Posts on Perox https://p3r0x.github.io/post/ Recent content in Posts on Perox Hugo -- 0.152.2 zh-cn Perox Tue, 19 May 2026 20:14:14 +0800 Jacobian雅可比坐标（ECC) https://p3r0x.github.io/p/jacobian%E9%9B%85%E5%8F%AF%E6%AF%94%E5%9D%90%E6%A0%87ecc/ Tue, 19 May 2026 20:14:14 +0800Peroxhttps://p3r0x.github.io/p/jacobian%E9%9B%85%E5%8F%AF%E6%AF%94%E5%9D%90%E6%A0%87ecc/ jacobian

避免逆运算过于难算将仿射坐标转化为雅可比坐标

定义

对一个椭圆曲线：$y^2≡x^3+ax+b \mod p$

将坐标(x,y)等价表示为：$(X,Y,Z)$

$x = \frac{X}{Z^2} \ y = \frac{Y}{Z^3}$

代入原方程得:

$$ Y^2≡X^3+aXZ^4+bZ^6 \mod p $$

点加法(P≠Q)

仿射坐标下：

$$ \left\{ \begin{aligned} \lambda &= \frac{y_2 - y_1}{x_2 - x_1} \\ x_3 &= \lambda^2 - x_1 - x_2 \\ y_3 &= \lambda(x_1 - x_3) - y_1 \end{aligned} \right. $$

$x_1 = \frac{X_1}{Z^2_1} \ y_1 = \frac{Y_1}{Z^3_1}$

$x_2 = \frac{X_2}{Z^2_2} \ y_2 = \frac{Y_2}{Z^3_2}$​

令$U_1=X_1Z_2^2,U_2=X_2Z_1^2$

$S_1=Y_1Z_2^3,S_2=Y_2Z_1^3$

$令H=U_2-U_1$

$R=S_2-S_1$

所以

$$ \lambda =\frac{R}{H} \frac{1}{Z_1Z_2} $$$$ x_3 = \frac{R^2-H^2Z_2^2X_1-H^2Z_1^2X_2}{H^2Z_1^2Z_2^2}\\ 所以x_3=\frac{R^2-H^2(U_2+U_1)}{H^2Z_1^2Z_2^2}\\ 因为H=U_2-U_1,所以U_1+U_2=2U_1+H\\ x_3=\frac{R^2-2U_1H^2-H^3}{H^2Z_1^2Z_2^2} 所以按照x=\frac{X}{Z^2}，令z_3=HZ_1Z_2\\ X_3=R^2-2U_1H^2-H^3\\ Y_3可以同样化简为:Y_3=R(U_1H^2-X_3)-S_1H^3 $$

得到$(X_3,Y_3,Z_3)$

然后得到$(x_3,y_3)$

点倍加（P=Q）

若P=Q时,切线代替割线：

$$ λ=\frac{3x_1^2+a}{2y_1} \mod p $$$$ x_3=λ^2-2x_1 \mod p\\ y_3=λ(x_1-x_3)-y_1 $$$$ x_1=\frac{X_1}{Z_1^2},y_1=\frac{Y_1}{Z_1^3} $$

则：

$$ \lambda=\frac{3X_1^2+aZ_1^4}{2Y_1Z_1} $$

令：

$$ M=3X_1^2+aZ_1^4 $$$$ S=4X_1Y_1^2 $$

由：

$$ x_3=\lambda^2-2x_1 $$

得到：

$$ x_3=\frac{M^2-2S}{4Y_1^2Z_1^2} $$

因此令：

$$ Z_3=2Y_1Z_1 $$

得到：

$$ X_3=M^2-2S $$

再由：

$$ y_3=\lambda(x_1-x_3)-y_1 $$

得到：

$$ Y_3=M(S-X_3)-8Y_1^4 $$

因此：

$$ 2P=(X_3,Y_3,Z_3) $$

其中：

$$ X_3=M^2-2S \\ Y_3=M(S-X_3)-8Y_1^4 \\ Z_3=2Y_1Z_1 $$

最后恢复仿射坐标：

$$ x_3=\frac{X_3}{Z_3^2},y_3=\frac{Y_3}{Z_3^3} $$]]> 双线性映射 weil pairing https://p3r0x.github.io/p/%E5%8F%8C%E7%BA%BF%E6%80%A7%E6%98%A0%E5%B0%84-weil-pairing/ Fri, 17 Apr 2026 19:37:01 +0800Peroxhttps://p3r0x.github.io/p/%E5%8F%8C%E7%BA%BF%E6%80%A7%E6%98%A0%E5%B0%84-weil-pairing/ 双线性映射

定义

$G_1,G_2为两个q阶循环群，G_1是F_p椭圆曲线上的点群，G_2是F_{p^2}^*的子群，所以$定义了$f:G_1 ×G_2→G_T$，其中$G_1和G_2$为加法群，$G_T$为乘法群

有$g_1∈G_1,g_2∈G_2,a,b∈Z$，满足：

  1. 双线性性：$e(a*g_1,b*g_2)=e(g_1,g_2)^{ab}$​

    或者定义为：$e(P,Q+R)=e(P,Q)*e(P,R) \\ e(P+S,Q)=e(P,Q)*e(S,Q)$

  2. 非退化性：满足$e(g_1,g_2)≠e_{G_T}$，$e_{G_T}$代表 $G_T$的单位元

  3. 可计算性：存在有效算法$e(g_1,g_2)$​

线性映射

线性映射如:

$$ f(x+y)=f(x)+f(y)\\ f(ax)=af(x) $$

对两个变量，分别单独看都是线性的，合在一起就叫双线性

如果有变量x,y，函数F(x,y)：

  • 固定x,变化y：函数对y是线性的
  • 固定y,变化x：函数对x是线性的

weil配对

Weil对可将椭圆曲线的挠群上的两个点，映射到一个特殊有限域的乘法子群上，借此可将椭圆曲线离散对数问题（ECDLP）投射到一般的离散对数问题（DLP）

$n$-torsion点：如果一个点$P$被“加自己”若干次以后会回到单位元 $\mathcal O$，那它就是torsion点，表现为$nP=\mathcal O$

$E[n]$：所有满足$nP=\mathcal O$的点放在一起，形成一个子群，记作$E[n]$

单位根：满足$\zeta^n=1$的数叫$n$次单位根，比如复数里$1,-1,i,-i$ 是4次单位根

除子：记录函数在哪些点有零、哪些点有极点，以及它们各自重复多少次，记作$\operatorname{div}(f)=n(P)-n(\mathcal O)$，表示在$P$有$n$重零点，在$\mathcal O$有$n$重极点：

$$ 设有理函数f(X) = \frac{a_0 + a_1 X + \cdots + a_n X^n}{b_0 + b_1 X + \cdots + b_m X^m}\\ 在复数范围内进行因子分解：f(X) = \frac{a(X - \alpha_1)^{e_1} (X - \alpha_2)^{e_2} \cdots (X - \alpha_r)^{e_r}} {b(X - \beta_1)^{d_1} (X - \beta_2)^{d_2} \cdots (X - \beta_s)^{d_s}}\\ $$

可写作： $$ \operatorname{div}(f(X)) \triangleq e_1[\alpha_1] + e_2[\alpha_2] + \cdots + e_r[\alpha_r]

  • d_1[\beta_1] - d_2[\beta_2] - \cdots - d_s[\beta_s] $$ 表示$e_1$个$$\alpha_1$$零点…在$d_1$有$\beta_1$个极点…

定义

设$P,Q \in E[n]$，选择函数$f_P,f_Q$，满足

$$ \operatorname{div}(f_P) = n(P) - n(\mathcal O)\\ \operatorname{div}(f_Q) = n(Q) - n(\mathcal O) $$

可定义为：

$$ e_n(P,Q) = \frac{f_P(Q+S)}{f_P(S)} \bigg/ \frac{f_Q(P-S)}{f_Q(-S)}. $$

S为辅助点，为E中任意元素，且满足$S \notin \{\mathcal{O}, P,-Q,P,-Q\}\,$

只要输入的两个点P和Q都是n-torsion点，配对的输出$e_n(P,Q)$满足所有$x^n=1$的集合

题

红名谷2025

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

from Crypto.Util.number import *
from Crypto.Util.Padding import pad
from sage.all import *
from functools import reduce

def mul(numbers):
    return reduce(lambda x, y: x * y, numbers)

res = [4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272555731, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556223, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556437, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556749, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557237, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557459, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557687, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272558239, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272558627, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559239, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559523, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559787, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560169, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560343, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560433, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560751, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560969, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272561441, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272562103, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272562601, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563261, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563297, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563391, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563511, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563711]
p = res[11]
pp = mul(res)
K = GF(p)
E = EllipticCurve(K, (0, 4))
qwq = 0x320238b
qaq = E.order()//qwq**2

flag = pad(open("flag.txt", "rb").read().strip(),4)
flag_part = [bytes_to_long(flag[i:i+2]) for i in range(0, len(flag), 2)]

output = []
for c in flag_part:
    P1 = qaq*E.random_element()
    P2 = qaq*E.random_element()
    out = P1.weil_pairing(P2, qwq)**3*c
    output.append(pow(out,qaq, pp))
print(output)

E的阶为qaq*qwq^2^,因为flag_part的每个元素为两个字节，也就是16bit，所以表示的范围为（0，$2^{16}$）

pytho 
1
2

    P1 = qaq*E.random_element()
    P2 = qaq*E.random_element()

这两行代码将p1和p2投影到了qwq^2^阶子群，然后对这两个点进行weil配对，所以输出结果应该为qwq次单位根：

$$ e_{qwq}(p_1,p_2)^{qwq}=1 $$

所以$output=(e_{qwq}(p_1,p_2)^3*c)^{qaq} \ mod \ pp$

两边qwq次幂得到$output^{qwq}=c^{qwq*qaq}$

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

from sage.all import *
from Crypto.Util.number import *
res = [4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272555731, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556223, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556437, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272556749, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557237, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557459, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272557687, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272558239, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272558627, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559239, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559523, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559787, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560169, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560343, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560433, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560751, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272560969, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272561441, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272562103, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272562601, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563261, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563297, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563391, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563511, 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272563711]
p = res[11]
pp = mul(res)
K = GF(p)
E = EllipticCurve(K, (0, 4))
qwq = 0x320238b
qaq = E.order()//qwq**2
output = [2258729984869869545899085887518820011795880892632317458813070773270633871398785757696896679887453336507722151037267, 1843407310728065127389586068976768146728145160643439144895915852634291722663455873979176336542780552480617232750208, 1107061034832953338095294459542523703297843192927313275050958753437078121375795698115353665062727895555487155331316, 460337686287218470707660572908024613140030922587867288532588857547792028112129697850035268228038619747643899804437, 1659483062154723617504533638726171721668768657049197025961515070605996080663312140357834824850074607457421362000265, 3150528329201636320206556304125544975332446992414777732425647667048147102509308959254762895094589762017857965981432, 3338854035461286314545186888372727000962778038359519702308782495912356677650264814573463929190025956045491115654437, 3042574495339632074308497406446851120362994432361876743901608172567070991832258762751304397604780567703759317642849, 380771388315580393673388198522357440257018642337119013880143084485482127962577943753495690258532782147018511750175, 507222017133457507399048159541059729302482262298099528096040456818913085187752925782279385808732260473494863290057, 533663958640518878580794848474449572155795564171089765377581587253792204491009275840408579120376539757958097910250, 2681145160205204287930367627648683111546318004811732016137828270063753300095675791698398080219566725174890793619305, 3259478178021541801713314504097142165241891541242669456591074651894459393333167453811425864198267757724232689747676, 3553147298452254907907643059383506744982654808021508866104139240155822133286673657139615950259800036058045049186173, 1778776925369812510137824472396145391840300438509021838870105004154301861222612045533034046889878767915343446874895, 3409071358092535255033136229525415652816479844958949032220987821989305575696869929136493897719813036034016228268240, 571819148781137687997336847709735468532344087614483867682513640750800758034003212746545051127998686475933050072942, 2676666310158795770609746651024766841212271213339384335651155407291004834251914242990757216402110096603729617413168, 2557670339976470006330058052583841683167706755578266425502679937976714609864257535859316483527764340425703004883241, 973319024062640263364951783086923560907216776835485042157036675663719529568519121997200478026304141184810597275543, 1189768012357955450386827626693191057999220508190415783719135619271537446794904663649700073564180453068646130539863, 790522915783756530835443034667719516913120763875831140857606265058871034793645280121113275798239222760522467771184]
flag = []
for i in output:
    flag_part = pow(i,qwq,p)
    for h in range(65537):
        if pow(h,qaq*qwq,p) == flag_part:
            flag.append(h)
            break
flag = b''.join([long_to_bytes(i) for i in flag])
print(flag)
]]> cryptohack lwe wp https://p3r0x.github.io/p/cryptohack-lwe-wp/ Tue, 10 Mar 2026 18:00:00 +0800Peroxhttps://p3r0x.github.io/p/cryptohack-lwe-wp/ LWE High Bits Message
python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# dimension
n = 64
# plaintext modulus
p = 257
# ciphertext modulus
q = 0x10001
# bound for error term
error_bound = int(floor((q/p)/2))
# message scaling factor
delta = int(round(q/p))


V = VectorSpace(GF(q), n)
S = V.random_element()
print("S = ", S, "\n")

m = ?

A = V.random_element()
error = randint(-error_bound, error_bound)
b = A * S + m * delta + error

print("A = ", A)
print("b = ", b)

缩放因子delta=round(q/p)

b=A * S+m * delta+e(mod q)

所以$m*{\delta}+e=b-A*S=t$

$m + \frac{e}{\delta} = \frac{t}{\delta}$

e在$(-\frac{\delta}{2},\frac{\delta}{2})$之间，所以相当于m+x,x∈$(-\frac{1}{2},\frac{1}{2})$所以四舍五入就是m

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

from sage.all import *
from Crypto.Util.number import*

S =  (55542, 19411, 34770, 6739, 63198, 63821, 5900, 32164, 51223, 38979, 24459, 10936, 17256, 20215, 35814, 42905, 53656, 17000, 1834, 51682, 43780, 22391, 33012, 61667, 37447, 16404, 58991, 61772, 44888, 43199, 32039, 26885, 17206, 62186, 58387, 57048, 38393, 29306, 58001, 57199, 33472, 56572, 53429, 62593, 14134, 40522, 25106, 34325, 37646, 43688, 14259, 24197, 33427, 43977, 18322, 38877, 55093, 12466, 16869, 25413, 54773, 59532, 62694, 13948) 

A =  (13759, 12750, 38163, 63722, 39130, 22935, 58866, 48803, 15933, 64995, 60517, 64302, 42432, 32000, 22058, 58123, 53993, 33790, 35783, 61333, 53431, 43016, 60795, 25781, 28091, 11212, 64592, 11385, 24690, 40658, 35307, 63583, 60365, 60359, 32568, 35417, 22078, 38207, 16331, 53636, 28734, 30436, 18170, 15939, 966, 48519, 41621, 36371, 41836, 4026, 33536, 57062, 52428, 59850, 476, 43354, 61614, 32243, 42518, 19733, 63464, 29357, 56039, 15013)
b =  44007
# dimension
n = 64
# plaintext modulus
p = 257
# ciphertext modulus
q = 0x10001


error_bound = int(floor((q/p)/2))
delta = int(round(q/p))
AS=sum(A[i]*S[i] for i in range(len(S)))%q
t = (b-AS)%q
m = int(round(t/delta))%p
print(m)

LWE Low Bits Message

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# dimension
n = 64
# plaintext modulus
p = 257
# ciphertext modulus
q = 0x10001
# bound for error term
error_bound = int(floor((q/p)/2))


V = VectorSpace(GF(q), n)
S = V.random_element()
print("S = ", S, "\n")

m = ?

A = V.random_element()
error = randint(-error_bound, error_bound)
b = A * S + error * p + m

print("A = ", A)
print("b = ", b)

模q的值可能是：

  • x
  • x+q

范围在[0,q-1]，所以当x+q(即x<0)时，减一个q就可以复原，然后因为x=p*e+m，所以对m取模就可以得到m

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

from sage.all import *
n = 64
# plaintext modulus
p = 257
# ciphertext modulus
q = 0x10001
# bound for error term
S =  (10082, 48747, 17960, 55638, 37012, 51876, 10128, 37750, 7608, 58952, 33296, 25463, 38900, 85, 65248, 42153, 44966, 31594, 40676, 56828, 30325, 38502, 65083, 7497, 2667, 54022, 24029, 32162, 57267, 12253, 6668, 5181, 14906, 51655, 61347, 4722, 22227, 23606, 63183, 52860, 1670, 31085, 42633, 47197, 7255, 16150, 9574, 62956, 26742, 57998, 49467, 31224, 60073, 12730, 41419, 41042, 53032, 16339, 32913, 16351, 34283, 47845, 3617, 35718) 

A =  (53751, 21252, 55954, 16345, 60990, 2822, 56279, 37048, 36153, 52141, 2121, 56565, 48112, 43755, 12951, 22539, 29478, 28421, 62175, 10265, 36378, 21305, 42402, 26359, 939, 60690, 1161, 65097, 34505, 19777, 29652, 42868, 49148, 38296, 31916, 25606, 18700, 12655, 35631, 64674, 29018, 21021, 14865, 40196, 14036, 40278, 37209, 35585, 34344, 33030, 285, 58536, 56121, 40899, 24262, 62326, 57433, 5765, 24456, 28859, 45170, 14799, 21567, 55484)
b =  11507

error_bound = int(floor((q/p)/2))
AS = sum(A[i]*S[i] for i in range(len(A)))%q
x = (b-AS)%q
if x > q//2:
    x -= q
m=int(x)%p
print(m)

Noise Free

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

from utils import listener
from sage.all import *
FLAG = b"crypto{????????????????????????}"
# dimension
n = 64
# plaintext modulus
p = 257
# ciphertext modulus
q = 0x10001

V = VectorSpace(GF(q), n)
S = V.random_element()

def encrypt(m):
    A = V.random_element()
    b = A * S + m
    return A, b
class Challenge:
    def __init__(self):
        self.before_input = "Would you like to encrypt your own message, or see an encryption of a character in the flag?\n"

    def challenge(self, your_input):
        if 'option' not in your_input:
            return {'error': 'You must specify an option'}

        if your_input['option'] == 'get_flag':
            if "index" not in your_input:
                return {"error": "You must provide an index"}
                self.exit = True

            index = int(your_input["index"])
            if index < 0 or index >= len(FLAG) :
                return {"error": f"index must be between 0 and {len(FLAG) - 1}"}
                self.exit = True

            A, b = encrypt(FLAG[index])
            return {"A": str(list(A)), "b": str(int(b))}

        elif your_input['option'] == 'encrypt':
            if "message" not in your_input:
                return {"error": "You must provide a message"}
                self.exit = True

            message = int(your_input["message"])
            if message < 0 or message >= p:
                return {"error": f"message must be between 0 and {p - 1}"}
                self.exit = True

            A, b = encrypt(message)
            return {"A": str(list(A)), "b": str(int(b))}

        return {'error': 'Unknown action'}


import builtins; builtins.Challenge = Challenge # hack to enable challenge to be run locally, see https://cryptohack.org/faq/#listener
listener.start_server(port=13411)

有两个选项：

  1. get_flag:可以得到flag字符的加密
  2. encrypt:可以加密自定义m

所以选encrypt，且令m=0，就可以得到式子b = A * S，这样就可以把S算出来、

再选get_flag，由于不知道flag的长度，所以进行100轮循环把flag遍历完

然后每次循环执行m=b-A * S（mod q）

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

from pwn import *
import json
from sage.all import *
io = remote("socket.cryptohack.org",13411)
io.recvline()
n = 64
p = 257
q = 0x10001
row = []
bs = []
for i in range(64):
    io.sendline(json.dumps({
        "option":"encrypt",
        "message":0
	}).encode())
    r = json.loads(io.recvline().decode())
    A = eval(r["A"])
    b = int(r["b"])
    row.append(A)
    bs.append(b)
A = matrix(GF(q),row)
b = vector(GF(q),bs)
S = A.solve_right(b)
flag = ""
for i in range(100):
    io.sendline(json.dumps({
        "option":"get_flag",
        "index":i
    }).encode())
    r = json.loads(io.recvline().decode())
    if "error" in r:
        break
    A = vector(GF(q),eval(r["A"]))
    b = int(r["b"])
    m = (b-A*S)%q
    flag += chr(int(m))
print(flag)
]]> RSA共私钥d攻击 https://p3r0x.github.io/p/rsa%E5%85%B1%E7%A7%81%E9%92%A5d%E6%94%BB%E5%87%BB/ Mon, 09 Mar 2026 20:50:09 +0800Peroxhttps://p3r0x.github.io/p/rsa%E5%85%B1%E7%A7%81%E9%92%A5d%E6%94%BB%E5%87%BB/ 共私钥d的RSA攻击

攻击原理

原文：IJCSI-9-2-1-311-314.pdf

不深究数学原理

对于RSA给出的r个式子满足：

$$ \begin{align*} e_1 d &= 1 + k_1 \phi(N_1) \\ e_2 d &= 1 + k_2 \phi(N_2) \\ &\ \vdots \\ e_r d &= 1 + k_r \phi(N_r) \end{align*} $$

私钥指数d相同，模数N大小相似，且满足

$$ N_1 < N_2 < N_3 < .... < Nr < 2N_1 $$

$ϕ(N_r)=N_i−s_i$,

$$ 在 RSA 中，模数N=pq，欧拉函数 \varphi(N) = (p-1)(q-1) = pq - p - q + 1 = N - (p+q) + 1 \\ 令 s = p + q - 1，那么 \varphi(N) = N - s $$

在攻击中，$ϕ(N_r)$未知，所以可以将其转换成N-s，

$$ 所以e_i d = 1 + k_i \varphi(N_i)\\ 就变成了 e_i d = 1 + k_i (N_i - s_i) \quad\Rightarrow\quad e_i d - N_i k_i = 1 - k_i s_i $$

令$M=\sqrt{N_r}$这样就可以根据这个方程构造格：

$$ dM=dM\\ e_1d-N_1k_1=1-k_1s_1\\ e_2d-N_2k_2=1-k_2s_2\\ ...\\ e_rd-N_rk_r=1-k_rs_r\\ $$

构造过程：

$$ d\begin{pmatrix} M \\ e_1 \\ e_2 \\ ... \\ e_r\end{pmatrix}+k_1\begin{pmatrix} 0 \\ -N_1 \\0 \\ ... \\ 0\end{pmatrix}+k_2\begin{pmatrix} 0 \\ 0 \\-N_2 \\ ... \\ 0\end{pmatrix}+...+k_r\begin{pmatrix} 0 \\ 0 \\0 \\ ... \\ -N_r\end{pmatrix}=\begin{pmatrix} dM \\ 1-k_1s_1 \\1-k_2s_2 \\ ... \\ 1-k_rs_r\end{pmatrix} $$

转置得到这个矩阵来进行LLL：

$$ \begin{pmatrix} M &e_1 &e_2 & \dotsb &e_r \\ 0 & -N_1 & 0 & \dotsb & 0 \\ 0 & 0 & -N_2 & \dotsb & 0 \\ \vdots & \vdots & \vdots & \ddots & \vdots \\ 0 & 0 & 0 & \dotsb & -N_r \end{pmatrix} $$

题

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

from Crypto.Util.number import *
from random import randint
from secret import flag

flag = bytes_to_long(flag)
d = getPrime(randint(370, 390))


def enc(i):
    print()
    p = getPrime(512)
    q = getPrime(512)
    n = p * q
    phi = (p - 1) * (q - 1)
    e = inverse(d, phi)
    c = pow(flag, e, n)
    print(f'e_{i} =', e)
    print(f'n_{i} =', n)
    print(f'c_{i} =', c)


if __name__ == '__main__':
    for i in range(3):
        enc(i)

