n = 201354090531918389422241515534761536573 c = 20442989381348880630046435751193745753 p = 14450452739004884887 q = 13934102561950901579 e = 2
inv_p = gmpy2.invert( p , q ) inv_q = gmpy2.invert( q , p ) mp = pow( c , (p+1)//4 , p ) mq = pow( c , (q+1)//4 , q )
a = (inv_p * p * mq + inv_q * q * mp) % n b = n - int(a) c = (inv_p * p * mq - inv_q * q * mp) % n d = n - int(c) # 因为rabin 加密有四种结果，全部列出。 aa = [a, b, c, d] for i in aa: print(i) print( long_to_bytes(i) )
c = [eval('0x'+x.strip()) for x in open('Problem.txt','r').readlines()] m1 = c[0]
for i in range( 1 , len(c) ): tmp = hex( m1^c[i] )[2:] for i in range( 0 , len(tmp), 2 ):#两位一转ascll p = chr(eval('0x'+tmp[i:i+2])) if p.isalpha(): print( p , end='' ) else: print('.', end='' ) print()
import Crypto.Util.strxor as xo import libnum, codecs, numpy as np
def isChr(x): if ord('a') <= x and x <= ord('z'): return True if ord('A') <= x and x <= ord('Z'): return True return False
def infer(index, pos): if msg[index, pos] != 0: return msg[index, pos] = ord(' ') for x in range(len(c)): if x != index: msg[x][pos] = xo.strxor(c[x], c[index])[pos] ^ ord(' ')
dat = []
def getSpace(): for index, x in enumerate(c): res = [xo.strxor(x, y) for y in c if x!=y] f = lambda pos: len(list(filter(isChr, [s[pos] for s in res]))) cnt = [f(pos) for pos in range(len(x))] for pos in range(len(x)): dat.append((f(pos), index, pos))
c = [codecs.decode(x.strip().encode(), 'hex') for x in open('Problem.txt', 'r').readlines()]
msg = np.zeros([len(c), len(c[0])], dtype=int)
getSpace()
dat = sorted(dat)[::-1] for w, index, pos in dat: infer(index, pos)
print('\n'.join([''.join([chr(c) for c in x]) for x in msg]))
得到：
1 2 3 4 5 6 7 8 9 10 11
Dear Friend, T%is tim< I u nderstood my m$stake 8nd u sed One time p,d encr ptio n scheme, I he,rd tha- it is the only en.ryptio7 met hod that is ma9hemati:ally proven to be #ot cra:ked ever if the ke4 is ke)t se cure, Let Me k#ow if ou a gree with me t" use t1is e ncryption sche e alwa s...
但是有点问题，可以选择手动修复，或者使用代码修复
1 2 3 4 5 6 7 8
def know(s,x,y): msg[x,y] = ord(s) for index in range(len(c)): if index != x: msg[index,y] = xo.strxor(c[x], c[index])[y] ^ ord(s) know('h',0,14) know('e',0,21)
得到
1 2 3 4 5 6 7 8 9 10 11
Dear Friend, This time I u nderstood my mistake and u sed One time pad encryptio n scheme, I heard that it is the only encryption met hod that is mathematically proven to be not cracked ever if the key is kept se cure, Let Me know if you a gree with me to use this e ncryption scheme always...
