Number Theory on manbolq's Blog

ASIS Primes - CryptoCTF - writeup

Sat, 27 Dec 2025 00:00:00 +0000

This challenge is a RSA-style challenge, in which we can provide the prime numbers used for encryption as long as they satisfy specific conditions.

First, standard parameters are generated:

global flag
nbit = 512
p, q = [getPrime(nbit) for _ in range(2)]
e = 65537

Then, the main challenge’s logic goes into this loop:

while True:
    pr(f"{border} Options: \n{border}\t[E]ncrypted the flag! \n{border}\t[S]ubmit primes! \n{border}\t[Q]uit")
    ans = sc().decode().strip().lower()
    if ans == 'e':
        m = bytes_to_long(flag)
        c = pow(m, e ^ 1, p * q)
        pr(f'{c = }')
    elif ans == 's':
        pinit = f'CCTF{{7H!S_iZ_th3_f1RSt_pRim3__P_f0R_oUr_{nbit}-bit_m0DulU5_{rand_str(randint(5, 40))}'.encode()
        qinit = f'CCTF{{7H!S_iZ_th3_s3c0Nd_pRim3_Q_f0R_oUr_{nbit}-bit_m0DulU5_{rand_str(randint(5, 40))}'.encode()
        pr(border, f'the condition for the first  prime is: {pinit}')
        pr(border, f'the condition for the second prime is: {qinit}')
        pr(border, f'Please submit the primes p, q: ')
        inp = sc().decode().strip()
        try:
            _p, _q = [int(_) for _ in inp.split(',')]
            _pbytes, _qbytes = [long_to_bytes(_) for _ in (_p, _q)]
            if (
                isPrime(_p) and isPrime(_q) 
                and _pbytes.startswith(pinit) and _qbytes.startswith(qinit) 
                and _pbytes.endswith(b'}') and _qbytes.endswith(b'}') 
                and is_valid(_pbytes) and is_valid(_qbytes)
                and (9 * _p * _q).bit_length() == 2 * nbit
                ):
                    p, q = _p, _q
        except:
            pr(border, f'The input you provided is not valid! Try again!!')
            nbit += 1¡

And the is_valid and rand_str functions are:

Interpol - CryptoCTF - writeup

Wed, 24 Dec 2025 00:00:00 +0000

In this challenge, we are given two files: interpol.sage and output.raw. This is the challenge’s code:

from Crypto.Util.number import *
from flag import flag

def randpos(n):
	if randint(0, 1):
		return True, [(-(1 + (19*n - 14) % len(flag)), ord(flag[(63 * n - 40) % len(flag)]))]
	else:
		return False, [(randint(0, 313), (-1) ** randint(0, 1) * Rational(str(getPrime(32)) + '/' + str(getPrime(32))))]

c, n, DATA = 0, 0, []
while True:
	_b, _d = randpos(n)
	H = [d[0] for d in DATA]
	if _b:
		n += 1
		DATA += _d
	else:
		if _d[0][0] in H: continue
		else:
			DATA += _d
			c += 1
	if n >= len(flag): break

A = [DATA[_][0] for _ in range(len(DATA))]
poly = QQ['x'].lagrange_polynomial(DATA).dumps()
f = open('output.raw', 'wb')
f.write(poly)
f.close()

The challenge creates an array whose entries are the (x,y) coordinates of rational points. Every time a new point is added to the array, there are two possibilities:

Vainrat - CryptoCTF - writeup

Wed, 24 Dec 2025 00:00:00 +0000

For this challenge, we are given a vainrat.sage file. Looking at the code, we see that we will be working with the field of real numbers with 440 bits o precision:

nbit = 110
prec = 4 * nbit
R = RealField(prec)

The main function is the following:

def main():
	m = bytes_to_long(flag)
	x0 = R(10 ** (-len(str(m))) * m)
	while True:
		y0 = abs(R.random_element())
		if y0 > x0: break
	assert len(str(x0)) == len(str(y0))
	c = 0
	pr(border, f'We know y0 = {y0}')
	while True:
		pr("| Options: \n|\t[C]atch the rat \n|\t[Q]uit")
		ans = sc().decode().strip().lower()
		if ans == 'c':
			x, y = rat(x0, y0)
			x0, y0 = x, y
			c += 1
			if c <= randint(12, 19):
				pr(border, f'Unfortunately, the rat got away :-(')
			else: pr(border, f'y = {y}')
		elif ans == 'q': die(border, "Quitting...")
		else: die(border, "Bye...")

And this is the rat function: