多因子变形1

题目:

from Crypto.Util.number import *

flag = b'NSSCTF{******}'

p = getPrime(512)
q = getPrime(512)

e = 65537
while True:
    r = 2*getPrime(100)*e+1
    if isPrime(r):
        break

n = p*q*r

m = bytes_to_long(flag)

c = pow(m, e, n)

print(f'p = {p}')
print(f'q = {q}')
print(f'r = {r}')
print(f'e = {e}')
print(f'c = {c}')

'''
p = 7478755670255767435237487693415479182290330775502792675052667363676831056436638619069277770540533350723045234676443621124912287506103439704868369839725279
q = 9232828888049557325429111621080998490274442347556398052322580869768941301413255711626092627273543579067597113958627672298942570149816938335701615759283713
r = 102909133680612532601801231903654039
e = 65537
c = 142893174944324070830219394465469685943669308818639857030565389839224452373848570577201378981080333784852764502832587008270072323948511579823852437852643609820245476634896477031076952735298279618952398460203032125853063235638358942643559551563899381032067185778629120272032518475352761100115057449043142848203976076694124978394099839339406197
'''

解题思路:

• 此处的r = 2×getPrime(100)×e+1
• 看一下此时的phi = (p−1)(q−1)(r−1) = (p−1)(q−1)×2×getPrime(100)×e
• 然后我们可以发现e整除phi,所以他们二者是不互素的,不互素则逆元不存在
• 我们可以考虑flag比较短,即flag转为数字后的数m足够小
• m mod pq ≡ m mod n
  也就是说m不仅比n(这里的n=pqr)还小也比pq还小,所以取模得到的结果也相同
• c1 = c mod pq = (m^e mod n) mod pq = m^e mod pq
  ed1 ≡ 1(mod φ(pq))
  c1^d1 ≡ m(mod pq)
• 即c1为c再模pq的结果,根据模的性质有c1便是消息使用公钥(pq,e)加密的结果,那么此时我们可以求出该公钥对应的私钥进行解密,得到m mod pq的结果,又因为m比较小,所以该结果直接就是m

解答:

from Crypto.Util.number import *
from gmpy2 import *

p = 7478755670255767435237487693415479182290330775502792675052667363676831056436638619069277770540533350723045234676443621124912287506103439704868369839725279
q = 9232828888049557325429111621080998490274442347556398052322580869768941301413255711626092627273543579067597113958627672298942570149816938335701615759283713
r = 102909133680612532601801231903654039
e = 65537
c = 142893174944324070830219394465469685943669308818639857030565389839224452373848570577201378981080333784852764502832587008270072323948511579823852437852643609820245476634896477031076952735298279618952398460203032125853063235638358942643559551563899381032067185778629120272032518475352761100115057449043142848203976076694124978394099839339406197

n = p*q*r
phi = (p-1)*(q-1)
d = invert(e, phi)
m = pow(c, d, p*q)

print(long_to_bytes(m))
#NSSCTF{no_inverse!but_decrypt}