print("# task1") m = flag_parts[0] e = 65537 p = getPrime(1024) q = getPrime(1024) r = getPrime(1024) n1 = p * q c1 = pow(m, e, n1) n2 = r * q c2 = pow(m, e, n2) print("e =", e) print("n1 =", n1) print("c1 =", c1) print("n2 =", n2) print("c2 =", c2)
print("# task2") m = flag_parts[1] e = 7 p = getPrime(1024) q = getPrime(1024) n = p * q c = pow(m, e, n) print("e =", e) print("n =", n) print("c =", c)
from flag import flag from Crypto.Util.number import * m = bytes_to_long(flag) e = 65537 f = open("output.txt", "r") a = f.readlines() for i in a: n = int(i) c = pow(m, e, n) m = c # c1 m1=c1 # c2 = pow(c1,e,n) # ci = pow(ci-1,e,n) # 每次取文本中的数作为 加密的模数 # 每次得到的密文会作为下一次的明文进行加密 # 也就可以理解为 连续加密了len(a)遍 每次都用不同的模数 # 已知最后一次加密的密文 c 最后一次加密的模数n 指数e # 使用多组模数 可以有限考虑 模数共用素因子 print'c = %s' % (m) f.close() c = 38127524839835864306737280818907796566475979451567460500065967565655632622992572530918601432256137666695102199970580936307755091109351218835095309766358063857260088937006810056236871014903809290530667071255731805071115169201705265663551734892827553733293929057918850738362888383312352624299108382366714432727 65439077968397540989065489337415940784529269429684649365065378651353483030304843439003949649543376311871845618819107350646437252980144978447924976470943930075812834237368425374578215977641265884859875440799334807607478705932175148673160353577875890074101393042506714001617338265284910381849259298772642190619 86843235426823545017422014398916780909062053456790256392304973548517489132984667679637386416948409930796162377844525829968317585749956057149930523547463230147376192820753802868362225137830225967953826475779047454555958271846035526319036389127587352017149417549187850782892924691511398536178090031958365483499 57839320383142814687522363258949714784622321678585619281948174372461045134361003939684803510572969567182690634502610963365500727981041136988638273942465134797850643121827808482673619534240872593224537996099454035648829692386918230535360101064254854063175494150147494342652670585674593236663514793256521719547 52668168898129361356420333177679019946307853075463961068071790653159090226904625885080236174231665178538405547828768043706515464922611051221394704678558922339886480247663138702481349098077291584992082414494275463670330534613607852999291645500391111597009868188974671249118213040057429113174377610094956993269 79875848044631194160351918105738804229446748736206976033243436373010695259945613104837645712048695514204494137005015770637421510392760763371639480133851920449252506525423837434811693638210458851990502785655738042348115385964604080872180121543147063180945532713593712726527002909054818485584237993215139630243 73100501797447180147684637554796375398455002202770022931512541062214916136294604754404667725341796896161398464327153718845280194035978972665664657052946003418121755545770123205426883869361411412259838522099085901563107814985172942977520233320215882707710717870398128412272218474014381169303848087621856187879 89149546555397759430343098936690138982544367561661914051499112345535238108800665531588376806546499374457634397161670140520060064963391826220177798442707381640723248034061313974522233415815795656570220902974484865176728535660627712374835329967608728216749734529761431592345816592875807318876347151421393671763 66449107450661172442868032153863675098235855689218695279414435182923510356012957155941548483160873271040452368644926703812707864779900715051152673705082002761445847561495295455460041902473282731259268870375921215589157288622757488879539441498396276257589120302991242300378364101246448094955634459779361686643 