2025 ISCTF Crypto方向题目解析与密码学教学文档<\/h1>

1. Ez_Caesar（变异凯撒密码）<\/h2>

题目背景<\/h3>
本题实现了一个变异的凯撒密码，加密时偏移量会动态变化。<\/p>

加密原理<\/h3>

初始偏移量 shift = 2<\/code><\/li>
每加密一个字母后，偏移量增加3<\/li>

只对字母字符进行加密，非字母字符保持不变<\/li>
<\/ul>
解密方法<\/h3>
采用与加密相反的思路：<\/p>

初始偏移量同样设为2<\/li>
对每个字母字符进行反向偏移计算<\/li>
每处理一个字符后，偏移量增加3（与加密过程保持一致）<\/li>
<\/ul>
解密代码<\/h3>
def<\/span> variant_caesar_decrypt<\/span>(text):
<\/span><\/span>    decrypted =<\/span> ""<\/span>
<\/span><\/span>    shift =<\/span> 2<\/span>
<\/span><\/span>    for<\/span> char in<\/span> text:
<\/span><\/span>        if<\/span> char.<\/span>isalpha():
<\/span><\/span>            if<\/span> char.<\/span>isupper():
<\/span><\/span>                base =<\/span> ord('A'<\/span>)
<\/span><\/span>                new_char =<\/span> chr((ord(char) -<\/span> base -<\/span> shift) %<\/span> 26<\/span> +<\/span> base)
<\/span><\/span>            else<\/span>:
<\/span><\/span>                base =<\/span> ord('a'<\/span>)
<\/span><\/span>                new_char =<\/span> chr((ord(char) -<\/span> base -<\/span> shift) %<\/span> 26<\/span> +<\/span> base)
<\/span><\/span>            decrypted +=<\/span> new_char
<\/span><\/span>            shift +=<\/span> 3<\/span>
<\/span><\/span>        else<\/span>:
<\/span><\/span>            decrypted +=<\/span> char
<\/span><\/span>    return<\/span> decrypted
<\/span><\/span>
<\/span><\/span>c =<\/span> 'KXKET<\/span>{Tubsdx_re_hg_zytc_hxq_vnjma}<\/span>'<\/span>
<\/span><\/span>print(variant_caesar_decrypt(c))  # ISCTF{Caesar_is_so_easy_and_funny}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

凯撒密码的基本原理是字符偏移<\/li>
变异凯撒密码的关键在于偏移量的动态变化<\/li>
解密时需要完全复现加密时的偏移量变化规律<\/li>
<\/ul>
2. Power Tower（幂塔问题）<\/h2>
题目背景<\/h3>
涉及模运算和幂塔计算，需要利用中国剩余定理(CRT)求解。<\/p>
关键发现<\/h3>

题目声称n是256位素数，但实际上n可分解为三个素数的乘积<\/li>
使用factordb等工具可获取n的分解：n = p₁ × p₂ × p₃<\/li>
<\/ul>
解题步骤<\/h3>

