2022 SUSCTF

import numpy as np#from secret import flagdef gravity(n,d=0.25):    A=np.zeros([n,n])    for i in range(n):        for j in range(n):            A[i,j]=d/n*(d**2+((i-j)/n)**2)**(-1.5)    return An=len(flag)A=gravity(n)x=np.array(list(flag))b=A@xnp.savetxt('b.txt',b)

import numpy as npdef gravity(n,d=0.25):    A=np.zeros([n,n+1])    for i in range(n):        for j in range(n):            A[i,j]=int((d/n*(d**2+((i-j)/n)**2)**(-1.5))*10e16)        A[i,j+1] = 0    return An=85A=gravity(n)with open ("b.txt") as f:data = f.read().split("\n")b = [int(eval(i)*10e16) for i in data]b.append(100)A = matrix(ZZ,A)Ab = A.stack(vector(b))AB = Ab.BKZ(block_size = 22)assert AB[0][-1] == 100cvp = vector(list(vector(b) - AB[0])[:-1])s = A \ cvpprint("".join(chr(i) for i in s[:-1] ))

from magic_box import *from secret import mask1, mask2, seed1, seed2, seed3n1, n2 = 64, 12flag = 'SUSCTF{***}'def encrypt(cipher, ipath, opath):    ifile=open(ipath,'rb')    ofile=open(opath,'wb')    plaintext=ifile.read()    for ch in plaintext:        c=ch^cipher.getrandbit(8)        ofile.write(long_to_bytes(c))    ifile.close()    ofile.close()def problem1():    r = getRandomInteger(6)    magic = 1<<r    lfsr1 = lfsr(seed1, mask1, n1)    lfsr2 = lfsr(seed2, mask2, n2)    cipher = generator(lfsr1, lfsr2, magic)    encrypt(cipher, "MTk4NC0wNC0wMQ==_6d30.txt", "MTk4NC0wNC0wMQ==_6d30.enc")def problem2():    magic = getPrime(64)    lfsr1=lfsr(seed1, mask1, n1)    lfsr2=lfsr(seed3, mask2, n2)    cipher = generator(lfsr1, lfsr2, magic)    encrypt(cipher, "MTk4NC0xMi0yNQ==_76ff.txt", "MTk4NC0xMi0yNQ==_76ff.enc")    # flag in it?    print(f'hint={magic}')    # hint = 15193544052573546419problem1()problem2()

