第十七届ciscn初赛

弃捐勿复道，努力加餐饭。

古典密码

题目内容：

1	AnU7NnR4NassOGp3BDJgAGonMaJayTwrBqZ3ODMoMWxgMnFdNqtdMTM9

题解

初步尝试自己的想法无果后，就对着这边的古典密码一个一个对照，然后发现 Atbash Cipher 有惊喜

找个能区分大小写的Atbash解密网站

Atbash Cipher (online tool) | Boxentriq

然后base64解，fa{2b838a-97ad-e9f743lgbb07-ce47-6e02804c}

最后fence解密：flag{b2bb0873-8cae-4977-a6de-0e298f0744c3}

OvO

XYCTF 铜匠，类似，据此搜索

d高位攻击

根据题目加密要求稍改脚本

Sage 里环中数大致相等可算

1 2	rr = kk + 2 e = 65537 + kk * p + rr * ((p+1) * (q+1)) + 1

$kk = e//n - 2$

把 kk 代入 e中的式子，再两边乘p，就剩一个未知数了，多项式可求

e*p = ( 65537*p + kk * p*p + rr * (n*p+p*p+n+1) + p)

np+pp+n+1

f=e* p - ( 65537*p + kk * p*p + rr * (n*p+p*p+n+1) + p)

exp：

import libnum

def get_full_p(p_high, n,d_high,bits):
    PR.<x> = PolynomialRing(Zmod(n))
    f = x + p_high
    f = f.monic()
    roots = f.small_roots(X=2^(bits + 4), beta=0.4)
    if roots:
        x0 = roots[0]
        p = gcd(x0 + p_high, n)
        return ZZ(p)

def find_p_high(d_high, n,bits):
    kk = d_high//n - 2
    rr = kk+2
    PR.<p> = PolynomialRing(RealField(1000))
    f=d_high * p - ( 65537*p + kk * p*p + rr * (n*p+p*p+n+1)+ p)
    results = f.roots()
    if results:
        for x in results:
            p_high = int(x[0])
            p = get_full_p(p_high, n,d_high,bits)
            if p and p != 1:
                return p

n = 111922722351752356094117957341697336848130397712588425954225300832977768690114834703654895285440684751636198779555891692340301590396539921700125219784729325979197290342352480495970455903120265334661588516182848933843212275742914269686197484648288073599387074325226321407600351615258973610780463417788580083967
e = 37059679294843322451875129178470872595128216054082068877693632035071251762179299783152435312052608685562859680569924924133175684413544051218945466380415013172416093939670064185752780945383069447693745538721548393982857225386614608359109463927663728739248286686902750649766277564516226052064304547032760477638585302695605907950461140971727150383104
c = 14999622534973796113769052025256345914577762432817016713135991450161695032250733213228587506601968633155119211807176051329626895125610484405486794783282214597165875393081405999090879096563311452831794796859427268724737377560053552626220191435015101496941337770496898383092414492348672126813183368337602023823

p = find_p_high(e, n,200)
q = n//p

rr = e//((p+1)*(q+1))
kk = rr-2
e = 65537 + kk * p + rr * ((p+1) * (q+1)) + 1
d = libnum.invmod(e,(p-1)*(q-1))
m = pow(c,d,n)
print(libnum.n2s(int(m)))

# flag{b5f771c6-18df-49a9-9d6d-ee7804f5416c}

忙，待补。。。