对每个素因子pᵢ计算局部解<\/li>
使用中国剩余定理组合局部解得到最终解<\/li>
通过异或操作恢复flag<\/li>
<\/ol>
解密代码<\/h3>
from<\/span> Crypto.Util.number import<\/span> long_to_bytes
<\/span><\/span>from<\/span> functools import<\/span> reduce
<\/span><\/span>
<\/span><\/span>def<\/span> crt<\/span>(residues, moduli):
<\/span><\/span>    total =<\/span> 0<\/span>
<\/span><\/span>    prod =<\/span> 1<\/span>
<\/span><\/span>    for<\/span> m in<\/span> moduli:
<\/span><\/span>        prod *=<\/span> m
<\/span><\/span>    for<\/span> r, m in<\/span> zip(residues, moduli):
<\/span><\/span>        p =<\/span> prod \/\/<\/span> m
<\/span><\/span>        total +=<\/span> r *<\/span> pow(p, -<\/span>1<\/span>, m) *<\/span> p
<\/span><\/span>    return<\/span> total %<\/span> prod
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>t =<\/span> 6039738711082505929<\/span>
<\/span><\/span>primes =<\/span> [127<\/span>, 841705194007<\/span>, 1005672644717572752052474808610481144121914956393489966622615553<\/span>]
<\/span><\/span>c =<\/span> 114092817888610184061306568177474033648737936326143099257250807529088213565247<\/span>
<\/span><\/span>
<\/span><\/span>residues =<\/span> []
<\/span><\/span>for<\/span> p in<\/span> primes:
<\/span><\/span>    phi =<\/span> p -<\/span> 1<\/span>
<\/span><\/span>    exp =<\/span> pow(2<\/span>, t, phi)  # 简化指数计算<\/span>
<\/span><\/span>    l_p =<\/span> pow(2<\/span>, exp, p)  # 模p下的计算结果<\/span>
<\/span><\/span>    residues.<\/span>append(l_p)
<\/span><\/span>
<\/span><\/span>l =<\/span> crt(residues, primes)
<\/span><\/span>flag =<\/span> c ^<\/span> l
<\/span><\/span>print(long_to_bytes(flag))  # ISCTF{Euler_1s_v3ry|useful!!!!!}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

中国剩余定理的应用场景和原理<\/li>
大数分解在密码分析中的重要性<\/li>
欧拉定理在模幂运算中的简化作用<\/li>
<\/ul>
3. baby_equation（方程求解）<\/h2>
题目背景<\/h3>
需要通过代数变换将多元方程转化为单变量方程求解。<\/p>
解题思路<\/h3>

将已知方程相加得到新关系式<\/li>
通过代换消去其他变量，得到关于b的单变量高次方程<\/li>
使用数学工具求解该方程<\/li>
<\/ol>
关键步骤<\/h3>

设已知方程为：

a³ + b⁶ = H1<\/li>
b⁵ + 6a³c³\/a³ + 2acb = H2<\/li>
a³ - b⁶ = H3<\/li>
<\/ul>
<\/li>
通过代数变换得到关于b的多项式方程<\/li>
<\/ul>
求解代码<\/h3>
from<\/span> sage.all import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>K1 =<\/span> 5530346600323339885232820545798418499625132786869393636420197124606005490078041505765918120769293936395609675704197197479866186297686468133906640256390919799453701894382992223127374374212586492263661287287954143417128958298503464448<\/span>
<\/span><\/span>K2 =<\/span> 3672387566481634932632147073162736684768502472691316672641810915658843009888927691356318999678786606498949603828582004040213248582239696135245956482586942861911170423611833986217506435186606622181418065496949887722886999596999114757792357<\/span>
<\/span><\/span>K3 =<\/span> 5530346600323339885232820545798418499625132786869393636420197035566805062064534503704976756468319888650441668826363984844327206056424439752726283862026042410921197396370839233560708886006884569969932749615838070243922866371345910111<\/span>
<\/span><\/span>
<\/span><\/span>S =<\/span> K1 -<\/span> K3
<\/span><\/span>T =<\/span> K1 -<\/span> (2<\/span>*<\/span>K3)\/\/<\/span>3<\/span>
<\/span><\/span>R.<<\/span>b><\/span> =<\/span> ZZ[]
<\/span><\/span>X =<\/span> S -<\/span> b^<\/span>6<\/span>
<\/span><\/span>Y =<\/span> T -<\/span> 2<\/span>*<\/span>b^<\/span>6<\/span>
<\/span><\/span>
<\/span><\/span># 构建单变量多项式<\/span>
<\/span><\/span>poly =<\/span> (b^<\/span>5<\/span> +<\/span> 2<\/span>*<\/span>b*<\/span>Y -<\/span> K2)*<\/span>X +<\/span> 6<\/span>*<\/span>Y^<\/span>3<\/span>
<\/span><\/span>roots =<\/span> poly.<\/span>roots(ring=<\/span>ZZ)
<\/span><\/span>b0 =<\/span> roots[0<\/span>][0<\/span>]
<\/span><\/span>
<\/span><\/span># 恢复其他变量<\/span>
<\/span><\/span>X0 =<\/span> S -<\/span> b0^<\/span>6<\/span>
<\/span><\/span>a0 =<\/span> abs(X0).<\/span>nth_root(3<\/span>)
<\/span><\/span>if<\/span> X0 <<\/span> 0<\/span>: a0 =<\/span> -<\/span>a0
<\/span><\/span>
<\/span><\/span>Y0 =<\/span> T -<\/span> 2<\/span>*<\/span>b0^<\/span>6<\/span>
<\/span><\/span>c0 =<\/span> Y0 \/\/<\/span> a0
<\/span><\/span>
<\/span><\/span>print(bytes.<\/span>fromhex(hex(int(c0))[2<\/span>:]).<\/span>decode())  # ISCTF{y0u_93t_7h3_3qu4710n_50lv3}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

