一个
有了p或者q中的一个,就可以分解出n = p * q,从而计算出私钥d进行解密
附上代码:
import gmpy2
import binascii
def solve(nList, cList):
for i in range(len(nList)):
for j in range(i+1, len(nList)):
p = gmpy2.gcd(nList[i], nList[j]) #计算最大公约数
if p != 1: #若存在最大公约数,则该数为n[i]和n[j]共有的大素数因子,即p或者q
print("n[%d]和n[%d]存在公约数为\n%d" % (i,j,p))
q = nList[i] // p
print("分解n[%d]得到:\n%d =\n%d * \n%d" % (i,nList[i],p,q))
d = gmpy2.invert(e,(p-1)*(q-1)) #计算e的逆元,即私钥d
m = gmpy2.powmod(cList[i], d, nList[i]) #模幂运算,解密
return (binascii.unhexlify(hex(m)[2:]))
if __name__ == "__main__":
e = 65537
#========== n c ==========
n1 = 20474918894051778533305262345601880928088284471121823754049725354072477155873778848055073843345820697886641086842612486541250183965966001591342031562953561793332341641334302847996108417466360688139866505179689516589305636902137210185624650854906780037204412206309949199080005576922775773722438863762117750429327585792093447423980002401200613302943834212820909269713876683465817369158585822294675056978970612202885426436071950214538262921077409076160417436699836138801162621314845608796870206834704116707763169847387223307828908570944984416973019427529790029089766264949078038669523465243837675263858062854739083634207
c1 = 974463908243330865728978769213595400782053398596897741316275722596415018912929508637393850919224969271766388710025195039896961956062895570062146947736340342927974992616678893372744261954172873490878805483241196345881721164078651156067119957816422768524442025688079462656755605982104174001635345874022133045402344010045961111720151990412034477755851802769069309069018738541854130183692204758761427121279982002993939745343695671900015296790637464880337375511536424796890996526681200633086841036320395847725935744757993013352804650575068136129295591306569213300156333650910795946800820067494143364885842896291126137320
n2 = 20918819960648891349438263046954902210959146407860980742165930253781318759285692492511475263234242002509419079545644051755251