a ctfer on the load

1
from Crypto.Util.number import getPrime, bytes_to_long
2
from secret import flag
3

4
def get_huge_RSA():
5
    p = getPrime(1024)
6
    q = getPrime(1024)
7
    N = p * q
8
    phi = (p - 1) * (q - 1)
9
    while True:
10
        d = getPrime(256)
11
        e = pow(d, -1, phi)
12
        if e.bit_length() == N.bit_length():
13
            break
14
    return N,e
15

16
if __name__ == '__main__':
17
    N, e = get_huge_RSA()
18
    m = bytes_to_long(flag)
19
    c = pow(m, e, N)
20

21
    print(f'N = {hex(N)}')
22
    print(f'e = {hex(e)}')
23
    print(f'c = {hex(c)}')

1
N =
2
e =
3
c =
4

5
def factor_rsa_wiener(N, e):
6
    N = Integer(N)
7
    e = Integer(e)
8
    cf = (e / N).continued_fraction().convergents()
9
    for f in cf:
10
        k = f.numer()
11
        d = f.denom()
12
        if k == 0:
13
            continue
14
        phi_N = ((e * d) - 1) / k
15
        b = -(N - phi_N + 1)
16
        dis = b ^ 2 - 4 * N
17
        if dis.sign() == 1:
18
            dis_sqrt = sqrt(dis)
19
            p = (-b + dis_sqrt) / 2
20
            q = (-b - dis_sqrt) / 2
21
            if p.is_integer() and q.is_integer() and (p * q) % N == 0:
22
                p = p % N
23
                q = q % N
24
                if p > q:
25
                    return (p, q)
26
                else:
27
                    return (q, p)
28
print(factor_rsa_wiener(N,e))
29

30
p=
31
q=N//p
32

33
from Crypto.Util.number import *
34

35
print(long_to_bytes(pow(c,inverse(e,(p-1)*(q-1)),N)))
36
#flag{Y0u_kNoW_C0n7lNu3d_Fr4c71on!}

1
from Crypto.Cipher import AES
2
import random
3

4
flag = '******'.encode()
5
p =
6

7
have = lambda s,t:
8
fun = lambda t:
9
def have_fun(a, b):
10
    res = g1
11
    while b:
12
        if b&1:
13
            res = have(res,a)
14
        a = fun(a)
15
        b >>= 1
16
    return res
17

18
g1 = (,)
19
g2 = (,)
20

21
key = random.randrange(2,1<<54)
22
y = have_fun(g2, key)
23

24
print('y =',y)
25

26
cipher = AES.new(str(key).encode()[:16], AES.MODE_ECB)
27
enc = cipher.encrypt(flag)
28
print('enc =', enc)

1
res = [have_fun(g2, i) for i in range(100)] + [g1, g2]
2

3
# x^3 + Ax^2 + Bx + Cy^2 + Dy + Exy + F = 0
4
M = []
5
Y = []
6
for x, y in res:
7
    M.append([x**2, x, y**2, y, x * y, 1])
8
    Y.append(-(x**3))
9

10
M = Matrix(Zmod(p), M)
11
Y = vector(Y)
12
X = M.solve_right(Y)

1
R = Zmod(p)["x, y"]
2
(
3
    x,
4
    y,
5
) = R._first_ngens(2)
6

7
A, B, C, D, E, F = X
8
f = x**3 + A * x**2 + B * x + C * y**2 + D * y + E * x * y + F
9

10
print(X, f, C)
11

12

13
def mapping(point):
14
    return (-point[0] * pow(C, -1, p) % p, -point[1] * pow(C, -1, p) % p)
15

16
f1 = (
17
    -1 * x**3
18
    + A * pow(C, -1, p) * x**2
19
    - B * pow(C, -2, p) * x
20
    + y**2
21
    - D * pow(C, -2, p) * y
22
    + E * pow(C, -1, p) * x * y
23
    + F * pow(C, -3, p)
24
)
25