from Crypto.Util.number import *from magic_box import *import osfrom tqdm import tqdmimport stringn1=64n2=16magic = 15193544052573546419with open("MTk4NC0wNC0wMQ==_6d30.enc","rb") as f:data1 = f.read()# data = data1[:4]# for i in tqdm(range(4095)):# for j in range(4095):# lfsr2 = lfsr(i, j, n2)# s = ""# for ch in data:# tmp = lfsr2.getrandbit(8)# c = chr(tmp ^ ord(ch))# if c not in "Date":# break# s+=c# else:# if c == "Date":# print(i,j,s)# # 73%|███████▎  | 2988/4095 [02:21<00:53, 20.67it/s](2989, 2053, 'Date')sage:from tqdm import tqdmfrom Crypto.Util.number import *class lfsr():    def __init__(self, seed, mask, length):        self.length_mask = 2 ** length - 1        self.mask = mask & self.length_mask        self.state = seed & self.length_mask    def next(self):        next_state = (self.state << 1) & self.length_mask        i = self.state & self.mask & self.length_mask        output = 0        while i != 0:            output ^^= (i & 1)            i = i >> 1        next_state ^^= output        self.state = next_state        return output    def getrandbit(self, nbit):        output = 0        for _ in range(nbit):            output = (output << 1) ^^ self.next()        return outputn1=64n2=16with open("MTk4NC0xMi0yNQ==_76ff.enc","rb") as f:outputs = f.read()# output = input ^ c1 ^ c2#已知两轮输出，恢复maskdata = b"Date: 1984-12-25"output = bytes_to_long(outputs[:16])inputs = bytes_to_long(data)for seed3 in tqdm(range(4095)):lfsr2 = lfsr(seed3, 2053, n2)tmp = lfsr2.getrandbit(128)tmpc1 = list(bin(output ^^ inputs ^^ tmp)[2:].zfill(128))#已知两轮输出，恢复maskmat = [tmpc1[i:i+64] for i in range(64)]A = matrix(GF(2),mat)if not A.det():continueB = vector(GF(2),tmpc1[64:128])mask_int = list(A.solve_right(B))mask = ''.join(str(i) for i in mask_int)#mask = [int(n.str()) for n in A.solve_right(B).transpose().entries()]# 已知后一轮输出和mask，往前恢复一轮A = []for i in range(64):    B = []    for j in range(64):        if j == 63:            B.append(mask[i])        elif j == i-1:            B.append(1)        else:            B.append(0)    A.append(B)M = matrix(GF(2),A)M = M^64if not M.det():continuekey = ""for i in M.solve_left(vector(GF(2),tmpc1[:64])):    key += str(i)key = int(key,2)lfsr1 = lfsr(key, int(mask,2), n1)lfsr2 = lfsr(seed3, 2053, n2)FLAG = ""# 少看几个，对了就停for i in range(32):tmp = lfsr1.getrandbit(8) ^^ lfsr2.getrandbit(8) ^^ (outputs[i])FLAG += chr(tmp)if FLAG[16] != "\r": #日期结束后是跟一个 \r\ncontinueelse:print(FLAG,seed3,key,int(mask,2))# ix'ÒMìýã&ÉúÈ 447 8149177008550264303 13814079135560313241984-12-25# èû£¼’ñr,¤YÞìþ° 771 18096245683970471305 115606832613435467084-12-25# Së“05ÔáuëÍC 1674 13294312146216746169 115187255862075445261984-12-25#  75%|███████▍  | 3053/4095 [00:49<00:16, 63.38it/s]Date: 1984-12-25# Though the hun 3054 5071452738113266023 9223372036854775811#  91%|█████████ | 3713/4095 [01:00<00:06, 60.53it/s]seed3 = 3054key = 5071452738113266023mask1 = 9223372036854775811# 然后那这几个数解完所有密文就行

from Crypto.Util.number import *from secret import flag,getMyPrimeimport hashlibimport randomclass SpecialCurve:    def __init__(self,p,a,b):        self.p=p        self.a=a        self.b=b    def __str__(self):        return f'SpecialCurve({self.p},{self.a},{self.b})'    def add(self,P1,P2):        x1,y1=P1        x2,y2=P2        if x1==0:            return P2        elif x2==0:            return P1        elif x1==x2 and (y1+y2)%self.p==0:            return (0,0)        if P1==P2:            t=(2*self.a*x1-self.b)*inverse(2*y1,self.p)%self.p        else:            t=(y2-y1)*inverse(x2-x1,self.p)%self.p        x3=self.b*inverse(self.a-t**2,self.p)%self.p        y3=x3*t%self.p        return (x3,y3)    def mul(self,P,k):        assert k>=0        Q=(0,0)        while k>0:            if k%2:                k-=1                Q=self.add(P,Q)            else:                k//=2                P=self.add(P,P)        return Qdef problem(size,k):    p=getMyPrime(size)    x=random.randint(1,p-1)    y=random.randint(1,p-1)    e=random.randint(1,p-1)    a=k*random.randint(1,p-1)**2%p    b=(a*x**2-y**2)*inverse(x,p)%p    curve=SpecialCurve(p,a,b)    G=(x,y)    Q=curve.mul(G,e)    print(f'curve={curve}')    print(f'G={G}')    print(f'Q={Q}')    return ee1=problem(128,1)e2=problem(256,0)e3=problem(512,-1)enc=bytes_to_long(hashlib.sha512(b'%d-%d-%d'%(e1,e2,e3)).digest())^bytes_to_long(flag.encode())print(f'enc={enc}')