CTF日本語サイト : DiceCTF 2023

crypto/Provably Secure
jyu
I proved this cryptographic combiner to be super secure (specifically IND-CCA2) on my graduate cryptography final exam, but just to be safe, I'm making you break it with both primitives being computationally secure!
nc mc.ax 31493
Downloads
server.py

server.py

#!/usr/local/bin/python

# Normally you have unlimited encryption and decryption query requests in the IND-CCA2 game.
# For performance reasons, my definition of unlimited is 8 lol

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes
from secrets import randbits
from os import urandom
from Crypto.Util.strxor import strxor

def encrypt(pk0, pk1, msg):
    r = urandom(16)
    r_prime = strxor(r, msg)
    ct0 = pk0.encrypt(r, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                         algorithm=hashes.SHA256(), label=None))
    ct1 = pk1.encrypt(r_prime, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()), 
                         algorithm=hashes.SHA256(), label=None))
    return ct0.hex() + ct1.hex()


def decrypt(key0, key1, ct):
    ct0 = ct[:256]
    ct1 = ct[256:]
    r0 = key0.decrypt(ct0, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                           algorithm=hashes.SHA256(), label=None))
    r1 = key1.decrypt(ct1, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                           algorithm=hashes.SHA256(), label=None))
    return strxor(r0, r1)


if __name__ == '__main__':
    print("""Actions:
0) Solve
1) Query Encryption
2) Query Decryption
""")
    for experiment in range(1, 129):
        print("Experiment {}/128".format(experiment))
        key0 = rsa.generate_private_key(public_exponent=65537, key_size=2048)
        key1 = rsa.generate_private_key(public_exponent=65537, key_size=2048)
        pk0 = key0.public_key()
        pk1 = key1.public_key()
        print("pk0 =", pk0.public_numbers().n)
        print("pk1 =", pk1.public_numbers().n)
        m_bit = randbits(1)
        seen_ct = set()
        en_count = 0
        de_count = 0
        
        while True:
            choice = int(input("Action: "))
            if choice == 0:
                guess = int(input("m_bit guess: "))
                if (guess == m_bit):
                    print("Correct!")
                    break
                else:
                    print("Wrong!")
                    exit(0)
            elif choice == 1:
                en_count += 1
                if (en_count > 8):
                    print("You've run out of encryptions!")
                    exit(0)
                m0 = bytes.fromhex(input("m0 (16 byte hexstring): ").strip())
                m1 = bytes.fromhex(input("m1 (16 byte hexstring): ").strip())
                if len(m0) != 16 or len(m1) != 16:
                    print("Must be 16 bytes!")
                    exit(0)
                msg = m0 if m_bit == 0 else m1
                ct = encrypt(pk0, pk1, msg)
                seen_ct.add(ct)
                print(ct)
            
            elif choice == 2:
                de_count += 1
                if (de_count > 8):
                    print("You've run out of decryptions!")
                    exit(0)
                in_ct = bytes.fromhex(input("ct (512 byte hexstring): ").strip())
                if len(in_ct) != 512:
                    print("Must be 512 bytes!")
                    exit(0)
                if in_ct in seen_ct:
                    print("Cannot query decryption on seen ciphertext!")
                    exit(0)
                print(decrypt(key0, key1, in_ct).hex())

    with open('flag.txt', 'r') as f:
        print("Flag: " + f.read().strip())

0か1のm_bitを128回連続で当てるとフラグゲット。
Actionsで1) Query Encryptionを選択し2つの値を入力すると暗号化されたデータが返される。次に2) Query Decryptionを選択し暗号化されたデータを入力として与えると1で入力した2つの値のどちらかに復号される。m_bitが0の時は最初の入力、1の時は2つ目の入力となるので、m_bitが分かる。

from pwn import *
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('--local', action='store_true')
args = parser.parse_args()

context.log_level = 'debug'

p = remote('mc.ax', 31493)

for i in range(128):
    p.recvuntil(b"/128\n")
    ret = p.recvline()  #pk0
    ret = p.recvline()  #pk1

    p.recvuntil(b"Action: ")
    p.sendline(b"1")

    p.recvuntil(b"m0 (16 byte hexstring): ")
    p.sendline(b"11111111111111111111111111111111")
    p.recvuntil(b"m1 (16 byte hexstring): ")
    p.sendline(b"22222222222222222222222222222222")

    ct = p.recvline()
    ct = ct.strip()
    #print(ct)

    p.recvuntil(b"Action: ")
    p.sendline(b"2")

    p.recvuntil(b"ct (512 byte hexstring): ")
    p.sendline(ct)

    val = p.recvline()
    val = val.strip()
    #print(val)

    p.recvuntil(b"Action: ")
    p.sendline(b"0")

    p.recvuntil(b"m_bit guess: ")
    if val == b"11111111111111111111111111111111":
        p.sendline(b"0")
    else:
        p.sendline(b"1")
    
    ret = p.recvline()
    #print(ret)
    if ret == b"Wrong":
        break

ret = p.recvall()
#print(ret)
p.close()