# e_0 = 37389635736858807810703086504264263440188928763651776502954117173983775626039037008534821321761858567723984257427640816113325770208734640385635663643682102780255726244659849205653007212192504491177021176624605722718152646889627480051142935241036578957272339153039961711802753021931124235464986935316295647379
# n_0 = 87704526707772151782606625126900349506318713860335977395824997219721333991491994027303721441548488339412359519408127174109547119019245873976917916080340858937125736650376514406944094998893225164676363063781400756374403299951466867573215964360920244878373810391250391475087527409213204756990192602517961590163
# c_0 = 78656123855003406993963573497876652287109947684890741747390020445306861422604130132525802389554149844489256622057009394678814584233565675702142297935509191018145970589418173328145004732595569847696022333024124469320873194195223535859964387627938665526123562969554622541694399263934496631337485091067073489148

# e_1 = 28535169211141109871379321582501492434722235009040085167442370469971731780018594508141105234950857774463438226249819106596920677559656398153362076685288045484306156454558741088396794170762527953573082734587618137075161676392362016474076363311708889307420903699720319611668580377903356783222664068961626803615
# n_1 = 134298877057487865189085342936485527664167450453080897084604607959501054859295769447683135156167266222961308751016451904929475702646252122360203167489936020076488657815646993920082535307414536854323149177250531362615850689341066360635074886835720438532107976530111551202845697404444502476862934946146194420313
# c_1 = 3208711484494445700905074340207543865325589037128163311082565190422756093807236786011349707275838139469873445326457948489588753029946395247710197747538418278782966047404435385208682596795152082296050804126524129644617710791433973098499266439604632728957505961744280687343384601998774018570047292904007768763

# e_2 = 27653153186459366670449283776658896188717513017934031993526241644501850206894800647711159987946276669184047769965182746812351757618147642060630769822810070480507035319320426666128599562714143342910248758055424582501972900763786232170145957578683616604737178839977216709381529813768748145393798635858691196687
# n_2 = 82113192811251631639012300385672674439485256963081847790431181633372052788107703751257606763043873164706839243919206719171536710944060815484051324239120708906418093409305166299531826404505861042666985630956832163750255358332156122245372899824101210233079028706971698312018388678352739819636695333269309456613
# c_2 = 79145689398302968140315554300835109898158799236562716569497147385375487041207363302776833573990584370222316102267792795080448018216133931915984139305260191001847394275311719986838969706049641052337337102739487620502723651258075501409442088938776353037366614208693030741599888985069155346722608948495955447606

构造格

$$ \begin{pmatrix} M & e_0 & e_1 & e_2 \\ 0 & -n_0 & 0 & 0 \\ 0 & 0 & -n_1 & 0 \\ 0 & 0 & 0 &-n_2 \end{pmatrix} $$
python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

import gmpy2
from sage.all import *
e_0 = 37389635736858807810703086504264263440188928763651776502954117173983775626039037008534821321761858567723984257427640816113325770208734640385635663643682102780255726244659849205653007212192504491177021176624605722718152646889627480051142935241036578957272339153039961711802753021931124235464986935316295647379
n_0 = 87704526707772151782606625126900349506318713860335977395824997219721333991491994027303721441548488339412359519408127174109547119019245873976917916080340858937125736650376514406944094998893225164676363063781400756374403299951466867573215964360920244878373810391250391475087527409213204756990192602517961590163
c_0 = 78656123855003406993963573497876652287109947684890741747390020445306861422604130132525802389554149844489256622057009394678814584233565675702142297935509191018145970589418173328145004732595569847696022333024124469320873194195223535859964387627938665526123562969554622541694399263934496631337485091067073489148

e_1 = 28535169211141109871379321582501492434722235009040085167442370469971731780018594508141105234950857774463438226249819106596920677559656398153362076685288045484306156454558741088396794170762527953573082734587618137075161676392362016474076363311708889307420903699720319611668580377903356783222664068961626803615
n_1 = 134298877057487865189085342936485527664167450453080897084604607959501054859295769447683135156167266222961308751016451904929475702646252122360203167489936020076488657815646993920082535307414536854323149177250531362615850689341066360635074886835720438532107976530111551202845697404444502476862934946146194420313
c_1 = 3208711484494445700905074340207543865325589037128163311082565190422756093807236786011349707275838139469873445326457948489588753029946395247710197747538418278782966047404435385208682596795152082296050804126524129644617710791433973098499266439604632728957505961744280687343384601998774018570047292904007768763

e_2 = 27653153186459366670449283776658896188717513017934031993526241644501850206894800647711159987946276669184047769965182746812351757618147642060630769822810070480507035319320426666128599562714143342910248758055424582501972900763786232170145957578683616604737178839977216709381529813768748145393798635858691196687
n_2 = 82113192811251631639012300385672674439485256963081847790431181633372052788107703751257606763043873164706839243919206719171536710944060815484051324239120708906418093409305166299531826404505861042666985630956832163750255358332156122245372899824101210233079028706971698312018388678352739819636695333269309456613
c_2 = 79145689398302968140315554300835109898158799236562716569497147385375487041207363302776833573990584370222316102267792795080448018216133931915984139305260191001847394275311719986838969706049641052337337102739487620502723651258075501409442088938776353037366614208693030741599888985069155346722608948495955447606
M,exact = gmpy2.iroot(n_2,2)
M=ZZ(M)
L = matrix([
    [M,0,0,0],
    [e_0,-n_0,0,0],
    [e_1,0,-n_1,0],
    [e_2,0,0,-n_2]
]).T
print(L.LLL())
Md = L.LLL()[0][0]        
d = Md//M
print(d)
print(long_to_bytes(pow(c_0,d,n_0)))
]]> 格密码学习笔记2 https://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B02/ Wed, 14 Jan 2026 15:30:32 +0800Peroxhttps://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B02/ 格密码学习笔记

对偶格

定义

对偶格也叫倒易格，对一个满秩格Λ，定义对偶格为：

只要y与对偶格的内积为整数就属于对偶格

一般情况（非满秩）下，

span(Λ)是格的张成空间

几何解释：

固定一个向量x，找出与向量x内积为整数的点，这些点都在同一个超平面（多维空间的平面）上，点之间的距离为1/||x||

对偶基

定义

对于一个基B(b1,b2….bn)，和它的对偶基D(d1,d2,….dn)满足两个条件：

  1. 张成空间相同
  2. B的转置矩阵和D的乘积为I，I就是单位矩阵E所以对角线为1其余为0，也就是<bi,di>=1,<bi,dj>=0

D是唯一的，在满秩格的情况下，

$$ D=(B^T)^{-1} $$

一般情况下：

$$ D=B(B^TB)^{-1} $$

对偶格的性质

定理1

一个格的对偶格的基正好是这个格的基的对偶基

如果D为B的对偶基，那么(L(B))^* =L(D)

证明过程：

定理2

给定一个格Λ，$(Λ^*)^*=Λ$，

定理3

对偶格的行列式和原本格的行列式满足

$$ det(Λ^*)=\frac{1}{det(Λ)} $$

证明过程

对于满秩格来说：

依靠线性代数：矩阵的逆的行列式等于矩阵的行列式的倒数，矩阵的转置的行列式等于矩阵的行列式

对非满秩格：

原来的格行列式（体积）越小，对偶格的行列式（体积）就越大，格密度就大，格的分布就越稀

定理4

对任意秩为n的格Λ：

$$ λ1(Λ)⋅λ1(Λ^∗)≤n $$

λ1(Λ)表示最短向量长度

上下两个相乘就可以得到这个式子

定理5

对于任意秩为n的格Λ：

$$ λ_1(Λ)⋅λ_n(Λ^∗)≥1 $$

取原格中的最短向量v，使：

$$ ||v||= \lambda_1(Λ) $$

取对偶格Λ* 中的n给无关向量，x1,x2….xn（Λ为秩为n的格），它们不可能全部与v正交，因此存在某个i使得<xi,v>≠0，根据对偶格的定义<xi,v>∈Z，所以 $$ ||xi||≥ \frac{1}{||v||} $$ 因为λn(Λ )肯定>||xi||，所以结果成立

+++

对一组基b1,b2….bn，让πi投影到空间$span(b_1,…,b_{i−1})^⊥$，特别的，π1b1,π2b2,…..,πnbn，就是b1,b2,…,bn正交化后的结果

