Finite Fields on manbolq's Blog

Asemoon - CryptoCTF - writeup

Tue, 06 Jan 2026 00:00:00 +0000

In this challenge, we are given a file called asemoon.sage. It starts by generating some parameters:

def gen_CP(nbit):
	R.<x> = PolynomialRing(GF(2))
	while True:
		c = ''.join([hex(randint(0, 15))[2:] for _ in range(nbit >> 2)])
		G = R(Integer(int(c, 16)).bits()[::-1]) + x ^ nbit
		if G.is_irreducible():
			return int(c, 16)

nbit = 64
skey = getRandomNBitInteger(nbit)
CP, CT = gen_CP(nbit), []
for _ in range(256):
    cb = _
    for _ in range(8):
        if cb & 1:
            cb = (cb >> 1) ^^ CP
        else:
            cb >>= 1
    CT.append(cb & 0xFFFFFFFFFFFFFFFF)

For now, it is enough to know that CP is a random integer of less than 64 bits and CT is generated from CP deterministically. Then, we have the main loop of the challenge:

Lowdown - CryptoCTF - writeup

Sat, 27 Dec 2025 00:00:00 +0000

In this challenge, we are given a file called lowdown.sage. The challenge implements a custom signature scheme. If we are able to forge a signature for a given message, we get the flag. The challenge first generates the key and the random message to sign:

def makey(k):
    while True:
        g = random_matrix(F, k)
        if g.is_invertible():
            ng = 1 << 192 # g.order()
            break
    r, a = [randint(2, ng - 2) for _ in '01']
    gg = g ** r
    pkey, skey = (g, gg ** a), r
    return(pkey, skey)

global F, k
F = GF(256)
k = 10
pkey, skey = makey(k)

msg = ''.join([string.printable[randint(0, 85)] for _ in range(40)]).encode()

It picks a random matrix $g \in GL(10, F)$ (invertible 10$\times$10 matrix with elements on the field $F$) and generates two random numbers $r$ and $a$. The private key is the random number $r$ and the public key is composed by the matrix $g$ and the matrix $g^{ra}$.

Mitram - CryptoCTF - writeup

Sat, 27 Dec 2025 00:00:00 +0000

This is a bit weird challenge in my opinion. It constructs some exotic matrices, mix them up a little bit and expects us to recover the flag from the output. This is the code:

q, v, m = 256, 40, 14
_F = GF(q)

def makeup(M, n):
	for i in range(n):
		for j in range(i, n):
			M[i, j] += M[j, i]
			M[j, i] = 0
		return M

def mitramap():
	_M = []
	for s in range(m):
		M = zero_matrix(_F, v + m, v + m)
		for i in range(0, v):
			M[i, (i + s + 1) % v] = _F.random_element()
			M[i, (i + s) % m + v] = _F.random_element()
		M = makeup(M, v + m)
		_M.append(M)
	return _M

def n2F(n):
	x = _F.gen()
	e = sum(((n >> _) & 1) * x ** _ for _ in range(8))
	return e

def F2n(e):
	x = _F.gen()
	n = 0
	for _ in range(8):
		n |= (int(e.coefficient(x, _)) << _)
	return n

def embed_secret(msg, v, m):
	M = random_matrix(_F, v, m)
	for _ in range(v):
		M[_, 0] = n2F(msg[_])
	return M

def maketrig():
	return block_matrix([[identity_matrix(_F, v), embed_secret(flag, v, m)], [zero_matrix(_F, m, v), identity_matrix(_F, m)]])

def makepub(F, S):
	S = S.submatrix(0, v, v, m)
	Z = zero_matrix(_F, m, v)
	return [
		block_matrix([
			[G := M.submatrix(0, 0, v, v), (G + G.transpose()) * S + (H := M.submatrix(0, v, v, m))],
			[Z, makeup(S.transpose() * G * S + S.transpose() * H, m)]
		])
		for M in F[:m]
	]

F, S = mitramap(), maketrig()
P = makepub(F, S)

print(f'{dumps(F) = }')
print(f'{dumps(P) = }')

Let’s forget about the specifics of the mitramap and makeup functions, as I won’t be using them in this solution. Note that the maketrig function creates a random matrix whose first column is the flag. Our goal is to recover this matrix $S$.