In-Depth Reference
The following reference materialsload on demand, select the corresponding file according to the specific direction identified:
- Classical ciphers (Vigenere/Atbash/XOR/OTP/homophonic substitution) → references/classic-ciphers.md
- Modern cipher attacks (AES/CBC/Padding Oracle/LFSR/MAC forgery) → references/modern-ciphers.md
- RSA attacks (small exponent/Wiener/Pollard/Coppersmith/Hastad/CRT) → references/rsa-attacks.md
- ECC attacks (small subgroup/invalid curve/Smart/ECDSA nonce reuse) → references/ecc-attacks.md
- Advanced mathematical attacks (lattice/LWE/isogeny/Pohlig-Hellman/LLL) → references/advanced-math.md
- PRNG attacks (MT19937/LCG/V8 XorShift128+/chaotic maps) → references/prng.md
- ZKP and constraint solving (Z3/graph coloring/Groth16/Shamir SSS) → references/zkp-and-advanced.md
- Historical ciphers (Lorenz SZ40/42/Book Cipher) → references/historical.md
- Exotic algebraic structures (braid group DH/tropical semiring/FPE/Goldwasser-Micali) → references/exotic-crypto.md
- Lattice and LWE attacks (LLL/BKZ/Babai CVP/Coppersmith lattice/NTRU) → references/lattice-and-lwe.md
- Modern cipher attacks continued (Blum-Goldwasser/Hash length extension/RC4 statistics) → references/modern-ciphers-2.md
- Modern cipher attacks Part3 (custom Hash inversion/CRC32 brute force/HMAC timing) → references/modern-ciphers-3.md
- RSA specialized techniques (p=q bypass/CRT cube root/multi-prime factorization/partial key) → references/rsa-attacks-2.md
- Stream cipher attacks (LFSR/RC4 second byte bias/Salsa20/ChaCha20) → references/stream-ciphers.md
Classification Decision Tree
题目涉及加密？
├─ 古典密码（Caesar/Vigenere/XOR/替换） → [references/classic-ciphers.md](references/classic-ciphers.md)
├─ 对称加密（AES/DES/RC4/分组密码）
│ ├─ ECB → 块重排 / 逐字节oracle
│ ├─ CBC → 比特翻转 / Padding Oracle
│ └─ 流密码 → LFSR / Berlekamp-Massey
├─ RSA
│ ├─ 小e → 开根号 ├─ 小d → Wiener
│ ├─ p≈q → Fermat ├─ 公共模数 → ExtGCD
│ └─ 部分已知因子 → Coppersmith (SageMath)
├─ ECC
│ ├─ 阶有小因子 → Pohlig-Hellman
│ ├─ 奇异曲线 → 映射到加法群
│ └─ ECDSA nonce重用 → 恢复私钥
├─ 格/LWE → Babai CVP / LLL 短向量
├─ PRNG → MT19937 untemper / LCG / V8 xs128p
├─ ZKP → 碰撞/预测盐 / Z3求解
└─ 哈希 → 长度扩展(hashpump) / 生日攻击
Quick Reference Tools
| Scenario | Tool/Command |
|---|---|
| RSA automatic attack | RsaCtfTool.py -n N -e E --uncipher C |
| Substitution cipher | quipqiup.com |
| SageMath | sage -python script.py(Coppersmith/ECC/lattice) |
| Z3 constraint solving | pip install z3-solver → BitVec / Int |
| PRNG MT19937 | pip install not_random(floating-point state recovery) |
| V8 Math.random | d0nutptr/v8_rand_buster |
| Padding Oracle | PadBuster / padding-oracle library |
| XOR operation | from pwn import xor |
Commonly Used Python Libraries
pip install pycryptodome z3-solver sympy gmpy2
RSA Basics Quick Reference
from Crypto.Util.number import inverse, long_to_bytes
phi = (p-1)*(q-1)
d = inverse(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m))
Common Patterns
- RSA multiplicative homomorphism: unpadded RSA
S(a)*S(b) mod n = S(a*b), can combine signature forgery - CBC Padding Oracle: ~4096 queries to decrypt a 16-byte block
- Bleichenbacher (ROBOT): RSA PKCS#1 v1.5 padding oracle → ~10K queries to recover plaintext
- CRC32 linearity: appending 4 bytes can forge any CRC32 signature
- Hash length extension: Merkle-Damgard structure
hash(SECRET||data)can append data
RSA Small Exponent Attack
- When e=3, if m^3 < n (no modulo taken, no modular operation), the plaintext can be recovered directly by taking the cube root
Padding Oracle Details
- At most 256 attempts per byte, brute-force trying all possible values