実行すると次のようになる。

b'Experiment 128/128\n'
b'pk0 = 26483178418609116136951478639155735955228244719231038357154286456849164060537738601129461329027032592022630276653274631380513565573453208959131970498627891166304660979526866358093970418467452255935885486672919046263969293559022305618635679493450910418358860413789966895286255402093586148398942408961686081886747201577911268454355107333476809801749505548136117482308470616651066354286490397379793697989041763209509786130857855625486035421706980743070961196362581601994281592155108200050766753687511387016112248369819804225762436294955214316499544033467870439578449504064153537328438230865934214907862597149182412802701\n'
b'pk1 = 22667744595601474719286417722625980199953337073921238439970513544682185573760647158871048307685415680411492067802867281482343310100191877885779793610507355501999611487469590935934426591359710644022154322375553905976005195668301956253448563908292821833250608789296031973513718421770681387826699074934899042073377864571289646893078940363500912533248781684860073627225276507037962023181884504883692372741763762006049491280194835446782532329513422943632894660291064132748577211239618413055708718354177215501903052248014031902261890798295746583994399760723038360888997246445020179588051003201717048265195427106050941676633\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'1\n'
[DEBUG] Received 0x18 bytes:
b'm0 (16 byte hexstring): '
[DEBUG] Sent 0x21 bytes:
b'11111111111111111111111111111111\n'
[DEBUG] Received 0x18 bytes:
b'm1 (16 byte hexstring): '
[DEBUG] Sent 0x21 bytes:
b'22222222222222222222222222222222\n'
[DEBUG] Received 0x409 bytes:
b'5a3f744e9f9c02d1b11bf4bf85d9dbf5ec1f8ca76b2468cd3479f55f337a65ad38a74ab8aa698903c48672c4d2681c1da170f4cf2551a35515258f7e1536fa92d7184d90d20096605a939adc17e58c6c0f010d1ee7978f034baa3c54bb6650bc496232cc298349ccefff2b9aca787603bca06b04e8d6c7317cc928097b3cc5a0a376794f67d4926df80e9d8729d14284d64ae34977fd87be5ec37072fe4f2842761fe25275ac903fc44677bd79a49d76d04b96c9152703b569fd4e6e21041eb69c5c8b6b970391c693a46748b63a6179fc53fb24a30ee651a98afdff748f4cbecb86f81d1a53acc93cadb338f06fccbc4515707a7ab721e644205986eb29d8be6f50162452fc1d8891df1b576d5da495c4631f7d1a353f2fcf79460fe2207d96ccae1385d33890705a19bafdf910ef2b723e21a1a225df761416626d1cf3d4b405b456514b050dd69dcb3987cd9cca82de7cce0dc57d32967a2d43ace5f0bab765c03664d61dd32a876de664f2e5b4cf4d8c744cb5b30a538b03aba6d111596af6fcb60252843c07f9b120b57b06ab46cca0b306b6215bb1a90eb062bdb7c1e7192092fcb24089b0d5a114c77b8904e4fffbf5ef2b8dbf95112c2362c14df478cb2f89dfd03d48ffe89cc864f5b5ac056e4886c87dbdc2ee126e1ed69848401fee18cfde7cf326aad014cc53d047979d92d851678d002105ab341f8c0b83e060\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'2\n'
[DEBUG] Received 0x19 bytes:
b'ct (512 byte hexstring): '
[DEBUG] Sent 0x401 bytes:
b'5a3f744e9f9c02d1b11bf4bf85d9dbf5ec1f8ca76b2468cd3479f55f337a65ad38a74ab8aa698903c48672c4d2681c1da170f4cf2551a35515258f7e1536fa92d7184d90d20096605a939adc17e58c6c0f010d1ee7978f034baa3c54bb6650bc496232cc298349ccefff2b9aca787603bca06b04e8d6c7317cc928097b3cc5a0a376794f67d4926df80e9d8729d14284d64ae34977fd87be5ec37072fe4f2842761fe25275ac903fc44677bd79a49d76d04b96c9152703b569fd4e6e21041eb69c5c8b6b970391c693a46748b63a6179fc53fb24a30ee651a98afdff748f4cbecb86f81d1a53acc93cadb338f06fccbc4515707a7ab721e644205986eb29d8be6f50162452fc1d8891df1b576d5da495c4631f7d1a353f2fcf79460fe2207d96ccae1385d33890705a19bafdf910ef2b723e21a1a225df761416626d1cf3d4b405b456514b050dd69dcb3987cd9cca82de7cce0dc57d32967a2d43ace5f0bab765c03664d61dd32a876de664f2e5b4cf4d8c744cb5b30a538b03aba6d111596af6fcb60252843c07f9b120b57b06ab46cca0b306b6215bb1a90eb062bdb7c1e7192092fcb24089b0d5a114c77b8904e4fffbf5ef2b8dbf95112c2362c14df478cb2f89dfd03d48ffe89cc864f5b5ac056e4886c87dbdc2ee126e1ed69848401fee18cfde7cf326aad014cc53d047979d92d851678d002105ab341f8c0b83e060\n'
[DEBUG] Received 0x29 bytes:
b'11111111111111111111111111111111\n'
b'Action: '
[DEBUG] Sent 0x2 bytes:
b'0\n'
[DEBUG] Received 0xd bytes:
b'm_bit guess: '
[DEBUG] Sent 0x2 bytes:
b'0\n'
[DEBUG] Received 0x43 bytes:
b'Correct!\n'
b'Flag: dice{yeah_I_lost_like_10_points_on_that_proof_lmao}\n'

フラグは、

dice{yeah_I_lost_like_10_points_on_that_proof_lmao}

暗号ハードウェアのセキュリティ

李陽

コロナ社

2019-05-23

CTF日本語サイト

DiceCTF 2023

DiceCTF 2023 recursive-csp

DiceCTF 2023 Provably Secure