⊥叫“正交补”表示与该子空间中的所有向量都正交的向量构成的集合

+++

定理6

设B，D为一组对偶基，B’=(πi(bi),…,πi(bn))和，D’=(di,…,dn)也是对偶基

要证明B’和D’为对偶基，需要证明，span(B’)=span(D’)，和$B'^TD'=I$,等价于 ⟨bj,dk⟩=σ_ij

因为dj与b1,….,bn都正交，所以dj∈$span(b_1,…,b_{i−1})^⊥$，D’=(di,…,dn)，所以span(D’)=$span(b_1,…,b_{i−1})^⊥$

因为πi(bk)是把bk投影到$span(b_1,…,b_{i−1})^⊥$，所以span(B’)=$span(b_1,…,b_{i−1})^⊥$，所以span(B’)=span(D’)

定理7

设对偶格基为B,D，B=（b1,b2,…,bn），D=(d1,d2,…,dn)

所以B正交化后=

$$ \tilde{b}_1,....., \tilde{b}_n $$

D正交化=

$$ \tilde{d}_1,....., \tilde{d}_n $$

长度满足：

$$ \tilde{d}_i= \frac{\tilde{b_i}}{||\tilde{b_i}||^2} $$

证明采用对n的归纳法，假设对秩为n-1的格成立，来证明对秩为n的格成立：

Korkine-Zolotarev bases

定义

对一个秩为n的格Λ，其KZ基b1,b2…..bn递归定义如下：

  1. 令b1为格Λ中的短向量

  2. 令 Λ′为将Λ投影到span(Λ)中与b1正交的子空间所得的格

  3. 令c2….cn 为Λ′的KZ基

  4. 定义

    $$ b_i=c_i+α_ib_i $$

    αi∈（-1/2，1/2]，是让bi∈Λ成立的唯一数

参考链接

计算机科学中的格（2004 年秋季） — Lattices in Computer Science (Fall 2004)

]]> 格密码学习笔记 1 https://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0-1/ Sat, 10 Jan 2026 16:09:51 +0800Peroxhttps://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0-1/ 格密码学习笔记

记录一下学习 LLL 算法，以 Regev 的讲义为主加上网上搜的其他资料，主要是 LLL ==

LLL 算法

算法目的

用于解决最短向量问题的多项式时间复杂度算法，目的简单说就是将坏基转化为好基

好基：

  • 向量短
  • 接近正交（垂直）

坏基：

  • 向量长
  • 接近平行

LLL 约简基

Gram-Schmidt 正交化

进行 δ-LLL 约基简的条件

σ = 3/4，bi 线性无关向量，上面有个~的是正交化后的正交向量，μi, j 是 bi 在 bj（正交化） 上的投影系数

尺寸约减（条件一）

第 i 个原始基向量 bi 在前个正交化向量 bj 上的投影系数 ui, j 的绝对值不超过二分之一, 目的是为了让基向量更接近正交

Lovász 条件（条件二）

正交化的第 i 个模长的平方的 σ 倍小于右边，给第 i+1 个正交化的向量规定了下限

因为 ~ b i 和 ~ b(i+1) 都进行了正交化，所以内积等于 0，两者和的平方就可以看作两者平方之和，

由 条件一 可以得到 u 小于 1/2，所以 u² 应该小于 1/4，所以比较小，~bi+1 的平方加上这个比较小的数大于等于 σ 倍 ~bi 的平方，所以 限制 ~bi+1 的长度不能太短

SVP 问题

最短向量问题（SVP）：给定一个格 L，找到一个非零向量 v，使得对于格 L 中任意一个非零向量 u，都满足 ∥v∥≤∥u∥（即 v 是格中长度最短的非零向量）

近似CVP问题

cvp可定义搜索问题，优化问题和决策问题。

$$ (CVP_γ,搜索):在\mathcal{L}(B)里找一个点x，让x到t的距离，不超过格里其他点到t的距离的γ倍\\ (CVP_γ,优化):找一个数r，使得r属于最短距离和最短距离的γ倍之间\\ (CVP_γ,判断):给定一个数r，来判断最短距离 ≤ r|最短距离＞γ⋅r $$ 上面γ≥1为近似因子。当γ=1时，为精确cvp问题

可以用babai算法解决CVP搜索问题，其中γ=2^n/2^

参考链接

LLL 格基约简算法（2） - 3cH0_Nu1L - 博客园

计算机科学中的格（2004 年秋季） — Lattices in Computer Science (Fall 2004)

]]> 格密码学习笔记 https://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/ Fri, 09 Jan 2026 17:24:37 +0800Peroxhttps://p3r0x.github.io/p/%E6%A0%BC%E5%AF%86%E7%A0%81%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/ 格密码学习笔记

1.格的定义

基：向量的集合，例如基向量（0，1）和（1，0）构成一个基

格：由基向量线性组合，

格

秩与维度：秩为基向量的个数 n，维度空间所在的维度 m。若 n = m 则称这个格为满秩格

基本平行体(Fundamental Parallelepiped)：基本平行体是由格的基向量围绕成的一个半闭半开的区域，给出一组线性无关的向量 b1, b2…., bn∈Rn，基本平行体就是：

$$ P(\mathbf{b}_1, \mathbf{b}_2, \dots, \mathbf{b}_n) = \left\{ \sum_{i = 1}^{n} z_i \mathbf{b}_i \mid z_1, z_2, \dots, z_n \in \mathbb{Z},\ 0 \le z_i < 1 \right\} $$

例如：

图 a 的阴影面积为（0，1）和（1，0）组成的基本平行体，图 b 的阴影面积为（1，1）和（2，1）组成的

行列式和体积：这个基本平行体的体积 = 行列式，令 B 是格 L 的基矩阵，则格 L 的行列式定义为 det(L)=|det(B)|，以图 a 为例子，

$$ \mathrm{Vol}(A) = \left| \det\begin{pmatrix} 0 & 1 \\ 1 & 0 \end{pmatrix} \right| = 1 $$

然后可以通过幺模变换来相互转换的基向量等价，简单说就是基向量可以通过幺模变换变成另一组基向量，这两组基向量的行列式一样，表示的格都一样

  • 幺模变换：由幺模矩阵定义的线性变换
  • 幺模矩阵：设 U 为整数矩阵，满足
    • U 的所有元素都是整数
    • det(U)= ±1（行列式绝对值为 1）
    • 幺模矩阵的逆矩阵也是幺模矩阵

表示为：

$$ B'= B\ *\ U $$

格的扩展空间：格基实系数组合生成的空间称为格的延展空间，表示为$span(L(B))=span(B)={Ba|a∈R^n}$，当格为满秩格时格的扩展空间是整个n维空间

在格空间内有两个困难问题：

Gram-Schmidt 正交化

正交化过程

设有一组线性无关的向量α1α2….αn，目标是构造正交向量组β1β2…βn，

正交化流程

$$ \beta_1 = \alpha_1\\ \beta_2 = \alpha_2 - \frac{(\alpha_2, \beta_1)}{(\beta_1, \beta_1)}\beta_1\\ \beta_3 = \alpha_3 - \frac{(\alpha_3, \beta_1)}{(\beta_1, \beta_1)}\beta_1 - \frac{(\alpha_3, \beta_2)}{(\beta_2, \beta_2)}\beta_2\\ 所以\beta_n = \alpha_n - \sum_{i = 1}^{n-1}\frac{(\alpha_n, \beta_i)}{(\beta_i, \beta_i)}\beta_i\\ 投影的系数：\mu_{n,i} = \frac{(\alpha_n, \beta_i)}{(\beta_i, \beta_i)}\\ 标准化：\\ e_n = \frac{\beta_n}{|\beta_n|} $$

3.Successive Minima（逐次极小）

逐次极小描述了在一个空间中，一个凸集（比如一个对称的、中心在原点的物体）能装下多少个线性无关的、越来越长的格向量

3.1最短非零向量λ1

格Λ是由一组基向量线性组合（系数为整数）生成的向量集合。在这个集合里，去掉零向量后，所有非零向量中 “长度最短” 的那个向量的长度，就记为λ1（Λ）

$$ λ1(Λ)=inf \{∥v∥∣v∈Λ∖{0}\} $$

Λ\0表示格Λ中除0之外的所有向量，inf表示最小值

3.2逐次极小的一般定义λi（Λ）

公式：

$$ \lambda_k(\Lambda) = \inf\left\{ r>0 \mid \exists \text{ 线性无关的 } \boldsymbol{v}_1,\dots,\boldsymbol{v}_k \in \Lambda \cap C(r) \right\} $$
  • λk（Λ）：表示格Λ的第k个逐次极小
  • C(r)：指以原点为中心、半径为r的闭球
  • Λ∩C(r)：格Λ中落在这个球里的所有向量

