e与(q-1)互素,但用上题方法求不出

题目:

c = 2485360255306619684345131431867350432205477625621366642887752720125176463993839766742234027524
n = 0x2CAA9C09DC1061E507E5B7F39DDE3455FCFE127A2C69B621C83FD9D3D3EAA3AAC42147CD7188C53
e = 3

解题思路:

• 分解n得到

• 分析得到e只与(r-1)互素,但用上题方法无法解出
• 那就只能用下题的解法了,也就是有限域开方处理

c = 2485360255306619684345131431867350432205477625621366642887752720125176463993839766742234027524
e = 3
n = 23292710978670380403641273270002884747060006568046290011918413375473934024039715180540887338067
p = 26440615366395242196516853423447
q = 32581479300404876772405716877547
r = 27038194053540661979045656526063R = Zmod(p)['x']; (x,) = R._first_ngens(1) 
f = x ** e - c
f = f.monic()
res1 = f.roots()
print('res1 = ',res1)R = Zmod(q)['x']; (x,) = R._first_ngens(1) 
f = x ** e - c
f = f.monic()
res2 = f.roots()
print('res2 = ',res2)R = Zmod(r)['x']; (x,) = R._first_ngens(1) 
f = x ** e - c
f = f.monic()
res3 = f.roots()
print('res3 = ',res3)

• 运行得到结果

• 最后运用中国剩余定理求解

解答:

from Crypto.Util.number import long_to_bytes
import libnump = 26440615366395242196516853423447
q = 32581479300404876772405716877547
r = 27038194053540661979045656526063res1 = [(13374868592866626517389128266735, 1), (7379361747422713811654086477766, 1), (5686385026105901867473638678946, 1)]
res2 = [(13404203109409336045283549715377, 1), (13028011585706956936052628027629, 1), (6149264605288583791069539134541, 1)]
res3 = [(19616973567618515464515107624812, 1)]
for i in res1:for j in res2:for k in res3:m = libnum.solve_crt([int(i[0]),int(j[0]),int(k[0])],[p,q,r])flag = long_to_bytes(m)if b'ctf' in flag:print(flag)
#\x02\xd1^\xcb\x84\x84RC\xf3J\x000ctf{HahA!Thi5_1s_n0T_rSa~}\n