Skip to content

Latest commit

 

History

History

53-kilo-med-data

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

Chatlog

Challenge

From reading the challenge description, it is clear that this is a RSA (Rivest–Shamir–Adleman) challenge. We are given a chatlog where the public factors N and e are given, along with the ciphertext.

[22:10:25]      <Mr.Rivest>     Hi, I need to send you something. Can you send me your key?
[22:11:03]      <Mr.Adleman>    Sure, here: n=109773001979060500556771371722004589561407766472974181720301601504038097307183054327771414952722378616410690575654297998413723333283006388834687489519816814313970602740394095998728900971165525449666220812031401613319432338039749036919424709291358478655637030475075112370396605574403821950130705107292457546429 e=6251728305055461128215101113791542074487626873355761684912706796947820318045025894574010369655098754702916182673592159941529716341070091220295342244632166182377719507598162603755176681008223777597129409701832290624714334993812111228876927501848766224885363439534844304635205290155102644689388281018248057599
[22:11:47]      <Mr.Rivest>     69065966519105922162577567455261680573815854481710157074477507437933398566834762071577601999308205592512262422922008600362846112148013817314127895526875891430442404421013800492060589763419224572960632800381314756724351337523874069656512900871727433364755041357985429952615910953420906893665747562715489326060
[22:12:19]      <Mr.Adleman>    Hmm, I see... Thanks!

The first thing we tried was to check with factordb if N has any known factors. If this was the case, we would know p and q, and could subsequently construct the decryption key d = e^-1 % ( (p-1)*(q-1) ). Unfortunately, the N in this challenge has no known factors.

One thing that stands out is that e is very large in this challenge, as usually e = 0x10001. Because e is very large, the decryption key d is likely to be relatively small, and therefore vulnerable to Wiener's attack if certain size-requirements are met. Luckily, because this is a known attack we don't have to script all the code ourselves, and can just use RsaCtfTool for example.

$ python3 RsaCtfTool.py --attack wiener -n 109773001979060500556771371722004589561407766472974181720301601504038097307183054327771414952722378616410690575654297998413723333283006388834687489519816814313970602740394095998728900971165525449666220812031401613319432338039749036919424709291358478655637030475075112370396605574403821950130705107292457546429 -e 6251728305055461128215101113791542074487626873355761684912706796947820318045025894574010369655098754702916182673592159941529716341070091220295342244632166182377719507598162603755176681008223777597129409701832290624714334993812111228876927501848766224885363439534844304635205290155102644689388281018248057599 --decrypt 69065966519105922162577567455261680573815854481710157074477507437933398566834762071577601999308205592512262422922008600362846112148013817314127895526875891430442404421013800492060589763419224572960632800381314756724351337523874069656512900871727433364755041357985429952615910953420906893665747562715489326060
[*] Attack success with wiener method !
PKCS#1.5 padding decoded!
utf-8 : EPT{Shamir_is_up_2_something}