闭球C(r)：以原点为中心、半径为 ( r ) 的欧氏闭球，是所有到原点的距离不超过r的向量v的集合

这个公式表示：找到最小的半径r，使得该闭球内存在k个线性无关的格向量

BLICHFELD理论

对任意满秩格 $\Lambda \subseteq \mathbb{R}^n$ 以及可测集 $S \subseteq \mathbb{R}^n$，若 S 的体积 $\text{vol}(S) > \det\Lambda$，则必存在S中两个不同的点 $(z_1,z_2)$，使得 $(z_1 - z_2 \in \Lambda)$

如果集合S的体积比A的大（格A的体积等于行列式），那么存在集合的两个点的差属于格A

闵可夫斯基凸体定理

设任意满秩格 $\Lambda \subseteq \mathbb{R}^n$ ，$S⊂R^n$是一个凸的、中心对称的集合，如果$val(S)>2^ndet(A)$，那么$S∩(\Lambda \backslash \{0 \}≠∅)$，S中一定包含一个格向量。

闵可夫斯基定理第二定理

对任意n维格Λ：

Hermite定理:

n表示维度，为基向量的个数

公式含义：格的n个相继极小的乘积的n次方根，不超过Hermite常数的平方根与格行列式的n次方根的乘积

参考链接

格密码笔记（五）

格拉姆-施密特正交化 - 维基百科，自由的百科全书

格密码–数学基础–05Successive Minima与闵可夫斯基第二定理及赫米特常数_闵可夫斯基格点定理-CSDN博客

原讲义：Lattices in Computer Science (Fall 2004)

]]> Coppersmith定理的几种攻击情况的学习 https://p3r0x.github.io/p/coppersmith%E5%AE%9A%E7%90%86%E7%9A%84%E5%87%A0%E7%A7%8D%E6%94%BB%E5%87%BB%E6%83%85%E5%86%B5%E7%9A%84%E5%AD%A6%E4%B9%A0/ Fri, 02 Jan 2026 20:47:05 +0800Peroxhttps://p3r0x.github.io/p/coppersmith%E5%AE%9A%E7%90%86%E7%9A%84%E5%87%A0%E7%A7%8D%E6%94%BB%E5%87%BB%E6%83%85%E5%86%B5%E7%9A%84%E5%AD%A6%E4%B9%A0/ coppersmith 定理的几种攻击情况的学习

Coppersmith 可以用于求多项式的小根，经常用于 RSA 攻击中“已知某些二进制位，求剩余位”这一类问题

给定：

  • 模数 N（通常很大，如 RSA 模数）
  • 模 N 的多项式 f(x)（通常为单变量）
  • 边界 X

寻找所有满足 f(x0) ≡ 0 (mod N)且 ∣x0∣ < X 的整数根 x0

成立的条件：

$$ |x_0|\ <\ N^{1/deg(f)}\\ $$

deg(f)为多项式最高项次数

1.basic boradcast attack 广播攻击

攻击原理

text 
1

Broadcast attack 是 Håstad attack，不是 Coppersmith，只是经常一起出现

使用同一个指数 e 加密同一个密文 m，产生 e 个明文，形如：

$$ c_1 \equiv m^e \pmod{n_1} \\ c_2 \equiv m^e \pmod{n_2} \\ \vdots \\ c_e \equiv m^e \pmod{n_e} $$

n1, n2…互素，

是 m ≤ min(n₁, n₂, …, nₑ)，即明文 m 必须小于等于所有模数中的最小值

然后解中国剩余定理

根据中国剩余定理（CRT），可以求解：

mᵉ ≡ C (mod N)

其中 N = n₁ × n₂ × … × nₑ

因为 m ≤ min(n₁, n₂, …, nₑ)，m^e^ < n₁ × n₂ × … × nₑ

mᵉ < N，则可以直接对 C 开 e 次方根得到明文 m：m = ᵉ√C

RSA 高位攻击

内容参考：

RSA_高位攻击学习记录_rsa 已知高位攻击-CSDN 博客

RSA 中 coppersmith 定理的应用条件-CSDN 博客

Coppersmith 攻击

知道部分二进制位，求剩余二进制位，只有未知的 bit 位满足 unknown_bits / p_bits <= 0.44（即 coppersmith 定理）时，才能通过 small_roots()方法求出未知的 bit 位，进而求解 flag

small_roots(X = , beta = )的使用方法：

sage 
1
2
3

R.<x> = PolynomialRing(Zmod(N))      # 定义模N的多项式环
f = (x + a)^e - c                     # 定义多项式
roots = f.small_roots(X=,beta=)

看不懂，让 ai 细说了一下

边界因素 X：

  1. 已知根的比特 k 的情况下，X = 2^k^
  2. 已知根的大致范围 [0,1000]，X = 1000
  3. 理论边界：根据 coppersmith: X < N^1/e^，所以 X = floor(N^1/e^)
  4. 因子的部分比特攻击，知道了 p 的高位，p = p_high+x，所以 X = 2^unknown_bits^

beta 参数（β）：当 p, q 二进制位数相同时一般只能取 0.4

  1. 在模 N 上寻找根，如果根满足 f(x) ≡ 0 (mod N)，beta = 1

  2. 在模 p 上寻找根，且 p 约等于 N^0.5^（RSA 情况），p 是 N 的一个因子，p ≈ √N ≈ N^0.5，beta = 0.5，因为 p ≈ N^0.5，所以 β = 0.5

  3. 在模 p 上寻找根，但 p 的大小不同：

    如果 p ≈ N^0.3^：beta = 0.3

    如果 p ≈ N^0.25：beta = 0.25

  4. 寻找模 N 的小根：beta = 1.0

攻击目标 模数 β
模 N 求根 N 1.0
模 p（RSA） p ≈ N^0.5 0.5
模 p ≈ N^0.3 p 0.3

已知 p 高位

知道 p 的前 k 位，记低位为 x，所以 p = p_high * 2^k^ + x，算出 p 的低位 x 后直接用 small_roots

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

from Crypto.Util.number import*
p = getPrime(1024)
q = getPrime(1024)
n= p * q
print(p)
p_high = p >> 300#已知高位1024-300bits
pbits = 1024
kbits = pbits - p_high.bit_length()#低位300bits
p_high = p_high << kbits#移动回去把低位空出来
PR.<x> = PolynomialRing(Zmod(n))#多项式环
f = x + p_high
p0=f.small_roots(2**kbits,0.4)[0]
print(p0+p_high)

已知 p 高位，q 低位

已知的 p 高位不满足 unknown_bits / p_bits <= 0.44，且知道 q 的低位，低位数 x

解题方法省个流就是：

$$ p_{\text{low}} = p \bmod 2^{x} = \left( n \cdot q_{\text{low}}^{-1} \right) \bmod 2^{x} $$

然后用 small_roots 算出中间的未知数然后加起来就可以了

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

from Crypto.Util.number import getPrime, bytes_to_long
from secret import flag
p = getPrime(1024)
q = getPrime(1024)
n = p * q
e = 65537
hint1 = p >> 724
hint2 = q % (2 ** 265)
c = pow(bytes_to_long(flag), e, n)
print(hint1)
print(hint2)
print(n)
print(c)

q 的低位 q_low

$$ q \bmod 2^{265} = q_{\text{low}} $$

所以：

$$ q = k \cdot 2^{265} + q_{\text{low}} $$

两边同时乘 q 可以得到：

$$ n = p \cdot \left( k \cdot 2^{265} + q_{\text{low}} \right) = k \cdot 2^{265} \cdot p + q_{\text{low}} \cdot p $$

同时除以 q_low：

$$ n \cdot q_{\text{low}}^{-1} = k \cdot 2^{265} \cdot p \cdot q_{\text{low}}^{-1} + p $$

