Phoney - CryptoCTF - writeup

Sat, 27 Dec 2025 00:00:00 +0000

This is a (multi) RSA-type of challenge, in which we are given some relationships between the prime numbers used, and we have to recover them to decrypt the flag. This is the code:

def keygen(nbit):
	p, q, r = [getPrime(nbit + (nbit >> 3) * _) for _ in range(3)]
	return p, q, r

m = bytes_to_long(os.urandom(len(flag)) + flag + os.urandom(len(flag)))
nbit = 512
p, q, r = keygen(nbit)
n, s, e = p * q * r, inverse(p, q * r) + p, 1234567891

while True:
    pr(f"{border} Options: \n{border}\t[E]ncrypt the flag! \n{border}\t[P]ublic information \n{border}\t[Q]uit")
    ans = sc().decode().strip().lower()
    if ans == 'e':
        assert m < n
        c = pow(m, e, n)
        pr(f'{c = }')
    elif ans == 'p':
        pr(border, f'{n = }')
        pr(border, f'{s = }')
        pr(border, f'{q % p = }')

So, the server generates three prime numbers, $r, s$ and $t$, of 512, 576 and 640 bits, respectively. Then, we are given $n = pqr$, $s$, which is computed as s = inverse(p, q*r) + p and q % p. First, note that as $qr$ is quite bigger than $p$, we can take the sum of $p$ into the modular expression and say that

Multi-Prime RSA on manbolq's Blog

Phoney - CryptoCTF - writeup