26
C1 = EllipticCurve(f1)

1
order = G2.order()
2
factors = G2.order().factor()
3
print(factors)

1
moduli = []
2
residues = []
3

4
for p, e in factors[:-1]:
5
    assert e == 1
6
    x = discrete_log_lambda(
7
        (Y1 - G1) * (order // p), G2 * (order // p), bounds=(0, p), operation="+"
8
    )
9
    residues.append(x)
10
    moduli.append(p)
11

12
key = crt(residues, moduli)
13

14
assert key == discrete_log(
15
    (Y1 - G1) * factors[-1][0], G2 * factors[-1][0], operation="+"
16
)
17

18

19
enc =
20
cipher = AES.new(str(key).encode()[:16], AES.MODE_ECB)
21
flag = cipher.decrypt(enc)
22
print(flag)

1
from Crypto.Util.number import *
2
from gmpy2 import *
3
from secret import flag
4

5
m = bytes_to_long(flag)
6
p = getPrime(512)
7
q = next_prime(p)
8
n = p * q
9
e = 0x10001
10
d = inverse(e, (p-1) * (q-1))
11
c = pow(m, e, n)
12
print(f"c = {c}")
13
print(f"d = {d}")

1
from Crypto.Util.number import isPrime, long_to_bytes
2
import gmpy2
3

4
c =
5
d =
6
e = 65537
7

8
A = e * d - 1
9

10
for k in range(1, e):
11
    if A % k != 0:
12
        continue
13
    phi_candidate = A // k
14
    for t in range(2, 2000, 2):
15
        a = 1
16
        b = t - 2
17
        c_val = -t + 1 - phi_candidate
18
        disc = b*b - 4*a*c_val
19
        if disc < 0:
20
            continue
21
        sqrt_disc = gmpy2.isqrt(disc)
22
        if sqrt_disc * sqrt_disc != disc:
23
            continue
24
        p_candidate = (-b + sqrt_disc) // (2*a)
25
        if p_candidate <= 0:
26
            continue
27
        if isPrime(p_candidate) and isPrime(p_candidate + t) and gmpy2.next_prime(p_candidate) == p_candidate + t:
28
            p = int(p_candidate)
29
            q = p + t
30
            n = p * q
31
            phi = (p-1)*(q-1)
32
            if (e * d) % phi == 1:
33
                print(f"Found p = {p}")
34
                print(f"q = {q}")
35
                print(f"n = {n}")
36
                m = pow(c, d, n)
37
                flag = long_to_bytes(m)
38
                print(f"flag = {flag}")
39
# flag{Y0u_kNow_h0w_7o_f4cTor1z3_phI}

1
from Crypto.Util.number import *
2
from Crypto.Cipher import AES
3
from random import choice
4
from hashlib import md5
5
from secret import flag
6

7
p =
8
E = EllipticCurve(GF(p), [0, 5])
9

10
s = [E.random_element() for _ in range(73)]
11
e = [E.random_element() for _ in "01"]
12
A = random_matrix(GF(p), 137, 73)
13
b = [(sum(i*j for i,j in zip(_,s)) + choice(e)).xy() for _ in A]
14

15

16
print("A =", A.list())
17
print("b =", b)
18
print("enc =", AES.new(key=md5(str(s).encode()).digest(), nonce=b"LWECC", mode=AES.MODE_CTR).encrypt(flag))

1
A=[]
2
b=[]
3
enc =
4
from lll_cvp import reduce_mod_p
5
from Crypto.Cipher import AES
6
from hashlib import md5
7
def smart(P, Q):
8
    """
9
    Smart's attack in "The Discrete Logarithm Problem on Elliptic Curves of
10
    Trace One": find k such that k * P = Q
11