同时取模 2^265^得到：

$$ p_{\text{low}} = p \bmod 2^{265} = \left( n \cdot q_{\text{low}}^{-1} \right) \bmod 2^{265} $$
python 
1
2
3
4
5
6
7
8

from Crypto.Util.number import*
p_high = 1514296530850131082973956029074258536069144071110652176122006763622293335057110441067910479
q_low = 40812438243894343296354573724131194431453023461572200856406939246297219541329623
n = 21815431662065695412834116602474344081782093119269423403335882867255834302242945742413692949886248581138784199165404321893594820375775454774521554409598568793217997859258282700084148322905405227238617443766062207618899209593375881728671746850745598576485323702483634599597393910908142659231071532803602701147251570567032402848145462183405098097523810358199597631612616833723150146418889589492395974359466777040500971885443881359700735149623177757865032984744576285054725506299888069904106805731600019058631951255795316571242969336763938805465676269140733371287244624066632153110685509892188900004952700111937292221969
c = 19073695285772829730103928222962723784199491145730661021332365516942301513989932980896145664842527253998170902799883262567366661277268801440634319694884564820420852947935710798269700777126717746701065483129644585829522353341718916661536894041337878440111845645200627940640539279744348235772441988748977191513786620459922039153862250137904894008551515928486867493608757307981955335488977402307933930592035163126858060189156114410872337004784951228340994743202032248681976932591575016798640429231399974090325134545852080425047146251781339862753527319093938929691759486362536986249207187765947926921267520150073408188188
e = 65537
p_low=(n//q_low)%(2**256)
print(p_low)

现在有低位 256 和高位 300，所以目前未知位为 459，最多未知位为 1024 * 0.44 = 454，所以要暴力枚举五位

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

from Crypto.Util.number import*
p_high = 1514296530850131082973956029074258536069144071110652176122006763622293335057110441067910479
q_low = 40812438243894343296354573724131194431453023461572200856406939246297219541329623
n = 21815431662065695412834116602474344081782093119269423403335882867255834302242945742413692949886248581138784199165404321893594820375775454774521554409598568793217997859258282700084148322905405227238617443766062207618899209593375881728671746850745598576485323702483634599597393910908142659231071532803602701147251570567032402848145462183405098097523810358199597631612616833723150146418889589492395974359466777040500971885443881359700735149623177757865032984744576285054725506299888069904106805731600019058631951255795316571242969336763938805465676269140733371287244624066632153110685509892188900004952700111937292221969
c = 19073695285772829730103928222962723784199491145730661021332365516942301513989932980896145664842527253998170902799883262567366661277268801440634319694884564820420852947935710798269700777126717746701065483129644585829522353341718916661536894041337878440111845645200627940640539279744348235772441988748977191513786620459922039153862250137904894008551515928486867493608757307981955335488977402307933930592035163126858060189156114410872337004784951228340994743202032248681976932591575016798640429231399974090325134545852080425047146251781339862753527319093938929691759486362536986249207187765947926921267520150073408188188
e = 65537
q_low_inv=pow(q_low,-1,2**265)
p_low = (n*q_low_inv)%(2**265)
print(p_low)
PR.<x> = PolynomialRing(Zmod(n))
p_high=p_high << 724
for i in range(32):
    f = p_high + p_low + (x * 32 + i) * (2**265)
    f = f.monic()
    p = f.small_roots(2**454,0.4)
    if p:
        x0=int(p[0])
        p=(x0*32 + i) * (2**265) + p_high + p_low
        break
print(p)
q=n//p
phi=(p-1)*(q-1)
d=pow(e,-1,phi)
print(long_to_bytes(pow(c,d,n)))

md 还能有这种报错的，夸张哦 😓

已知密文 m 高位

怎么感觉像照着抄啊我干

m 和 c 的关系是

$$ c = m^e \mod n $$

又因为：

$$ m = m_{\text{high}} + x \quad (\text{$x$ 是低位未知}) $$

所以把 c 移过来可以变成：

$$ f(x) = (m_{\text{high}} + x)^e - c \equiv 0 \mod n $$

然后直接套公式秒了

已知 d 的低位求 pq

已知了 d 的低位 d_low 和低位 bits 数 x 还有 e

因为：

$$ ed \equiv 1 \pmod{(p-1)(q-1)} $$

所以：ed = 1 + k * (p-1) * (q-1)

然后对两边取模 2^x^，所以:

$$ ed_{\text{low}} \equiv 1 + k(p-1)(q-1) \pmod{2^x} $$

把 q 换成 n/p，这个式子就为

$$ p \cdot ed_{low} \equiv p + k(n \cdot p - p^{2} - n + p) \pmod{2^{x}} $$

然后 solve_mod 解模方程（sagemath 太好用了家人们）

Franklin-Reiter 相关消息攻击 & Coppersmith’s Short Pad Attack 短填充攻击

攻击原理

由于 m1 和 m2 存在线性关系并且在相同 N 下进行的 RSA 加密，

假设

$$ m_1 = k\ * \ m_2 \ +\ b $$

且

$$ m_1\ \equiv \ a\ mod \ N\\ m_2\ \equiv \ a\ mod \ N $$

这样就可以列出两个和 m2 相关的方程

$$ f(x)\ =\ x\ -\ a\\f(x)= k\ * \ x \ +\ b\ -\ a $$

这样这两个式子取 x = m2 时都会等于 0，在数学意义下有个 (x-m2) 的因式，所以直接取这两个方程的公因数就可以找到 m2

顺便学习一下 sagemath

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

R.<X> = Zmod(n)[]#定义多项式环
.coefficients()#以列表形式返回多项式的常数项（从低项到高项的升序排列，即7x^5+3x^4+4返回[4,3,7]）
.monic()#除以最高项的系数
'''
4x^3+2x^2+x
返回：
x^3+1/2x^2+1/4x
'''
#多项式求公因数用欧几里得算法递归
def gcd(a, b):
    if(b == 0):
        return a.monic()
    else:
        return gcd(b, a % b)

做下例题

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

from Crypto.Util.number import *
from secret import flag
from Crypto.Util.number import *

m1 = bytes_to_long(flag)
N = getPrime(512)*getPrime(512)
e = 17

c1 = pow(m1, e, N)

a = getRandomNBitInteger(512)
b = getRandomNBitInteger(512)
m2 = a * m1 + b
c2 = pow(m2, e, N)

print(f'N={N}', f'a={a}', f'b={b}', f'c1={c1}', f'c2={c2}', sep="\n")
python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

N=123659932061175480826793608011321410436349950741155126876095701055301878519455031361569954900678263326118459719432097093055918891948664714258046001339215600541946755989049122600427628642622036472692779340339300158628581419220590868242848311473965406365501747491282544140645468809520929307937285660479491241363
a=12795184347649957548397347648657609712242281197428253341891395348966629724842748696386579533843100833039565312645558384706282291396553602742473087674306336
b=12652561268961103936837420866306660440380907636430718507525953046969196471975210807471094652190751376751348655252244311630569860771118936181419956587387282
c1=51991948160397341594095534046308905334052328129886214140433481879034095448631790463996064234310860642758645828216350970768732856439017324754993220774971081882007838091737307185049230846102962234452369235186705221800322142645874117556212685451861172069436515378795560228077509937484022552758984136308761496373
c2=102367269426206577837660468860715696190840895268468904172938303357188227693435122799965957675733814903345970317009686706066325312156008609593926539768689081990544088825413585508055156925413722623286655819700429518477974133941543843635128782119973290018886257977205103150970429699110833604623614038282346303825
e=17
from Crypto.Util.number import*
def s(N,e,c1,c2,a,b):
    R.<X> = Zmod(N)[]
    f1 = X^e - c1
    f2 = (X*a+ b)^e - c2
    return Integer(-(gcd(f1,f2)).coefficients()[0]) 
def gcd(a, b):
    if(b == 0):
        return a.monic()
    else:
        return gcd(b, a % b)

m=s(N,e,c1,c2,a,b)
print(long_to_bytes(m))
python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

from Crypto.Util.number import *
from secret import flag

num1 = getPrime(512)
num2 = getPrime(512)
while num1<num2 :
    num2 = getPrime(512)
ring = RealField(1050)
num3 = ring(num1) /ring(num2)
print("num3=",num3)
p = getPrime(512)
q = getPrime(512)
n=p*q
e=65537
m = bytes_to_long(flag)
c=pow(m,e,n)

print("n=",n)
print("c=",c)

n2 = getPrime(512) * getPrime(512)
e1 = randint(1000,2000)
e2 = randint(1000,2000)
c1 = pow(p+num1,e1,n2)
c2 = pow(p+num2,e2,n2)

q1 = getPrime(512)
leak1 = pow(q+q1,2024,n)
leak2 = pow(q1+2024,q,n)


print("n2=",n2)
print("e1=",e1)
print("e2=",e2)
print("c1=",c1)
print("c2=",c2)
print("leak1=",leak1)
print("leak2=",leak2)