79694880331320743031437708811856697413105291652061062223857313580221562305807771003185061831752133665835648647560103986928466217390444724672894866216636981793418219455653595717274553950715056120806463449033181486699963584346517910081706586345546292894426402568226579894766693070066214488743160957135286739213 70521001788476157145543175674209083194325853388116385624440232036679708917857095748070597575068955423165296665429648694541353249787337464272095260410717659726012806836884799476995758902361678737968193674368688353935424186389207123637734230550266810766585903134004322848985320790788169777840924595645463787189 51801430118171456966246071852561156183140136541960623661080056673664466785669585092926482194691254461430866302262960624015915371927788809661387318097968209364907625599562339722700041444342116899266802018340155635959614677597708758012024981583143521259152639480003228924151971208695043251548758407218187895663 87310111118839703578797261862424304499548882114635944516216618095145194843718635007052242072452831460162126955481326379219639313067967998826898344673513019946299427614605216960081461930080199023399060417820769438661351988322185620598552697590115678078498754112860310272842870106790357443602405008865116282919
from Crypto.Util.number import long_to_bytes import gmpy2 c = 38127524839835864306737280818907796566475979451567460500065967565655632622992572530918601432256137666695102199970580936307755091109351218835095309766358063857260088937006810056236871014903809290530667071255731805071115169201705265663551734892827553733293929057918850738362888383312352624299108382366714432727 e = 65537 withopen("output.txt","r") as fp: n_list = fp.read().splitlines() print(n_list) print(type(int(n_list[0]))) print(len(n_list)) p = gmpy2.gcd(int(n_list[0]),int(n_list[1])) for i inrange(len(n_list)-1): assert gmpy2.gcd(int(n_list[0]),int(n_list[1])) == p print("[+] 存在公因数",p) for n in n_list[::-1]: q = int(n) // p d = gmpy2.invert(e,(q-1)*(p-1)) m = pow(c,d,int(n)) c = m print(long_to_bytes(m)) # b'GWHT{gixkJl7SJTcpLOL9zqwo}'
import random from secret import flag ror = lambda x, l, b: (x >> l) | ((x & ((1<<l)-1)) << (b-l)) # 循环右移 2|n -> c的最低位就是m的最低位 # 遍历所有的 c的最低位 合并即可得到m N = 1 for base in [2, 3, 7]: N *= pow(base, random.randint(123, 456)) # N = 2^x * 3^y * 7^z # 奇 * 奇 = 奇 # 偶 * 偶 = 偶 # 奇 * 偶 = 奇 # 所以 N最终为2的倍数 为偶数 对应的最后一个二进制字符为 1 # 当A > B时： # 若B为偶数，A % B的奇偶性同A的奇偶性一致 # 若B为奇数，A % B的奇偶性同A的奇偶性相反 # 当A < B时： # A % B的奇偶性与A一致 # N > m N为偶数 所以m 也就是偶数 # 对应 pow(c,d,n) 也为偶数 # 所以每次得到的结果中 最后一个 1bit位 和 m的最后一个bit位一样 # 所以求每个C的最后一个二进制位 组合起来就是 m e = random.randint(271828, 314159) m = int.from_bytes(flag, byteorder='big') assert m.bit_length() < N.bit_length() for i inrange(m.bit_length()): print(pow(ror(m, i, m.bit_length()), e, N)) # C = ( ror(m,i,m.len) ) ^e mod n
WP
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
from Crypto.Util.number import long_to_bytes flag='' f=open('chall.txt','r').readlines() li=[] for i in f: li.append(int(i.strip('\n'))) # print(li) for i in li: flag+=bin(i)[-1] print(flag) print(hex(int(flag,2))) print(long_to_bytes(eval('0b'+flag[::-1]))) #zer0pts{0h_1t_l34ks_th3_l34st_s1gn1f1c4nt_b1t}