12
    Args:
13
        P: the P in k * P = Q
14
        Q: the Q in k * P = Q
15

16
    Returns:
17
        the recovered k
18
    """
19

20
    from sage.all import EllipticCurve, Qp, ZZ, randint, GF
21

22
    # references:
23
    # https://link.springer.com/article/10.1007/s001459900052
24
    # https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/smart_attack.py
25
    # https://ctftime.org/writeup/29702
26
    # https://shiftleft.com/mirrors/www.hpl.hp.com/techreports/97/HPL-97-128.pdf
27
    # https://crypto.stackexchange.com/questions/70454/why-smarts-attack-doesnt-work-on-this-ecdlp
28

29
    # order of E(Fp) equals to p
30
    E = P.curve()
31
    F = E.base_ring()
32
    p = F.characteristic()
33
    assert E.order() == p
34

35
    # lift the elliptic curve to Qp with precision = 2
36
    # add random multiples of p to avoid special case
37
    Eqp = EllipticCurve(Qp(p, 2), [ZZ(t) + randint(0, p) * p for t in E.a_invariants()])
38

39
    # lift P
40
    P_Qps = Eqp.lift_x(ZZ(P.xy()[0]), all=True)
41
    for P_Qp in P_Qps:
42
        if GF(p)(P_Qp.xy()[1]) == P.xy()[1]:
43
            break
44

45
    # lift Q
46
    Q_Qps = Eqp.lift_x(ZZ(Q.xy()[0]), all=True)
47
    for Q_Qp in Q_Qps:
48
        if GF(p)(Q_Qp.xy()[1]) == Q.xy()[1]:
49
            break
50

51
    # multiply by p
52
    p_times_P = p * P_Qp
53
    p_times_Q = p * Q_Qp
54

55
    # compute p-adic elliptic logarithm
56
    x_P, y_P = p_times_P.xy()
57
    x_Q, y_Q = p_times_Q.xy()
58
    phi_P = -(x_P / y_P)
59
    phi_Q = -(x_Q / y_Q)
60

61
    # compute k
62
    k = phi_Q / phi_P
63
    return ZZ(k)
64

65
p =
66
E = EllipticCurve(GF(p), [0, 5])
67
assert E.order() == p
68

69
gen = E.gen(0)
70
print(gen)
71

72
bs = []
73
for point in b:
74
    bs.append(smart(gen, E(point)))
75
print(bs)
76

77
F = GF(p)
78
m = 137
79
n = 73
80
A = matrix(F, m, n, A)
81
b = vector(F, bs)
82
one = vector(F, [1] * m)
83

84
L = A.T.stack(b).stack(one)
85
rr = reduce_mod_p(L, p)
86
assert len(set(rr[0])) == 2, "failed QQ"
87
*_, u, v = L.solve_left(rr[0])
88
e = (rr[0] - v * one) / u
89
print(e, set(e))  # vector e
90
s = A.solve_right(b - e)
91
s = [i * gen for i in s]
92

93
key = md5(str(s).encode()).digest()
94
aes = AES.new(key, AES.MODE_CTR, nonce=b"LWECC")
95
flag = aes.decrypt(enc)
96
print(flag)

1
from Crypto.Util.number import *
2
from secret import *
3

4
with open("message", "r") as f:
5
    message = f.read().strip().encode()
6

7
m = bytes_to_long(flag)
8
message = bytes_to_long(message)
9

10
p = getPrime(1024)
11
q = getPrime(25)
12
N = p * q
13
e = 65537
14

15
c = pow(message, e, N)
16
r1, r2 = getPrime(512), getPrime(512)
17
k = getPrime(64)
18

19
t1 = (k * inverse(m + r1, p)) % p
20
t2 = (k * inverse(m + r2, p)) % p
21

22
leak1 = t1 >> 244
23
leak2 = t2 >> 244
24

25
print(f'{e = }')
26
print(f'{N = }')
27
print(f'{c = }')
28

29
print(f'{k = }')
30
print(f'{r1 = }')
31
print(f'{r2 = }')
32
print(f'{leak1 = }')
33
print(f'{leak2 = }')

