[Crypto] hpcurve - k1rit0 xp0int Posted on Jun 6 2021 超椭圆曲线...第一次接触,但搜到了原题 https://pwnthem0le.polito.it/2020/12/20/hxpCTF-2020-Hyper-writeup/ 具体原理我不是很懂也敢乱说 改一下上面链接的exp就可以了 ```python #sage import itertools import struct p = 10000000000000001119 R.<x> = GF(p)[] y = x f = y + y^7 C = HyperellipticCurve(f, 0) J = C.jacobian() Ds = [J(C(x, min(f(x).sqrt(0,1)))) for x in (11,22,33)] enc = bytes.fromhex('66def695b20eeae3141ea80240e9bc7138c8fc5aef20532282944ebbbad76a6e17446e92de5512091fe81255eb34a0e22a86a090e25dbbe3141aff0542f5') known_pt = ('a'*20+'flag').encode() rng_output = bytes(e^^m for e,m in zip(enc, known_pt)) blocks = [rng_output[i:i+8] for i in range(0, len(rng_output), 8)] ui = [int.from_bytes(r, 'little') for r in blocks] u = x^3 + ui[2]*x^2 + ui[1]*x + ui[0] L = GF(p).algebraic_closure() FL = True while FL: roots = [r[0] for r in u.change_ring(L).roots()] RR.<zz> = PolynomialRing(L) v = RR.lagrange_polynomial([(xi, f(xi).sqrt()) for xi in roots]) vi = [v.coefficients()[i].as_finite_field_element()[1] for i in range(3)] try: vi = [(int(-c), int(c)) for c in vi] except: continue for rs in itertools.product(*vi): q = struct.pack('<'+'Q'*len(rs), *rs) try: flag = bytes(k^^m for k,m in zip((rng_output+q)*2, enc)).decode() print(flag) FL = False break except: pass ``` 打赏还是打残，这是个问题 赏 Wechat Pay Alipay web3 Web1 find_it
没有帐号? 立即注册