[watevrCTF 2019]Baby RLWE

题目

Mateusz carried a huge jar of small papers with public keys written on them, but he tripped and accidentally dropped them into the scanner and made a txt file out of them! D: Note: This challenge is just an introduction to RLWE, the flag is (in standard format) encoded inside the private key.

baby_rlwe.sage

from sage.stats.distributions.discrete_gaussian_polynomial import DiscreteGaussianDistributionPolynomialSampler as d_gaussflag = bytearray(raw_input())
flag = list(flag)n = len(flag)
q = 40961## Finite Field of size q.
F = GF(q)## Univariate Polynomial Ring in y over Finite Field of size q
R.<y> = PolynomialRing(F)## Univariate Quotient Polynomial Ring in x over Finite Field of size 40961 with modulus b^n + 1
S.<x> = R.quotient(y^n + 1)def gen_small_poly():sigma = 2/sqrt(2*pi)d = d_gauss(S, n, sigma)return d()def gen_large_poly():return S.random_element()## Public key 1
a = gen_large_poly()## Secret key
s = S(flag)file_out = open("downloads/public_keys.txt", "w")
file_out.write("a: " + str(a) + "\n")for i in range(100):## Errore = gen_small_poly()## Public key 2b = a*s + efile_out.write("b: " + str(b) + "\n")file_out.close()

解题

Mateusz拿着一大罐写着公钥的小文件，但他绊倒了，不小心把它们丢进了扫描仪，并用它们制作了一个txt文件！D：注意：这个挑战只是对RLWE的介绍，标志（标准格式）编码在私钥中。

RLWE是Ring learning with errors的简称，是基于格的环上容错学习问题

RLWE 问题定义为：给定均匀随机生成的多项式 a∈Rqa \in R_qa∈Rq，s∈Rqs \in R_qs∈Rq和e∈Rqe \in R_qe∈Rq 服从分布 XXX， bi=ais+eib_i=a_is+e_ibi=ais+ei。搜索版本的 RLWE 问题 (Search RLWE) 为：给定多组 (ai,bi)(a_i,b_i)(ai,bi)，找到 sss。判定版本的 RLWE 问题 (Decision RLWE) 为：将bib_ibi和均匀随机生成的向量区分开。
大概能看出这道题就是这种类型的了，但是怎么解呢

找到一位大佬的思路

keys = open("public_keys.txt", "r").read().split("n")[:-1]
temp1 = keys[0].find("^")
temp2 = keys[0].find(" ", temp1)
n = Integer(keys[0][temp1+1:temp2]) + 1
q = 40961
F = GF(q)
R.<y> = PolynomialRing(F)
S.<x> = R.quotient(y^n + 1)
a = S(keys[0].replace("a: ", ""))
keys = keys[1:]
counters = []
for i in range(n):counters.append({})for key in keys:b = key.replace("b: ", "")b = list(S(b))for i in range(n):try:counters[i][b[i]] += 1except:counters[i][b[i]] = 1a_s = []
for counter in counters:dict_keys = counter.keys()max_key = 0maxi = 0for key in dict_keys:if counter[key] > maxi:maxi = counter[key]max_key = keya_s.append(max_key)a_s = S(a_s)
s = a_s/a
print ''.join(map(chr,list(s)))

也有师傅说：
用sage解
通过观察e的生成函数可以发现多项式e上的很多位都为0
这就说明我们可以通过统计b中的相应位上的出现次数最多的系数作为a*s的值
而a我们又是知道的
所以就可以求出s来
从而绕过e的干扰

#sage
from sage.stats.distributions.discrete_gaussian_polynomial import DiscreteGaussianDistributionPolynomialSampler as d_gauss
keys = open("public_keys.txt", "r").read().split("\n")[:-1]
temp1 = keys[0].find("^")
temp2 = keys[0].find(" ", temp1)
n=int(keys[0][temp1+1:temp2])+1
print(n)
q = 40961
F = GF(q)
R.<y> = PolynomialRing(F)
S.<x> = R.quotient(y^n + 1)
num=[]
for i in range(n):num.append({})
#print(num)
a=S(keys[0].replace('a: ',''))
#print(a)
keys=keys[1:]
for key in keys:b=key.replace('b: ','')li=list(S(b))#print(li)for i in range(len(num)):try:num[i][li[i]]+=1except:num[i][li[i]]=1
asnum=[]
#print(num)
for i in num:asnum.append(max(i,key=i.get))
#print(asnum)
aspoly=S(asnum)
flag=aspoly/a
print(list(flag))
flag=''.join(map(chr,flag))
print(flag)

运行得到watevr{rlwe_and_statistics_are_very_trivial_when_you_reuse_same_private_keys#02849jedjdjdj202ie9395u6ky}

[watevrCTF 2019]Baby RLWE相关推荐

[watevrCTF 2019]Repyc [NPUCTF2020]BasicASM
文章目录 [watevrCTF 2019]Repyc 反编译替换后整体思路: 脚本: [NPUCTF2020]BasicASM 查看题目: 分析 `call __CheckForDebuggerJ ...
BUUCTF：[watevrCTF 2019]Evil Cuteness
题目地址:https://buuoj.cn/challenges#[watevrCTF%202019]Evil%20Cuteness binwalk分析,发现zip压缩包,使用dd命令分离提取压缩包 ...
CTF逆向-[MRCTF2020]VirtualTree-恒成立的jz花指令去除及smc变换原执行流程在二叉树上的应用，通过逆向思维编写脚本以解决
CTF逆向-[MRCTF2020]VirtualTree-恒成立的jz花指令去除及smc变换原执行流程在二叉树上的应用,通过逆向思维编写脚本以解决来源:https://buuoj.cn/ 内容: 附 ...
BUUCTF reverse题解汇总
本文是BUUCTF平台reverse题解的汇总题解均来自本人博客目录 Page1 Page2 Page3 Page4 Page1 easyre reverse1 reverse2 内涵的软件新年 ...
CTF逆向-[b01lers2020]little_engine-cpp基本函数用法和byte类型要点
CTF逆向-[b01lers2020]little_engine-cpp基本函数用法和byte类型要点来源:https://buuoj.cn/ 内容: 附件:https://pan.baidu.co ...
2021-12-27
[watevrCTF 2019]Crypto over the intrawebs 题目 import socket, select, signal, string import sys, os, t ...
REVERSE-PRACTICE-BUUCTF-27
REVERSE-PRACTICE-BUUCTF-27 [XMAN2018排位赛]Dragon Quest [羊城杯 2020]easyre [watevrCTF 2019]Repyc [2019红帽杯 ...
REVERSE-PRACTICE-BUUCTF-24
REVERSE-PRACTICE-BUUCTF-24 [watevrCTF 2019]Timeout [SUCTF2019]hardcpp [CISCN2018]2ex [UTCTF2020]baby ...
BUUCTF MISC刷题笔记(三)
BUUOJ Misc [MRCTF2020]pyFlag Business Planning Group [ACTF新生赛2020]剑龙 [GWCTF2019]huyao [UTCTF2020]Fil ...

[watevrCTF 2019]Baby RLWE

[watevrCTF 2019]Baby RLWE

[watevrCTF 2019]Baby RLWE相关推荐

最新文章

热门文章