1
e = 65537
2
N =
3

4
k =
5
r1 =
6
r2 =
7

8
leak1 =
9
leak2 =
10

11
SHIFT = 244
12

13
q = min(p for p, _ in factor(N))
14
p = N // q
15

16
U1 = leak1 << SHIFT
17
U2 = leak2 << SHIFT
18

19
C1 = U1 * r1 - k
20
C2 = U2 * r2 - k
21

22
E_bits = 756
23
X = Integer(1) << (p.nbits() - E_bits)
24
M = Integer(1) << 760
25

26
B = Matrix(ZZ, [
27
    [p, 0, 0, 0],
28
    [0, p, 0, 0],
29
    [-U1, -U2, X, 0],
30
    [C1, C2, 0, M]
31
])
32

33
B = B.LLL()
34

35
for v in B:
36
    if abs(v[3]) == M or (v[3] % M == 0 and abs(v[3] // M) == 1):
37
        m = (-v[2]) // X
38
        print(m.to_bytes((m.nbits() + 7) // 8, 'big'))
39
        break

1
from sage.all import *
2
from sage.crypto.util import random_blum_prime
3
from Crypto.Util.number import *
4
from secret import flag
5

6
nbit = 512
7
gamma = 0.44
8
delta = 0.51
9
dm,dl = 0.103, 0.145
10
cpbit = ceil(nbit * gamma)
11
kbit  = int(nbit * delta)
12
msbit = int(nbit * dm)
13
lsbit = int(nbit * dl)
14
g = random_blum_prime(2**(cpbit - 1), 2**cpbit-1)
15
while 1:
16
    p = q = 0
17
    while is_prime(p) or len(bin(p)) - 2 != nbit // 2:
18
        a = randint(int(2 ** (nbit // 2 - 2) // g * gamma), 2 ** (nbit // 2 - 1) // g)
19
        p = 2 * g * a + 1
20
    while is_prime(q) or len(bin(q)) - 2 != nbit // 2:
21
        b = randint(int(2 ** (nbit // 2 - 2) // g * gamma), 2 ** (nbit // 2 - 1) // g)
22
        q = 2 * g * b + 1
23
    L = 2 * g * a * b
24
    if is_prime(L + a + b):
25
        n = p * q
26
        break
27

28
d = random_prime(2**kbit-1, lbound=2**(kbit - 1))
29
e = inverse_mod(d, L)
30
k = (e * d - 1) // L
31
dm = d // (2 ** (kbit - msbit))
32
dl = d % (2 ** lsbit)
33
m = bytes_to_long(flag)
34
print(dm, dl, e, n)
35
print(pow(m, e, n))

1
n=8073736467273664280056643912209398524942152147328656910931152412352288220476046078152045937002526657533942284160476452038914249779936821603053211888330755
2
e=36346110007425305872660997908648011390452485009167380402907988449045651435844811625907
3
c=8042279705649954745962644909235780183674555369775538455015331686608683922326562829164835918982642084136603628007677118144681339970688028985720674063973679
4

5
from Crypto.Util.number import *
6

7
p=11606767999414698455890262045272382868998286949
8
q=561544524741926577700278571
9
print(long_to_bytes(pow(c,inverse(e,(p-1)*(q-1)),p*q)))

1
import random
2

3
from Crypto.Util.number import *
4
from secret import flag, key
5

6
p, q, e, d = key
7
n = p * q
8

9
assert isPrime(p) and isPrime(q) and p.bit_length() == 512 and q.bit_length() == 512
10
print('d_len:', d.bit_length())
11
# d_len: 500
12

