已知n,e,c,但p,q相差不大,求m

题目:

from Crypto.Util.number import *
import gmpy2
flag = b'NSSCTF{******}'

p = getPrime(512)
q = gmpy2.next_prime(p)
n = p*q
e = 65537
phi = (p-1)*(q-1)

m = bytes_to_long(flag)

c = pow(m, e, n)

print(f'n = {n}')
print(f'e = {e}')
print(f'c = {c}')

'''
n = 115637000420176820831322601039129424406844427046456738651883381559357542765613732363445112111006849040385859313572091386802534464534403117787314180179562651607533039692795522388596550968316951090748054495960090527479954143448774136390568881020918710834542819900918984139672802889774720153267841255456602500057
e = 65537
c = 98161406745910866780822530171878255235776133393411573803496865047700715941955255328757920065032397556905095591171977170479344602512244671081108703687450560269408412671849929423399172588599903975793985819498354819305128607934552101433664794909855378636055525016664559476808490723554481335856183927702549281730
'''

解题思路:

p和q挨的很近,这个算法的原理是p,q是两个素数,而且他们俩在素数序列里面是一前一后的关系,所以把它们俩的乘积根号得到的结果一定是p,q之间的一个数,那就可以找这一个数的下一个素数(q),再用n/q得到p

• 测试一下你会发现大部分情况下二者的差值都小于1000

from Crypto.Util.number import *
import gmpy2
p = getPrime(512)
q = gmpy2.next_prime(p)
print(q-p)

• 考虑n的算术平方根为sn=√n,同时sn也是p和q的几何平均值
• 此时则有p < sn < q
• q,p是相邻的素数,p的下一个素数为q,同理也有sn的下一个素数也应该是q

sn = isqrt(n)
q = next_prime(sn)
p = n // q

• 注意除的时候用整除

解答:

from Crypto.Util.number import *
from gmpy2 import *

n = 115637000420176820831322601039129424406844427046456738651883381559357542765613732363445112111006849040385859313572091386802534464534403117787314180179562651607533039692795522388596550968316951090748054495960090527479954143448774136390568881020918710834542819900918984139672802889774720153267841255456602500057
e = 65537
c = 98161406745910866780822530171878255235776133393411573803496865047700715941955255328757920065032397556905095591171977170479344602512244671081108703687450560269408412671849929423399172588599903975793985819498354819305128607934552101433664794909855378636055525016664559476808490723554481335856183927702549281730

sn = isqrt(n)
q = next_prime(sn)
p = n // q

phi = (p-1)*(q-1)
d = invert(e, phi)

m = pow(c, d, n)
print(long_to_bytes(m))
#NSSCTF{so_closed}