#!/usr/bin/python from Crypto.Util.number import long_to_bytes import binascii, sys from Crypto.Util.strxor import strxor from Crypto.Cipher import AES # -----------get key--------- # tmp = hint ^ key -> key = tmp ^ hint tmp = 99748265546679089946917295913637945222843938798184123305418691873367322323659 # hint为32字节 key为16字节 所以异或后 tmp高位就是 hint的高位 # [2:10] 前面有0x 所以从第二位开始取8位 # 32字节 64个十六进制字符 hint = int(str(hex(tmp))[2:10] * 8, 16) key = long_to_bytes(tmp ^ hint) # ----------get iv----------- msg = b'Welcome, ctfer. Dont try too hard, its no use. Have a good day!!' msgs = [msg[ii:(ii + 16)] for ii inrange(0, len(msg), 16)] print(msgs) # [b'Welcome, ctfer. ', b'Dont try too har', b'd, its no use. H', b'ave a good day!!'] msgs.reverse() # msg[3] msg[2] msg[1] msg[0] # [b'ave a good day!!', b'd, its no use. H', b'Dont try too har', b'Welcome, ctfer. '] IV = binascii.unhexlify('bc03f3ac4ff8064acbcfaf0b0bf2ba7b') # iv = msg[0] ^ decrypt(enc1,key) # enc1 = msg[1] ^ decrypt(enc2,key) # enc2 = msg[2] ^ decrypt(enc3,key) # enc3 = msg[3] ^ decrypt(enc4,key) defdecry(key, IV, ms): aes = AES.new(key, AES.MODE_ECB) return strxor(aes.decrypt(IV), ms) for ms in msgs: IV = decry(key, IV, ms) print(b'flag{' + IV + b'}')
[ACTF新生赛2020]crypto-aes
题目
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
from Cryptodome.Cipher import AES import os import gmpy2 from flag import FLAG from Cryptodome.Util.number import * defmain(): key=os.urandom(2)*16 iv=os.urandom(16) print(bytes_to_long(key)^bytes_to_long(iv)) aes=AES.new(key,AES.MODE_CBC,iv) enc_flag = aes.encrypt(FLAG) print(enc_flag) if __name__=="__main__": main() # 91144196586662942563895769614300232343026691029427747065707381728622849079757 # b'\x8c-\xcd\xde\xa7\xe9\x7f.b\x8aKs\xf1\xba\xc75\xc4d\x13\x07\xac\xa4&\xd6\x91\xfe\xf3\x14\x10|\xf8p'
from Crypto.Cipher import AES from Crypto.Util.number import long_to_bytes withopen("flag_cipher", "rb") as fp: # print(len(fp.read())) cipher = fp.read() fp.close() key0 = cipher[:32] print(key0) defMyOwnCBC(key0,cipher): cipher = [cipher[i:i + 32] for i inrange(0, len(cipher), 32)] m = b'' tmpkey = key0 # 上一次的密文作为key参与下一次ECB for i inrange(1,len(cipher)): aes = AES.new(tmpkey,AES.MODE_ECB) m += aes.decrypt(cipher[i]) tmpkey = cipher[i] return m print(MyOwnCBC(key0,cipher)) #b'\xe5\xdf\x94sJ\xc2\xcd\x04\xeb\xb7\xcf\x05(\xbe\x98\\\xe9\xc3^\x1f!\xfb\xea6\xdac\x1f\xfe\x901\xbb\x13' #b"mode of operation is an algorithm that uses a block cipher to provide an information service such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transformation (encryption or decryption) of one fixed-length group of bits called a block. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block.\n\nMost modes require a unique binary sequence, often called an initialization vector (IV), for each encryption operation. The IV has to be non-repeating and, for some modes, random as well. The initialization vector is used to ensure distinct ciphertexts are produced even when the same plaintext is encrypted multiple times independently with the same key. Block ciphers have one or more block size(s), but during transformation the block size is always fixed. Block cipher modes operate on whole blocks and require that the last part of the data be padded to a full block if it is smaller than the current block size. There are, however, modes that do not require padding because they effectively use a block cipher as a stream cipher.\n\nHistorically, encryption modes have been studied extensively in regard to their error propagation properties under various scenarios of data modification. Later development regarded integrity protection as an entirely separate cryptographic goal. Some modern modes of operation combine confidentiality and authenticity in an efficient way, and are known as authenticated encryption modes.\n\nAh you found it~ afctf{Don't_be_fooled_by_yourself}~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"