13
class QN:
14
    def __init__(self, a, b, c, d, n):
15
        self.a = a % n
16
        self.b = b % n
17
        self.c = c % n
18
        self.d = d % n
19
        self.n = n
20
    def __mul__(self, other):
21
        if isinstance(other, QN) and self.n == other.n:
22
            n = self.n
23
            a1, b1, c1, d1 = self.a, self.b, self.c, self.d
24
            a2, b2, c2, d2 = other.a, other.b, other.c, other.d
25
            a = (a1*a2 - b1*b2 - c1*c2 - d1*d2) % n
26
            b = (a1*b2 + b1*a2 + c1*d2 - d1*c2) % n
27
            c = (a1*c2 - b1*d2 + c1*a2 + d1*b2) % n
28
            d = (a1*d2 + b1*c2 - c1*b2 + d1*a2) % n
29
            return QN(a, b, c, d, n)
30
        return NotImplemented
31
    def __pow__(self, exp):
32
        if exp <= 0:
33
            return QN(1, 0, 0, 0, self.n)
34
        result = QN(1, 0, 0, 0, self.n)
35
        base = self
36
        while exp > 0:
37
            if exp & 1:
38
                result = result * base
39
            base = base * base
40
            exp >>= 1
41
        return result
42
    def __repr__(self):
43
        return f"({self.a}, {self.b}, {self.c}, {self.d})"
44
    def __eq__(self, other):
45
        return (self.a == other.a and self.b == other.b and
46
                self.c == other.c and self.d == other.d and self.n == other.n)
47

48
if __name__ == "__main__":
49
    m = QN(bytes_to_long(flag), random.randint(1,n-1), random.randint(1,n-1), random.randint(1,n-1), n)
50
    c = pow(m, e)
51
    assert pow(c,d) == m
52

53
    print(f"n = {n}")
54
    print(f"e = {e}")
55
    print(f"c = {c}")

1
from Crypto.Util.number import long_to_bytes
2

3
class QN:
4
    def __init__(self, a, b, c, d, n):
5
        self.a, self.b, self.c, self.d, self.n = a % n, b % n, c % n, d % n, n
6

7
    def __mul__(self, other):
8
        a1, b1, c1, d1 = self.a, self.b, self.c, self.d
9
        a2, b2, c2, d2 = other.a, other.b, other.c, other.d
10
        n = self.n
11
        return QN(
12
            (a1*a2 - b1*b2 - c1*c2 - d1*d2) % n,
13
            (a1*b2 + b1*a2 + c1*d2 - d1*c2) % n,
14
            (a1*c2 - b1*d2 + c1*a2 + d1*b2) % n,
15
            (a1*d2 + b1*c2 - c1*b2 + d1*a2) % n,
16
            n
17
        )
18

19
    def __pow__(self, exp):
20
        result, base = QN(1, 0, 0, 0, self.n), self
21
        while exp > 0:
22
            if exp & 1:
23
                result = result * base
24
            base = base * base
25
            exp >>= 1
26
        return result
27

28
def cf_terms(num, den):
29
    terms = []
30
    while den:
31
        terms.append(num // den)
32
        num, den = den, num - (num // den) * den
33
    return terms
34

35
def convergents(terms):
36
    p0, q0, p1, q1 = 0, 1, 1, 0
37
    for a in terms:
38
        p, q = a*p1 + p0, a*q1 + q0
39
        yield p, q
40
        p0, q0, p1, q1 = p1, q1, p, q
41

42
def wiener_recover_d(e, n, c_qn, prefix=b"flag{"):
43
    for k, d in convergents(cf_terms(e, n)):
44
        if d == 0 or k == 0 or (e*d - 1) % k != 0:
45
            continue
46
        m = c_qn ** d
47
        if long_to_bytes(m.a).startswith(prefix):
48
            return d, m
49
    return None, None
50

51
if __name__ == "__main__":
52
    n =
53
    e =
54
    c = QN(
55
    )
56

57
    d, m = wiener_recover_d(e, n, c)
58
    if d:
59
        print(long_to_bytes(m.a))

