a ctfer on the load

1
import gmpy2
2
from gmpy2 import *
3
from Crypto.Util.number import *
4
from random import randint
5
from gmpy2 import invert
6
from scret import flag
7

8
def myfunction(num):
9
    output = 0
10
    output=num**3
11
    return output
12

13
if __name__ == '__main__':
14
    flag_len = len(flag)
15
    p, q = getPrime(512), getPrime(512)
16

17
    while True:
18
        r = getPrime(512)
19
        R = bytes_to_long(str(r).encode())
20
        if isPrime(R):
21
            break
22

23
    n = p * q * r
24
    hint1 = R * r
25
    mod = myfunction(n)
26
    hint2 = pow(3*n+1, p % (2 ** 400), mod)
27
    m = bytes_to_long(flag)
28
    c = pow(m, 65537, n)
29

30
    print('All data:')
31
    print(f'n = {n}')
32
    print(f'c = {c}')
33
    print(f'hint1 = {hint1}')
34
    print(f'hint2 = {hint2}')

1
import hashlib
2
import random
3
from ecdsa import NIST256p, SigningKey
4

5
class FlawedNonceGenerator:
6
    def __init__(self, n):
7
        self.n = n
8
        self.a = random.randrange(1, n)
9
        self.b = random.randrange(1, n)
10
        self.c = random.randrange(1, n)
11
        self.last_k = random.randrange(1, n)
12

13
    def generate_nonce(self):
14
        current_k = self.last_k
15
        next_k = (self.a * current_k**2 + self.b * current_k + self.c) % self.n
16
        self.last_k = next_k
17

18
        return current_k
19

20

21
curve = NIST256p
22
n = curve.order
23
private_key = SigningKey.from_secret_exponent(random.randrange(1, n), curve=curve)
24
d = private_key.privkey.secret_multiplier
25
public_key = private_key.get_verifying_key()
26

27
messages = [
28
    b"Hello player, welcome to L3HCTF 2025!",
29
    b"This is a crypto challenge, as you can probably tell.",
30
    b"It's about ECDSA, a very... robust algorithm.",
31
    b"I'm sure there are no implementation flaws whatsoever.",
32
    b"Anyway, here are your signatures. Good luck!",
33
    f"Oh, and the flag is L3HCTF{{{d}}}. Don't tell anyone!".encode(),
34
]
35
nonce_generator = FlawedNonceGenerator(n)
36
f = open('signatures.txt', 'w')
37

38
for i in range(6):
39
    k = nonce_generator.generate_nonce()
40
    message = messages[i]
41
    h = int.from_bytes(hashlib.sha256(message).digest(), 'big')
42
    R = k * curve.generator
43
    r = R.x() % n
44
    s_inv = pow(k, -1, n)
45
    s = (s_inv * (h + d * r)) % n
46
    f.write(f"h: {h}, r: {r}, s: {s}\n")

1
import hashlib
2

3
n = 115792089210356248762697446949407573529996955224135760342422259061068512044369
4
signatures_text = """
5

6
"""
7
lines = signatures_text.strip().split('\n')
8
signatures = []
9
for line in lines:
10
    parts = line.split(', ')
11
    h = Integer(parts[0].split(': ')[1])
12
    r = Integer(parts[1].split(': ')[1])
13
    s = Integer(parts[2].split(': ')[1])
14
    signatures.append({'h': h, 'r': r, 's': s})
15

16
R = GF(n)
17
P.<d> = PolynomialRing(R)
18
u_vals, v_vals = [], []
19
for sig in signatures[:5]:
20
    h, r, s = R(sig['h']), R(sig['r']), R(sig['s'])
21
    s_inv = s.inverse()
22
    u_vals.append(s_inv * h)
23
    v_vals.append(s_inv * r)
24

25
k = [u_vals[i] + v_vals[i] * d for i in range(5)]
26
M_data = [[k[i]**2, k[i], R(1), k[i+1]] for i in range(4)]
27
M = Matrix(P, M_data)
28
det_poly = M.determinant()
29
roots = det_poly.roots()
30
print(roots)

1
from sage.all import *
2

3
from secret import flag
4

5
def generate_vulnerable_key(bits=1024):
6
    p_bits = bits // 2
7
    q_bits = bits - p_bits
8

9
    while True:
10
        p = random_prime(2**(p_bits), lbound=2**(p_bits-1))
11
        q = random_prime(2**(q_bits), lbound=2**(q_bits-1))
12
        if p != q and p > q and p < 2*q:
13
            break
14

15
    N = p * q
16
    phi = (p**4 - 1) * (q**4 - 1)
17

18
    d_bits = 1024
19
    d_bound = 2**d_bits
20

21
    while True:
22
        d_small = randint(2, d_bound)
23
        d = phi - d_small
24
        if gcd(d, phi) == 1:
25
            if d_small.bit_length() == 1021:
26
                break
27

28
    e = inverse_mod(d, phi)
29

30
    return N, e
31

32
def encrypt(m, N, e):
33
    n = 4
34
    r = 2
35
    R = Integers(N)
36
    P = PolynomialRing(R, 't')
37
    t = P.gen()
38
    Q = P.quotient(t**n - r)
39

40
    m_poly = Q([m, 0, 0, 0])
41

42
    c_poly = m_poly ** e
43

44
    return c_poly.lift()
45

46
if __name__ == "__main__":
47
    N, e = generate_vulnerable_key()
48
    m = int.from_bytes(flag, 'big')
49
    c = encrypt(m, N, e)
50

51
    print(f"N = {N}")
52
    print(f"e = {e}")
53
    print(f"c = {c}")

1
from sage.all import *
2
from Crypto.Util.number import *
3
N =
4
e =
5
c =
6

7
nn = N**4
8

9
alpha = e / nn
10

11
cf = continued_fraction(alpha)
12
convergents = cf.convergents()
13

14
for conv in convergents:
15
    k_candidate = conv.numerator()
16
    d_small_candidate = conv.denominator()
17

18
    if d_small_candidate >= 2**1020 and d_small_candidate < 2**1021:
19
        try:
20
            c_inv = inverse(c, N)
21
            m = pow(c_inv, d_small_candidate, N)
22

23
            flag = long_to_bytes(m)
24

25
            if b'L3HCTF{' in flag:
26
                print("Flag found:", flag)
27
                break
28
        except:
29
            continue
30

31
else:
32
    print("fuck")