from Crypto.Util.number import * base = bytes_to_long(b"koito") iv = 3735927943 blocks = [8490961288, 122685644196, 349851982069, 319462619019, 74697733110, 43107579733, 465430019828, 178715374673, 425695308534, 164022852989, 435966065649, 222907886694, 420391941825, 173833246025, 329708930734] defblockize(long): out = [] while long > 0: # 取余数 存入 out out.append(long % base) long //= base returnlist(reversed(out)) defdeblockize(blocks): out = 0 for block in blocks: out = out * base + block return out defencrypt_block_cbc(blocks, iv, key): encrypted = [iv] for i inrange(len(blocks)): encrypted.append(blocks[i] ^ encrypted[i] ^ key) return encrypted[1:] # blocks[0] ^ iv ^ key = flag[0] defdecrypt_block_cbc(blocks, iv, key): # iv 初始化向量 encrypted = [iv, *blocks] decrypted = [] for i inrange(len(blocks)): decrypted.append(encrypted[i] ^ encrypted[i + 1] ^ key) return decrypted # flag = moectf{xxx} # 72个字符 其中 moectf 6 {} 2 72-2-6=64个 # flag[0] = blocks[0] ^ key ^ iv # key = iv ^ blocks[0] ^ flag[0] print("flag:",blockize(bytes_to_long(b"moectf{" + b"0"*64 + b"}"))[0] ) # print(blockize(bytes_to_long(b"moectf{" + b"0"*64 + b"}"))) key = blockize(bytes_to_long(b"moectf{" + b"0"*64 + b"}"))[0] ^ iv ^ blocks[0] m = long_to_bytes(deblockize(decrypt_block_cbc(blocks, iv, key))) print("key:",key) print(m)
aes3
题目
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
rom Crypto.Cipher import AES import binascii import hashlib from secret import flag assert flag[:5] == "flag{"and flag[-1:] == "}" key = b"J1fx2g1jDak1c***" l = len(key) message = b"I have had my invitation to this world's festival, and thus my life has been blessed" + binascii.unhexlify(hashlib.sha256(key).hexdigest())[:10] iv = flag[5:-1] message = message + bytes((l - len(message) % l) * chr(l - len(message) % l), encoding = "utf-8") aes = AES.new(key, AES.MODE_CBC, iv) print(binascii.hexlify(aes.encrypt(message))) #******************************************************************************************************************************************************6ece036e495d363b647d7f2749c4c2f3dd78f8637b
from Crypto.Cipher import AES from tqdm import tqdm import binascii import hashlib # 1. 生成key字典 import string dic = string.printable[:62] # print(dic) # 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ withopen('key_table.txt','wb') as file: for i in dic: for j in dic: for k in dic: key = b"J1fx2g1jDak1c"+i.encode()+j.encode()+k.encode() file.write(key+b'\n') file.close() # 2.爆破key defxor(m: bytes, c: bytes): returnbytes([i ^ j for i, j inzip(m, c)]) enc = binascii.unhexlify('5d363b647d7f2749c4c2f3dd78f8637b') five_part = binascii.unhexlify(b"6ece036e49") f = open("key_table.txt","rb+") pbar = tqdm(range(238328)) for i in f: key = i[:16] aes = AES.new(key, AES.MODE_ECB) dec = aes.decrypt(enc) # 一块 16个字节 4+10+2 m = b"ssed" +binascii.unhexlify(hashlib.sha256(key).hexdigest())[:10]+b'\x02\x02' xor_result = xor(m,dec) pbar.update(1) if five_part in xor_result: print("[+] key:",key) break f.close() # 3.求IV l = len(key) # 192 message = b"I have had my invitation to this world's festival, and thus my life has been blessed" + binascii.unhexlify(hashlib.sha256(key).hexdigest())[:10] message = message + bytes((l - len(message) % l) * chr(l - len(message) % l), encoding="utf-8") for i inrange(0,len(message),16): aes_ecb = AES.new(key,AES.MODE_ECB) dec_c = aes_ecb.decrypt(enc) enc = xor(message[len(message)-i-16:len(message)-i],dec_c) print(b'flag{'+enc+b'}')
