我多想再见你 哪怕匆匆一眼就别离

Problem: [tangcuxiaojkuai]easy_copper2

[[toc]]

思路

路灯下昏黄的剪影 越走越漫长的林径

EXP

我多想再见你

https://github.com/kionactf/coppersmith

from sage.all import *

import time
from Crypto.Util.number import *
from random import randrange, randint, choices as random_choices
import string
import sys

from coppersmith_onevariable import coppersmith_onevariable
from coppersmith_linear import coppersmith_linear
from coppersmith_multivariate_heuristic import coppersmith_multivariate_heuristic
from lll import *
from contextclass import context
from logger import *
import gc


# sys.set_int_max_str_digits(8000)


#logger.setLevel(DEBUG)


# lllopt = {}
#lllopt = {'algorithm':FPLLL}
lllopt = {'algorithm':FLATTER, 'use_pari_kernel':True}
#lllopt = {'algorithm':FPLLL_BKZ, 'blocksize':3}

context.lllopt = lllopt


def example_onevariable_linear():
    beta = 0.499
    our_small_roots = lambda f, X: coppersmith_onevariable(f, [X], beta)

    e = 65537
    C1 = 282
    C2 = 215656441


    n = 83732821313465518052403665361614770500711747426707910445616394700719876467737514967114877768176244233541342950517438107504392659632618504678367884223695674258126620001220856677629607205209582904215330731871567514530350222492246762740556482040907225061791231222448377878854527601783227627969726021295513927063
    c = 46663818733755991848242947341712498383456884024793897130170411388799402223110989123025227270450872334684154450132747808192836148157068113180136519163245994436646022864578219391320904777242102617963109623497099134092899460260651347833764105572783843769863133591669278971958095602865992957181139586462882547338
    leak1 = 1166802227519044965330497437183661580954600955790078699599066071608461
    leak2 = 100652187

    high_bits = leak1 << C1
    # make it multiple of C2
    high_bits = high_bits - high_bits % C2

    P = PolynomialRing(Zmod(n), 'x')
    x = P.gens()[0]
    for i in range(551, 2**10):
        print(f'>>> {i = }')
        f = C2 * (i * 2**244 + 2**243 + x) + high_bits + leak2

        f = f.monic()


        result = our_small_roots(f, 2**243) # pm
        if (len(result) > 0):
            print(f"result:{result}")
            exit()
        gc.collect()


if __name__ == '__main__':
    example_onevariable_linear()
​

至少玩笑话还能说起

from Crypto.Util.number import *

e = 65537
C1 = 282
C2 = 215656441

n = 83732821313465518052403665361614770500711747426707910445616394700719876467737514967114877768176244233541342950517438107504392659632618504678367884223695674258126620001220856677629607205209582904215330731871567514530350222492246762740556482040907225061791231222448377878854527601783227627969726021295513927063
c = 46663818733755991848242947341712498383456884024793897130170411388799402223110989123025227270450872334684154450132747808192836148157068113180136519163245994436646022864578219391320904777242102617963109623497099134092899460260651347833764105572783843769863133591669278971958095602865992957181139586462882547338
leak1 = 1166802227519044965330497437183661580954600955790078699599066071608461
leak2 = 100652187

high_bits = leak1 << C1
# make it multiple of C2
high_bits = high_bits - high_bits % C2

# assert (p - high_bits - leak2) % C2 == 0
# ans = (p - high_bits - leak2) // C2
# my_i = ans // (2**244)
# my_x = int(ans % (2**244)) - 2**243


P = PolynomialRing(Zmod(n), 'x')
x = P.gens()[0]
i = 897
x_0 = 8175271041403338825347226972756974778900012642754622865431309260605760503
f = C2 * (i * 2**244 + 2**243 + x) + high_bits + leak2
p = gcd(ZZ(f(x_0)), n)
q = n // p
d = inverse_mod(e, (p-1)*(q-1))
m = pow(c, d, n)
print(f'{long_to_bytes(int(m)) = }')
​

总结

街巷初次落叶的秋分 渐行渐远去的我们