N = 799435724361941209634642555902315435908058123605331438387001798549338453520550411955040034588382681734261551948934231708112188214329385775197475015900886462678223823221663504870303417810891914590183627695363822581523705641504085155996223051520822630001053204808158568793360428631925512479398108990194783353106281215727815924117572620057685972399090366983671158515878975809439859039986317907669857201927700624787846399742932381426050450874840002845772010595287785787014208146359876931886263687047818683794261329936228163632966638728420728815223888138456007423954834668594012507643531951685321953112783259102186136667 e = 3 Here's the encrypted flag: 1396c4db226f20a9076f0197826de0220f57cc4359107111b9eebf5e56b52e43e70aa2371b4db64260f0bbad80db0c7f8a121997bb02667a3d2d40d0e086209cd6e18568e251331a536d35257ae57bb7824e8dfbc6d1d1b421eab40ddfef686d8882806e44c353cc9efc2576c76ab856c7c2dbf27e43e2cc61da3f0aee94ed426f3b646981f60a965c9abe80bb09ea5def3db33929b1696d36f773c09989e511d7e16c99ddbe104331cd25e585483469ffeed7dbea1f2c829ed02eb98d6f4cb63ba67bc2aab0ddb44ef218141acd4a6ae14efa3dbf7d2834a6a40d054f1b0c49b757dabb75c5b91d6f415fe5c1e35d9f8a72200ac6a198279bde3e76eb5face
RSA Coppersmith's Short Pad Attack
from Crypto.Util.number import * import string N = 799435724361941209634642555902315435908058123605331438387001798549338453520550411955040034588382681734261551948934231708112188214329385775197475015900886462678223823221663504870303417810891914590183627695363822581523705641504085155996223051520822630001053204808158568793360428631925512479398108990194783353106281215727815924117572620057685972399090366983671158515878975809439859039986317907669857201927700624787846399742932381426050450874840002845772010595287785787014208146359876931886263687047818683794261329936228163632966638728420728815223888138456007423954834668594012507643531951685321953112783259102186136667 e = 3 c = 0x1396c4db226f20a9076f0197826de0220f57cc4359107111b9eebf5e56b52e43e70aa2371b4db64260f0bbad80db0c7f8a121997bb02667a3d2d40d0e086209cd6e18568e251331a536d35257ae57bb7824e8dfbc6d1d1b421eab40ddfef686d8882806e44c353cc9efc2576c76ab856c7c2dbf27e43e2cc61da3f0aee94ed426f3b646981f60a965c9abe80bb09ea5def3db33929b1696d36f773c09989e511d7e16c99ddbe104331cd25e585483469ffeed7dbea1f2c829ed02eb98d6f4cb63ba67bc2aab0ddb44ef218141acd4a6ae14efa3dbf7d2834a6a40d054f1b0c49b757dabb75c5b91d6f415fe5c1e35d9f8a72200ac6a198279bde3e76eb5face numofbytes = 31 numofpad = 97 left_padding = bytes_to_long(b' ' *numofpad) * pow(256, numofbytes) PR.<x> = PolynomialRing(Zmod(N)) f = (left_padding + x)^e - c f = f.monic() xs = f.small_roots(X=2^(numofbytes*8), beta=0.6) for x in xs: print(long_to_bytes(x))