1
from Crypto.Cipher import AES
2
from Crypto.Util.Padding import pad, unpad
3
import os
4

5

6
class PaddingOracleClass:
7
    def __init__(self):
8
        self.key = os.urandom(16)
9
        self.auth = os.urandom(16)
10
        self.nonces = set()
11

12
        self.update(nonce=os.urandom(12))
13

14
    def update(self, nonce: bytes):
15
        assert nonce not in self.nonces, "Nonce Reuse Detected"
16

17
        self.nonces.add(nonce)
18
        self.nonce = nonce
19
        self.cnt = 2
20

21
    def register(self, username: bytes) -> tuple[bytes, bytes]:
22
        assert self.cnt, "Out of Services"
23
        self.cnt -= 1
24

25
        aes = AES.new(self.key, AES.MODE_GCM, nonce=self.nonce)
26
        aes.update(self.auth)
27
        tok, en = aes.encrypt_and_digest(pad(username, 16))
28
        return tok+en
29

30
    def login(self, token: bytes) -> bytes:
31
        assert self.cnt, "Out of Services"
32
        self.cnt -= 1
33

34
        aes = AES.new(self.key, AES.MODE_GCM, nonce=self.nonce)
35
        aes.update(self.auth)
36
        tok, en = token[:-16], token[-16:]
37
        username = unpad(aes.decrypt_and_verify(tok, en), 16)
38
        return username
39

40

41
MENU = '''
42
========== MENU ==========
43
cnt = {}
44
nonce = {}
45

46
= [U]pdate
47
= [R]egister
48
= [L]ogin
49
= [Q]uit
50
==========================
51
'''
52

53
poc = PaddingOracleClass()
54
while True:
55
    print(MENU.format(poc.cnt, poc.nonce.hex()))
56
    try:
57
        inp = input('>').upper()
58
        if inp == "Q":
59
            raise Exception
60

61
        elif inp == "U":
62
            poc.update(
63
                nonce=bytes.fromhex(input("nonce(hex)>"))
64
            )
65

66
        elif inp == "R":
67
            username = os.urandom(8)
68
            token = poc.register(username=username)
69
            print(f"Register!\n{token.hex()}")
70
            print(username.hex())
71

72
        elif inp == "L":
73
            token = bytes.fromhex(input("token(hex)>"))
74
            username = poc.login(token=token)
75
            print(f"Login!")
76
            if username == b"admin":
77
                with open("flag", "r") as f:
78
                    print(f.read())
79
                raise Exception
80
            else:
81
                print(f"Hello, what can I help you? {username.hex()}")
82
    except:
83
        print("Bye")
84
        break

1
from Crypto.Util.number import bytes_to_long, long_to_bytes
2
from Crypto.Util.Padding import pad
3
from pwn import *
4

5
def gmult(a, b):
6
    p = 0
7
    R = 0xe1000000000000000000000000000000
8
    for i in range(128):
9
        if (b >> (127 - i)) & 1:
10
            p ^= a
11
        high = a & 1
12
        a >>= 1
13
        if high:
14
            a ^= R
15
    return p
16

17
def gpow(a, b):
18
    r = 1 << 127
19
    while b:
20
        if b & 1:
21
            r = gmult(r, a)
22
        a = gmult(a, a)
23
        b >>= 1
24
    return r
25

26
def ginv(a):
27
    return gpow(a, (1 << 128) - 2)
28

29
def solve():
30
    io = remote("pwn-f4e2f49344.challenge.xctf.org.cn", 9999, ssl=True)
31

32
    def update_nonce(n):
33
        io.sendlineafter(b'>', b'U')
34
        io.sendlineafter(b'nonce(hex)>', n.hex().encode())
35

36
    def register():
37
        io.sendlineafter(b'>', b'R')
38
        io.recvuntil(b'\n')
39
        t = bytes.fromhex(io.recvline().strip().decode())
40
        u = bytes.fromhex(io.recvline().strip().decode())
41
        return t, u
42

