Description:

We have developed a miniature of a crypto-system. Can you break it?
We only want to break it, don’t get so hard on our system!

Here is the file.

There are 3 files: source code encrypt.py, encrypted file flag.enc, key flag.pub.

The algorithm is so easy, read 1 byte/time then compute it and ouput 2 bytes. The encrypt algorithm is just convert the 1-byte-plaintext into 2 matrixs then compute the products of the plaintext matrix and the key matrix. The result will be change 1 bit then save as output.

1-byte was encrypted with 4 bits plaintext. We can reverse the algorithm by check all of plaintext available (16 value). We can guess the plaintext by compute the product of the 4-bit plaintext and the key, if the result is different 1 bit with the encrypted byte, then it maybe the correct plaintext with this encrypt byte.

Here my sage script.

And here is my result.

 

Description:
ASIS has many insecure sub-domains, but we think they are over HTTPS and attackers can’t leak the private data, what do you think?

Here is the pcap file.

This pcap shows the traffic of https protocol.

After filter with “ssl.handshake.certificate”, i got 101 different certificates. Extract those certificates by a script. Then use openssl to get the modulus. Check gcd of those modulus one-by-one, we got the common prime of the 1st modulus and the 99th modulus.

Then, we can factor them and create a private key file then import to wireshark to decrypt the traffic. Open wireshark –> edit –> preferences –>SSL –> edit RSA key lists then add 2 private key files obove.

File –> export objects –> HTTP to export flag.

Description:

With F-4 Phantom II, we want to break the encryption! Please help us!!

 

‍‍‍nc 66.172.27.77 54979

Here is the [K]ey generating fuction

As we can see, a prime p is chosen random, another number is created by change 2 bit of p, then find the prime next to that number as q. The modulus n=p*q.

Let len is the length of p in bits minus, k is a natural number smaller than len and l=len-k, we have:

with x is a small number.

n can be represented as:

Let and , now we have:

We have p and q is odd primes so their difference is an even number, it means x is even and a, b is integers. Morever the integer a is closely with . So, if we know the random number k, we can factor n efficiently by travial method (similar to the Fermat’s factorization). Luckily, len is appropriate 540 so we have about 270 available value of k. Then we can brute force the value of k.

Now, extract the key by openssl:

By brute-forcing, we get k=117 and n be factored. Here is my script.

I got the elements, but i couldn’t find the modular inverse of e because e is a divisor of (p-1). So i used dq to compute m:

but that result still isn’t the flag, after add some times of q, finally i got the flag:

ASIS{Still____We_Can_Solve_Bad_F4!}

Description:

Connect to OTP generator server, and try to find one OTP.

 

nc 66.172.27.77 35156

Here is the [E]ncryption function.

As we can see, the otp is the concatenation of template_phrase and 18-bytes passphrase and the encrypted OTP are compute as:

The server uses 2048-bits key and the public exponent  is 3 (so small) and the otp is small too, so the cube of otp is smaller than the modulus. We can easily compute the otp by computing the cube root of encrypted OTP:

 

I got an encrypted OTP then computed with sage:

Submit the OTP and get the flag 😀

That’s all for this challenge. So easy.

 

Description:

You should solve a DLP challenge, but how? Of course , you don’t expect us to give you a regular and boring DLP problem!

nc 146.185.143.84 28416

Here is the [C]ryptography function

As we can see, that fuction random n and s then compute:

We have:

Take a look at the Pascal’s triangle:

We can easily realize that :

We don’t care whatever the value of X is. We compute:

 Then, if we have  we can compute n efficiently, luckily we already had  with s+1 > 2

Now we compute n:

where (n+1)*msg+1 is smaller than then:

I got the numbers like that

then compute:

I wonder if it was an easy challange or i solved it with a different method. I joked with my friend that was a “paper with one line of code challenge” 😀 😀

Description:

Connect to OTP generator server, and try to find one OTP.
This is secure than first server 🙂

nc 66.172.33.77 12431

Here is the [E]ncryption fuction

This challenge is similar to the “a fine OTP server“ challenge. The otp is the concatenation of template_phrase and 18-bytes passphrase and the encrypted OTP are compute as:

(1)

but now, the template_phrase  is longer. So, the otp cubed now larger than the modulus n and we can’t compute the otp as the cube root of the encrypted OTP. 

The server use 2048-bits key with the public exponent is 3. We can use openssl or python to extract the key.

Let take a look at the equation:

(2)

Let the otp0 is the otp with the 18-null-bytes-passphrase, otherwise, otp0 is the concatenation of template_phrase and 18-bytes “\x00”, then we have the difference between otp0 and otp1 is the passphrase.

(3)

Combine equations (1), (2) and (3), let a = otp0, b = passphrase1, we have:

We can easily compute the encrypted of otp0:

then :

Now, we have the right-side of the equation is smaller than the modulus then we can tranform that congruence equation into polynomial equation:

Now, we can easily compute the passphrase1 by solving the cubic equation.

Submit the OTP and get the flag 😀

That ‘s all and the flag is “ASIS{gj____Finally_y0u_have_found_This_is_Franklin-Reiter’s_attack_CongratZ_ZZzZ!_!!!}”.