多元方程系统的化简技巧<\/li>
代数消元法的应用<\/li>
高次方程求根的数值方法<\/li>
<\/ul>
4. baby_math（数学计算）<\/h2>
题目背景<\/h3>
基于三角函数的加密问题，需要利用LLL算法求解。<\/p>
解题思路<\/h3>

将三角函数值转换为高精度整数<\/li>
构建格(Lattice)并使用LLL算法进行约简<\/li>
从约简结果中提取flag<\/li>
<\/ol>
解密代码<\/h3>
from<\/span> sage.all import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>R =<\/span> RealField(1000<\/span>)
<\/span><\/span>enc =<\/span> R("1.24839978408728580181183027675785982784764821592156892598136000363397267152291738689909414790691435938223032351375697399608345468567445269769342300325192248438038963977207296241971217955178443170598629648414706345216797043374408541203167719396818925953801387623884200901703606288664141375049626635852e52"<\/span>)
<\/span><\/span>x =<\/span> R("0.75872961153339387563860550178464795474547887323678173252494265684893323654606628651427151866818730100357590296863274236719073684620030717141521941211167282170567424114270941542016135979438271439047194028943997508126389603529160316379547558098144713802870753946485296790294770557302303874143106908193100"<\/span>)
<\/span><\/span>
<\/span><\/span>sin_x =<\/span> int(R(sin(x))*<\/span>10<\/span>^<\/span>300<\/span>)
<\/span><\/span>cos_x =<\/span> int(R(cos(x))*<\/span>10<\/span>^<\/span>300<\/span>)
<\/span><\/span>enc =<\/span> int(enc*<\/span>10<\/span>^<\/span>300<\/span>)
<\/span><\/span>
<\/span><\/span>M =<\/span> Matrix(ZZ, [
<\/span><\/span>    [cos_x, 1<\/span>, 0<\/span>, 0<\/span>],
<\/span><\/span>    [sin_x, 0<\/span>, 1<\/span>, 0<\/span>], 
<\/span><\/span>    [-<\/span>enc, 0<\/span>, 0<\/span>, 1<\/span>],
<\/span><\/span>]).<\/span>LLL()
<\/span><\/span>
<\/span><\/span>a =<\/span> int(M[0<\/span>, 1<\/span>])
<\/span><\/span>b =<\/span> int(M[0<\/span>, 2<\/span>])
<\/span><\/span>print(bytes.<\/span>fromhex(f<\/span>"<\/span>{<\/span>a:<\/span>x<\/span>}{<\/span>b:<\/span>x<\/span>}<\/span>"<\/span>).<\/span>decode())  # ISCTF{164a3221-7306-4024-88c3-4ef557b86895}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