43
    def login(t):
44
        io.sendlineafter(b'>', b'L')
45
        io.sendlineafter(b'token(hex)>', t.hex().encode())
46

47
    update_nonce(b'\x01' * 12)
48
    tok1, _ = register()
49
    tok2, _ = register()
50

51
    c1, t1 = tok1[:-16], tok1[-16:]
52
    c2, t2 = tok2[:-16], tok2[-16:]
53

54
    h2 = gmult(
55
        bytes_to_long(t1) ^ bytes_to_long(t2),
56
        ginv(bytes_to_long(c1) ^ bytes_to_long(c2))
57
    )
58

59
    update_nonce(b'\x02' * 12)
60
    tok3, u3 = register()
61

62
    c3, t3 = tok3[:-16], tok3[-16:]
63
    p3 = pad(u3, 16)
64

65
    keystream = bytes_to_long(c3) ^ bytes_to_long(p3)
66
    target_p = pad(b'admin', 16)
67
    target_c = long_to_bytes(bytes_to_long(target_p) ^ keystream).rjust(16, b'\x00')
68

69
    delta = gmult(bytes_to_long(target_c) ^ bytes_to_long(c3), h2)
70
    target_t = long_to_bytes(bytes_to_long(t3) ^ delta).rjust(16, b'\x00')
71

72
    login(target_c + target_t)
73
    print(io.recvall(timeout=2).decode(errors='ignore'))
74

75
if __name__ == "__main__":
76
    solve()

1
#include <stdio.h>
2
#include <unistd.h>
3
#include <string.h>
4
#include <openssl/sha.h>
5
#define BLOCK_SIZE 16
6

7
FILE *fp;
8

9
void Hash(unsigned char *msg, unsigned len)
10
{
11
    unsigned char tmp[32];
12
    memset(tmp, 0, 32);
13
    memcpy(tmp, msg, len < 32 ? len : 32);
14
    unsigned char hash[32];
15
    SHA256(tmp, 32, hash);
16
    memcpy(msg, hash, len < 32 ? len : 32);
17
}
18

19
void urandom(unsigned char *buf, int len)
20
{
21
    fread(buf, 1, len, fp);
22
}
23

24
void twist(unsigned char *msg) {
25
    unsigned long long in1 = 0, in2 = 0;
26
    for(int i = 0; i < BLOCK_SIZE; i++)
27
    {
28
        in1 <<= 4;
29
        in2 <<= 4;
30
        in1 |= msg[i] & 0xf;
31
        in2 |= msg[i] >> 4;
32
    }
33
    unsigned long long out1 = 0, out2 = 0;
34
    out1 = ((3*in1*in1 + in2) ^ (4*in2*in2)) - 2*in1;
35
    out2 = ((2*in1+in1) ^ (3*in1*in1 + in2)) * (2*in2) - ((3*in1*in1 + in2)*(3*in1*in1 + in2)*(3*in1*in1 + in2) & (8*in2*in2*in2)) - in2;
36
    for(int i = 0; i < BLOCK_SIZE; i++)
37
    {
38
        msg[i] = out1 & 0xf;
39
        msg[i] |= out2 & 0xf;
40
        out1 >>= 4;
41
        out2 >>= 4;
42
    }
43
}
44