有了明文了，计算
即可得到 key
1 2
key = xo.strxor(c[0], ''.join([chr(c) for c in msg[0]]).encode()) print(key)
key就是flag
flag:flag{OPT_1s_Int3rest1ng}
后记：
按行读取TXT中的数据：c = [x for x in open('Problem.txt','r').readlines()]
去除尾部的'\n'：c = [x.strip() for x in open('Problem.txt','r').readlines()]
eval的用法十分灵活，默认十进制：c = [eval('0x'+x.strip()) for x in open('Problem.txt','r').readlines()]
import gmpy2 from Crypto.Util.number import long_to_bytes
N1= c1= E1= N2= c2= E2=
def continuedFra(x, y): #不断生成连分数的项 cF = [] while y: cF += [x // y] x, y = y, x % y return cF def Simplify(ctnf): #化简 numerator = 0 denominator = 1 for x in ctnf[::-1]: #注意这里是倒叙遍历 numerator, denominator = denominator, x * denominator + numerator return (numerator, denominator) #把连分数分成分子和算出来的分母 def getit(c): cf=[] for i in range(1,len(c)): cf.append(Simplify(c[:i])) #各个阶段的连分数的分子和分母 return cf #得到一串连分数
def wienerAttack(e, n): cf=continuedFra(e,n) for (Q2,Q1) in getit(cf):#遍历得到的连分数，令分子分母分别是Q2，Q1 if Q1 == 0: continue if N1%Q1==0 and Q1!=1:#满足这个条件就找到了 return Q1 print('not find!') Q1=wienerAttack(N1,N2)
Original A: 5448452042455354204354462043415445474f52592049532043525950544f47524150485921 Original B: 4e4f205448452042455354204f4e452049532042494e415259204558504c4f49544154494f4e
A XOR A: 7574666c61677b7477305f74696d335f703464737d7574666c61677b7477305f74696d335f70 B XOR B: 7574666c61677b7477305f74696d335f703464737d7574666c61677b7477305f74696d335f70
一次一密是牢不可破的！
不过原文和密文都给了，就可以轻易得到flag了
1 2 3 4
c = '7574666c61677b7477305f74696d335f703464737d7574666c61677b7477305f74696d335f70' for i in range(0, len(c), 2): print(chr(int(c[i:i+2], 16)), end = '')
flag:flag{tw0_tim3_p4ds}
[Dest0g3 520迎新赛]babyAES
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
from Crypto.Cipher import AES import os iv = os.urandom(16) key = os.urandom(16) my_aes = AES.new(key, AES.MODE_CBC, iv) flag = open('flag.txt', 'rb').read() flag += (16 - len(flag) % 16) * b'\x00' c = my_aes.encrypt(flag) print(c) print(iv) print(key)
from Crypto.Cipher import AES c = b'C4:\x86Q$\xb0\xd1\x1b\xa9L\x00\xad\xa3\xff\x96 hJ\x1b~\x1c\xd1y\x87A\xfe0\xe2\xfb\xc7\xb7\x7f^\xc8\x9aP\xdaX\xc6\xdf\x17l=K\x95\xd07' iv = b'\xd1\xdf\x8f)\x08w\xde\xf9yX%\xca[\xcb\x18\x80' key = b'\xa4\xa6M\xab{\xf6\x97\x94>hK\x9bBe]F'
my_aes = AES.new(key, AES.MODE_CBC, iv) m = my_aes.decrypt(c) print(m)
flag:flag{d0e5fa76-e50f-76f6-9cf1-b6c2d576b6f4}
[ACTF新生赛2020]crypto-des
1 2 3 4 5 6 7 8
72143238992041641000000.000000, 77135357178006504000000000000000.000000, 1125868345616435400000000.000000, 67378029765916820000000.000000, 75553486092184703000000000000.000000, 4397611913739958700000.000000, 76209378028621039000000000000000.000000 To solve the key, Maybe you know some interesting data format about C language?
网上抄来的脚本，我也不知道为什么要这么干（感觉和密码学没关联
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
from libnum import* import struct import binascii
s = [72143238992041641000000.000000,77135357178006504000000000000000.000000,1125868345616435400000000.000000,67378029765916820000000.000000,75553486092184703000000000000.000000,4397611913739958700000.000000,76209378028621039000000000000000.000000] a = '' b = '' for i in s: i = float(i) a += struct.pack('<f',i).hex() #小端 print(a)
for j in s: i = float(i) b += struct.pack('>f',i).hex() #小端 print(b)
print(n2s(a)) print(n2s(b))
得到：
1 2
b'Interestring Idea to encrypt' b'tpyrtpyrtpyrtpyrtpyrtpyrtpyr'
import rsa d=int(gmpy2.invert(e,(p-1)*(q-1))) Rsa=rsa.PrivateKey(n,e,d,p,q) with open('flag_encry1','rb') as f: cipher1=f.read() print(rsa.decrypt(cipher1,Rsa))
P=43753 R.<y> = PolynomialRing(GF(P)) N= S.<x> = R.quotient(N) C= p,q = N.factor() p,q = p[0],q[0] phi=(pow(P,65)-1)*(pow(P,112)-1) e = 65537 d = inverse_mod(e,phi) m = C^d print("".join([chr(c) for c in m.list()]))
from fastecdsa.curve import P521 as Curve from fastecdsa.point import Point from Crypto.Util.number import bytes_to_long, isPrime from os import urandom from random import getrandbits
def gen_rsa_primes(G): urand = bytes_to_long(urandom(521//8)) while True: s = getrandbits(521) ^ urand