d泄露但n未知

题目:

from Crypto.Util.number import *
from gmpy2 import *
 
flag="ctfshow{***}"
m=bytes_to_long(flag.encode())
e=65537
p=getPrime(128)
q=getPrime(128)
n=p*q
phin=(p-1)*(q-1)
d=invert(e,phin)
c=pow(m,e,n)
print("c=",c)
print("hint=",pow(n,e,c))
print("e=",e)
print("d=",d)
"""
c= 48794779998818255539069127767619606491113391594501378173579539128476862598083
hint= 7680157534215495795423318554486996424970862185001934572714615456147511225105
e= 65537
d= 45673813678816865674850575264609274229013439838298838024467777157494920800897
"""

解题思路:

• 题目给了pow(n,e,c),已知 n>c,那么可以先分解c用rsa求出n-c,从而得到n,后续就是直接解出flag
• m=pow(c,d,n+c)

解答:

from Crypto.Util.number import *
 
e = 65537
hint = 7680157534215495795423318554486996424970862185001934572714615456147511225105
c = 48794779998818255539069127767619606491113391594501378173579539128476862598083
p1 = 6091
q1 = 8010963716765433514869336359812774009376685535134030237002058632158407913
phi1 = (p1 - 1) * (q1 - 1)
d1 = inverse(e, phi1)
n = pow(hint,d1,c)
 
while True:
    d = 45673813678816865674850575264609274229013439838298838024467777157494920800897
    n += c
    flag = long_to_bytes(pow(c,d,n))
    if b"ctfshow{" in flag:
        print(flag)
        break
#ctfshow{Oh_u_knOw_4uler}

from Crypto.Util.number import *
import gmpy2

c = 48794779998818255539069127767619606491113391594501378173579539128476862598083
hint = 7680157534215495795423318554486996424970862185001934572714615456147511225105
e = 65537
d = 45673813678816865674850575264609274229013439838298838024467777157494920800897
cp = 6091
cq = 8010963716765433514869336359812774009376685535134030237002058632158407913

phic = (cp - 1) * (cq - 1)

print(gmpy2.gcd(e, phic))
#1
dc = gmpy2.invert(e, phic)

n = pow(hint, dc, c)

n = n + c

print(long_to_bytes(int(pow(c, d, n))))
#ctfshow{Oh_u_knOw_4uler}

把n看作a+c,那么n^e mod c=a^e mod c,这一步就是二项式定理,展开之后后的项一定会有c,那么mod c时就会直接约去,这个时候直接去算a的大小,n就出来了

from Crypto.Util.number import *
from gmpy2 import *

c= 48794779998818255539069127767619606491113391594501378173579539128476862598083
hint= 7680157534215495795423318554486996424970862185001934572714615456147511225105
e= 65537
d= 45673813678816865674850575264609274229013439838298838024467777157494920800897

phic=euler_phi(c)

print(gcd(e,phic))
#1
dc=invert(e,phic)

a=pow(hint,dc,c)

n=int(a)+int(c)

print(long_to_bytes(int(pow(c,d,n))))
#ctfshow{Oh_u_knOw_4uler}