45
void triple_key_cipher(int len, unsigned char *msg, unsigned char *key1, unsigned char *key2, unsigned char* key3)
46
{
47
    if(len % BLOCK_SIZE != 0)
48
        return;
49
    int i, j, k;
50
    unsigned char key_expand[BLOCK_SIZE][BLOCK_SIZE];
51
    unsigned char tmp = 0;
52
    twist(key1);
53
    for(i = 0; i < BLOCK_SIZE; i++)
54
        key_expand[0][i] = key1[i];
55
    for(i = 0; i < BLOCK_SIZE-1; i++)
56
    {
57
        key_expand[i+1][0] = key_expand[i][BLOCK_SIZE-1] * key1[0];
58
        for(j = 0; j < BLOCK_SIZE-1; j++)
59
            key_expand[i+1][j+1] = key_expand[i][j] + key_expand[i][BLOCK_SIZE-1] * key1[j+1];
60
    }
61
    printf("leak: "); for(int i = 0; i < BLOCK_SIZE; i++) printf("%.2hhx", key_expand[BLOCK_SIZE-1][i]); printf("\n");
62
    for(int block = 0; block < len / BLOCK_SIZE; block++)
63
    {
64
        twist(key3);
65
        unsigned char enc[BLOCK_SIZE];
66
        for(i = 0; i < BLOCK_SIZE; i++)
67
            enc[i] = msg[i+block*BLOCK_SIZE] * key2[0];
68
        for(i = 1; i < BLOCK_SIZE; i++)
69
        {
70
            for(j = 0; j < BLOCK_SIZE-i; j++)
71
                enc[i+j] = enc[i+j] + key2[i] * msg[j+block*BLOCK_SIZE];
72
            for(j = BLOCK_SIZE-i; j < BLOCK_SIZE; j++)
73
                for(k = 0; k < BLOCK_SIZE; k++)
74
                    enc[k] = enc[k] + key2[i] * msg[j+block*BLOCK_SIZE] * key_expand[i+j-BLOCK_SIZE][k];
75
        }
76
        for(i = 0; i < BLOCK_SIZE; i++)
77
            msg[i+block*BLOCK_SIZE] = enc[i] ^ key3[i];
78
    }
79
}
80

81
int main()
82
{
83
    setvbuf(stdin,NULL, 2, 0);
84
    setvbuf(stdout,NULL, 2, 0);
85

86
    fp = fopen("/dev/urandom", "r");
87

88
    int i, j;
89
    unsigned char key1[BLOCK_SIZE], key2[BLOCK_SIZE], key3[BLOCK_SIZE];
90
    urandom(key2, BLOCK_SIZE);
91
    Hash(key2, BLOCK_SIZE);
92
    for(j = 0; j < 10; j++)
93
    {
94
        write(1, "1. Encrypt\n2. Get flag\n3. Quit\nYour choice: ", 44);
95
        unsigned int opcode;
96
        read(0, &opcode, 1);
97
        getchar();
98
        printf("%hhx\n", opcode);
99
        switch (opcode)
100
        {
101
        case '1':
102
            write(1, "Message: ", 9);
103
            unsigned char msg[2*BLOCK_SIZE];
104
            memset(msg, 0, 2*BLOCK_SIZE);
105
            read(0, msg, 2*BLOCK_SIZE);
106
            Hash(msg, 2*BLOCK_SIZE);
107
            urandom(key1, BLOCK_SIZE); urandom(key3, BLOCK_SIZE);
108
            triple_key_cipher(2*BLOCK_SIZE, msg, key1, key2, key3);
109
            printf("enc: "); for(int i = 0; i < 2*BLOCK_SIZE; i++) printf("%.2hhx", msg[i]); printf("\n");
110
            break;
111
        case '2':
112
            write(1, "Key: ", 5);
113
            unsigned char usr_key[BLOCK_SIZE];
114
            read(0, usr_key, BLOCK_SIZE);
115
            if(memcmp(usr_key, key2, BLOCK_SIZE) == 0)
116
            {
117
                FILE* file = fopen("flag", "r");
118
                unsigned char flag[60];
119
                fread(flag, 1, 60, file);
120
                fclose(file);
121
                printf("flag: %s\n", flag);
122
                return 0;
123
            }
124
            else
125
            {
126
                write(1, "Wrong!\n", 7);
127
            }
128
            break;
129
        case '3':
130
            return 0;
131
        default:
132
            break;
133
        }
134
    }
135
    fclose(fp);
136
    return 0;
137
}