crtrsa -- 2021巅峰极客

2021“巅峰极客”网络安全技能挑战赛

crtrsa

题目：

from secret import flagn,p,q
#p and q are two primes generated by getPrime
import random
def key_gen():
    while True:
	dp = random.randint(1,1<<20)
	dq = random.randint(1,q-1)
	if gcd(dp, p - 1) == 1 and gcd(dq, q - 1) == 1:
	    d = crt([dp,dq],[p-1,q-1])
	    phi = (p-1)*(q-1)
	    R = Integers(phi)
	    e = R(d)^-1
	    return p*q,e
n,e = key_gen()
print e
print n
print pow(flagn,int(e),n)

'''
e = 2953544268002866703872076551930953722572317122777861299293407053391808199220655289235983088986372630141821049118015752017412642148934113723174855236142887
N = 6006128121276172470274143101473619963750725942458450119252491144009018469845917986523007748831362674341219814935241703026024431390531323127620970750816983
flag = 4082777468662493175049853412968913980472986215497247773911290709560282223053863513029985115855416847643274608394467813391117463817805000754191093158289399
'''

可以看到dp的范围是在[1,1048576]，这个范围应该是可以进行穷举的。那如何利用这一点呢？

首先由以下公式和定理：
$$\begin{gathered} ①e\ast d\equiv 1(mod\phi (n))==>e\ast d\equiv 1(mod(p-1))) \\ ②dp\equiv d(mod(p-1)) \\ 欧拉定理： \\ 设m是大于1的整数，如果a是满足(a,m)=1的整数，则 \\ {a}^{\phi (m)}\equiv 1(modm) \end{gathered}$$
由①，②得
$$\begin{gathered} e\ast dp\equiv 1(mod(p-1)) \\ ==>e\ast dp=1+k\ast (p-1) \end{gathered}$$
根据欧拉定理有(m∈(1,p)，p是素数，即(m，p) = 1)：
$$m^{\phi (p)}\equiv m^{p-1}\equiv 1(modp)$$
进一步化简：
$$m^{p-1}\equiv 1(modp)==>m^{k\ast (p-1)+1}\equiv m(modp)==>m^{e\ast dp}\equiv m(modp)$$
所以有 $p|m^{e\ast dp}-m$，又有p|n，进一步得出$gcd(n,m^{e\ast dp}-m)=p$。

综上：我们可以随意选取m∈(1,p)，通过枚举dp，根据$p=gcd(n,m^{e\ast dp}-m)!=1$来求出p,进而分解n。

代码：

import gmpy2
from Crypto.Util.number import *

e = 2953544268002866703872076551930953722572317122777861299293407053391808199220655289235983088986372630141821049118015752017412642148934113723174855236142887
n = 6006128121276172470274143101473619963750725942458450119252491144009018469845917986523007748831362674341219814935241703026024431390531323127620970750816983
c = 4082777468662493175049853412968913980472986215497247773911290709560282223053863513029985115855416847643274608394467813391117463817805000754191093158289399
#dp = d % (p-1)     dq = d % (q-1)

m = 10000001
for dp in range(1,(1<<20)+1):
    print(dp)
    temp = pow(m,e*dp,n) - m
    p = gmpy2.gcd(n,temp)
    if p != 1:
        q = n // p
        try:
            d = gmpy2.invert(e,(p-1)*(q-1))
            flag = long_to_bytes(pow(c,d,n))
            if b'flag' in flag or b'ctf' in flag:
                print(flag)
                break
        except:
            pass
   
    
#dp = 915155
#b'flag{d67fde91-f6c0-484d-88a4-1778f7fa0c05}'

参考：
https://zhuanlan.zhihu.com/p/395205287