GDOUCTF2023-Crypto

Match

Created At : 2023-04-19 19:44

Count:497 Views 👀 :

Absolute_Baby_Encrytpion
babylua
Math Problem

Absolute_Baby_Encrytpion

把给的js的替换加密过程逆过来就行，没学过js，在佬的提示下知道了打开控制台能执行js代码，学到了！

babylua

爆破前四位即可，这里给自己提个醒，太粗心了，两层md5，一开始也看到了，后面就加了一层，怎么都看不出来哪错了，还跑去看给的md5文件。。。太不仔细了

for a in range(65,123):
     for b in range(65,123):
         for c in range(65,123):
             for d in range(65,123):
                 s = chr(i)+chr(j)+chr(k)+chr(l)
                 key0 = md5(s.encode()).hexdigest()
                 key = md5(key0.encode()).hexdigest()
                 if(key[:10] == 'b5e62abe84'):
                     print(key)
#'b5e62abe84bc8afbfd97c91a15aa0867'

Math Problem

import secret
from Crypto.Util.number import *

p, q = getPrime(512), getPrime(512)
e, n = 0x10001, p * q
c = pow(bytes_to_long(secret.flag), e, n)
print(f"{e = }\n{n = }\n{c = }")

a, b = getPrime(512), getPrime(512)
E = EllipticCurve(GF(p), [a, b])
G = E.lift_x(ZZ(getPrime(64)))
print(f"{a = }\n{b = }\ny = {G.xy()[1]}")

'''
e = 65537
n = 79239019133008902130006198964639844798771408211660544649405418249108104979283858140199725213927656792578582828912684320882248828512464244641351915288069266378046829511827542801945752252863425605946379775869602719406340271702260307900825314967696531175183205977973427572862807386846990514994510850414958255877
c = 45457869965165575324534408050513326739799864850578881475341543330291990558135968254698676312246850389922318827771380881195754151389802803398367341521544667542828862543407738361578535730524976113729406101764290984943061582342991118766322793847422471903811686775249409300301726906738475446634950949059180072008
a = 9303981927028382051386918702900550228062240363697933771286553052631411452412621158116514735706670764224584958899184294505751247393129887316131576567242619
b = 9007779281398842447745292673398186664639261529076471011805234554666556577498532370235883716552696783469143334088312327338274844469338982242193952226631913
y = 970090448249525757357772770885678889252473675418473052487452323704761315577270362842929142427322075233537587085124672615901229826477368779145818623466854
'''

大概分析可以猜测n无法分解，得想办法求p或q。发现下面椭圆以p为域。

G = E.lift_x(ZZ(getPrime(64)))

以随机的64bit的数为X坐标赋给G，Y坐标也给了，那我们可以通过椭圆方程得到kp，再与n=pq进行gcd即可求出p来。

注意在域p下的椭圆方程完整为：

$y^2 = x^3+ax+b (mod p) $

$\Rightarrow kp = y^2 - x^3 - ax - b $

构造copper得到解出x来。

PR.<x> = PolynomialRing(Zmod(n))
f = y**2 - x**3 - a*x - b   
x = f.monic().small_roots(X=2^64, beta=0.4,epsilon=0.01)
print(x)
#9757458594430450711
kp = pow(y,2) - x^3 - ax - b
#p = gcd(kp,n)
#print(p)
p = 7279677904338093832546721706607315537640051433348566104875700920839161204729986401038944007088069112608905570366309380015748213899158756142624495493188683
q = n // p
d = inverse(e,(p-1)*(q-1))
m = pow(c,d,n)
print(long_to_bytes(m))
#b'flag{c4edd6d0-d1b3-cbda-95e3-a323edc35be5}'

RSA与椭圆相结合，新知了。

参考：

[GDOUCTF2023 Crypto部分 - 编程猎人 (programminghunter.com)](GDOUCTF2023 Crypto部分 - 编程猎人 (programminghunter.com))

(3条消息) GDOUCTF2023 Crypto Pwn_无趣的浅的博客-CSDN博客

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。可以在下面评论区评论，也可以邮件至 1666739907@qq.com