"""
num3= 1.36557212221826657073387899060669771982679822943621690677450888408226656788387273887547841291114809989272635809810564202247340711087479554863446719786359395466961253205133910506682801159622545780721946115442033391600881399634390008053822158098121985270501317972263356522400827768601773721146954464269212959784543085
n= 85105083975491693151454182116844944807066048677068373328227644321539783064315677834754866742549592569194223084173286381150626593510265361114796714226058887906219454795525438819082646860141163940340082006344850825956811992304447978369108606993344902286569100146695092703383844402883938506877787042873586279543
c= 8090472119640930864901421058741085326954308673260202542020919764880488559370287585797498390920330336595858609617432370825503480936376306766495089200286004922821787548265246289552343468177624634434613746605553770994437785042510225956023382347023663125411103947669109085411939772215657220674436476279268458980
n2= 101642316595332652021348165259853423287787139517550249986161819826180514401858258316466101056877182367161299111697465439636861942636526396547011727147471566130633614685728563576613692851860684686033186826342178072882901576159305747639645374751566751967096281105148714033096611618024355982220235949274576036321
e1= 1630
e2= 1866
c1= 8857135083997055103287497833179378469532619748945804429057682575070405217145941944821968708809563240261403711644389684947851643865895254406194464015430673347359589677809515117412321862622147634752091324365628790687343748145339949310696116239361890881096088375070083053010564890401663562726144984405628773323
c2= 44531030636557714647477473185500183066851251320453194953972504422367649302810396344051696851757189817391648356459225688318373454949578822468293099948132700460437006478679492801335689493431764882835346904225119630026545592437198370606462285405519745361570058335573353886454277790277663038008240372746639859253
leak1= 82301473255013183706458389946960254392188270550712533886416705365418418731488346328643954589202172816597173052792573628245245948345810581701878535280775967863966009605872386693838526935762655380705962833467046779524956212498594045378770790026387120339093736625186401934354434702063802537686761251873173518029
leak2= 43580171648136008789232340619597144591536098696024883687397347933098380327258730482377138309020375265135558484586783368757872008322883985094403855691297725907800406097129735499961231236473313141257901326737291586051506797429883866846199683028143924054925109557329949641367848264351523500925115860458645738192

"""

DASTF 的题，先连分数逼近来解开 num1 和 num2，然后用相关消息攻击，情报有误，这是短填充攻击

python 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

num3= 1.36557212221826657073387899060669771982679822943621690677450888408226656788387273887547841291114809989272635809810564202247340711087479554863446719786359395466961253205133910506682801159622545780721946115442033391600881399634390008053822158098121985270501317972263356522400827768601773721146954464269212959784543085
n= 85105083975491693151454182116844944807066048677068373328227644321539783064315677834754866742549592569194223084173286381150626593510265361114796714226058887906219454795525438819082646860141163940340082006344850825956811992304447978369108606993344902286569100146695092703383844402883938506877787042873586279543
c= 8090472119640930864901421058741085326954308673260202542020919764880488559370287585797498390920330336595858609617432370825503480936376306766495089200286004922821787548265246289552343468177624634434613746605553770994437785042510225956023382347023663125411103947669109085411939772215657220674436476279268458980
n2= 101642316595332652021348165259853423287787139517550249986161819826180514401858258316466101056877182367161299111697465439636861942636526396547011727147471566130633614685728563576613692851860684686033186826342178072882901576159305747639645374751566751967096281105148714033096611618024355982220235949274576036321
e1= 1630
e2= 1866
e=65537
c1= 8857135083997055103287497833179378469532619748945804429057682575070405217145941944821968708809563240261403711644389684947851643865895254406194464015430673347359589677809515117412321862622147634752091324365628790687343748145339949310696116239361890881096088375070083053010564890401663562726144984405628773323
c2= 44531030636557714647477473185500183066851251320453194953972504422367649302810396344051696851757189817391648356459225688318373454949578822468293099948132700460437006478679492801335689493431764882835346904225119630026545592437198370606462285405519745361570058335573353886454277790277663038008240372746639859253
leak1= 82301473255013183706458389946960254392188270550712533886416705365418418731488346328643954589202172816597173052792573628245245948345810581701878535280775967863966009605872386693838526935762655380705962833467046779524956212498594045378770790026387120339093736625186401934354434702063802537686761251873173518029
leak2= 43580171648136008789232340619597144591536098696024883687397347933098380327258730482377138309020375265135558484586783368757872008322883985094403855691297725907800406097129735499961231236473313141257901326737291586051506797429883866846199683028143924054925109557329949641367848264351523500925115860458645738192
t=continued_fraction(num3)
for i in range(1000):
    num1=t.numerator(i)
    if is_prime(num1) and num1.nbits()==512:
        num2=t.denominator(i)
        print(num1)
        print(num2)
        break
from Crypto.Util.number import*
def s(n,e1,e2,c1,c2):
    R.<X> = Zmod(n)[]
    f1 = (X+num1)**e1 - c1
    f2 = (X+num2)**e2 - c2
    return Integer(-(gcd(f1,f2)).coefficients()[0]) 
def gcd(a, b):
    if(b == 0):
        return a.monic()
    else:
        return gcd(b, a % b)
p=s(n2,e1,e2,c1,c2)
print(p)
q=n//p
d=pow(e,-1,(p-1)*(q-1))
m=pow(c,d,n)
print(long_to_bytes(m))
]]> https://p3r0x.github.io/p/ Mon, 01 Jan 0001 00:00:00 +0000Peroxhttps://p3r0x.github.io/p/ 格密码相关

整数规划（IP）

定义

给定m个关于n个变量的有理数线性不等式，判断是否存在整数解，等价于矩阵

$$ A \ \in\Q^{m×n},b\ \in\ Q^{m}\\ 存在z\ \in\ Z^{n}\ Az\ \textless\ b $$

等价于：判断此集合是否为空集

2

凸组合：对任意两点x,y，以及λ∈[0,1]，凸组合就是λx+(1-y)λ

凸性：对集合内任意两点x,y的凸组合，仍然属于该集合

凸体指任意两点的凸组合仍在集合中；凸体还要求有界且内部非空

]]> https://p3r0x.github.io/p/ Mon, 01 Jan 0001 00:00:00 +0000Peroxhttps://p3r0x.github.io/p/ 时间复杂度

输入规模为n时，运行时间随n增长的数量级，是增长趋势

数据越大跑得越慢

时间复杂度增长的速度，和函数增长速度一样

$$ O_{log\ n}多项式时间复杂度

形如：

$$ m(n)=O_{n^k} \ $$

k为常量

非多项式时间复杂度

就是除了多项式复杂度以外的，比如指数型和阶乘型

P问题

能在多项式时间内可以解决的问题

p就是可以被算出来的问题

NP coNP

指在多项式时间内验证的决策问题，人话就是基本算不出来，但是很好判断

给出一个困难的问题和一个回答，可以很好判断这个回答是不是这个问题的答案，证明有解更简单，证明无解很困难，

coNP和NP差不多，但是属于NP的反面，更好证明无解，证明有解很难

AM

coAm

]]> https://p3r0x.github.io/p/ Mon, 01 Jan 0001 00:00:00 +0000Peroxhttps://p3r0x.github.io/p/ html 
1
2
3
4
5

<div class="code-fun" data-tip="测试功能">

    
    
</div>

这个是加吐槽，针对代码块

]]>