LLL算法在密码分析中的应用<\/li>
高精度数值计算的重要性<\/li>
格基约简的基本原理<\/li>
<\/ul>
5. easy_RSA（RSA加密）<\/h2>
题目背景<\/h3>
基于RSA加密的变种，需要利用数学关系进行解密。<\/p>
关键洞察<\/h3>
根据欧拉定理有：msg^(N+1) ≡ msg^(p+q) (mod N) = ct₂<\/p>
解题步骤<\/h3>

使用扩展欧几里得算法找到a,b满足：a×e + b×(N+1) = 1<\/li>
计算msg = ct₁^a × ct₂^b mod N<\/li>
<\/ol>
解密代码<\/h3>
from<\/span> Crypto.Util.number import<\/span> long_to_bytes
<\/span><\/span>
<\/span><\/span>def<\/span> egcd<\/span>(a, b):
<\/span><\/span>    if<\/span> a ==<\/span> 0<\/span>:
<\/span><\/span>        return<\/span> (b, 0<\/span>, 1<\/span>)
<\/span><\/span>    gcd, x1, y1 =<\/span> egcd(b %<\/span> a, a)
<\/span><\/span>    x =<\/span> y1 -<\/span> (b \/\/<\/span> a) *<\/span> x1
<\/span><\/span>    y =<\/span> x1
<\/span><\/span>    return<\/span> gcd, x, y
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>N =<\/span> 17630258257080557797062320474423515967705950026415012912087655679315479168903980901728425140787005046038000068414269936806478828260848859753400786557270120330760791255046985114127285672634413513991988895166115794242018674042563788348381567565190146278040811257757119090296478610798393944581870309373529884950663990485525646200034220648901490835962964029936321155200390798215987316069871958913773199197073860062515329879288106446016695204426001393566351524023857332978260894409698596465474214898402707157933326431896629025197964209580991821222557663589475589423032130993456522178540455360695933336455068507071827928617<\/span>
<\/span><\/span>ct1 =<\/span> 5961639119243884817956362325106436035547108981120248145301572089585639543543496627985540773185452108709958107818159430835510386993354596106366458898765597405461225798615020342640056386757104855709899089816838805631480329264128349465229327090721088394549641366346516133008681155817222994359616737681983784274513555455455340301061302815102944083173679173923728968671113926376296481298323500774419099682647601977970777260084799036306508597807029122276595080580483336115458713338522372181732208078117809553781889555191883178157241590455408910096212697893247529197116309329028589569527960811338838624831855672463438531266455<\/span>
<\/span><\/span>ct2 =<\/span> 11792054298654397865983651507912282632831471680334312509918945120797862876661899077559686851237832931501121869814783150387308320349940383857026679141830402807715397332316601439614741315278033853646418275632174160816784618982743834204997402866931295619202826633629690164429512723957241072421663170829944076753483616865208617479794763412611604625495201470161813033934476868949612651276104339747165276204945125001274777134529491152840672010010940034503257315555511274325831684793040209224816879778725612468542758777428888563266233284958660088175139114166433501743740034567850893745466521144371670962121062992082312948789<\/span>
<\/span><\/span>e =<\/span> 65537<\/span>
<\/span><\/span>
<\/span><\/span># 求解a,b<\/span>
<\/span><\/span>gcd, a, b =<\/span> egcd(e, N+<\/span>1<\/span>)
<\/span><\/span>
<\/span><\/span># 计算明文<\/span>
<\/span><\/span>msg =<\/span> (pow(ct1, a, N) *<\/span> pow(ct2, b, N)) %<\/span> N
<\/span><\/span>print(long_to_bytes(msg).<\/span>decode())  # ISCTF{Congratulations_you_master_Mathematical_ability}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

扩展欧几里得算法的应用<\/li>
欧拉定理在RSA中的扩展使用<\/li>
模运算的数学性质<\/li>
<\/ul>
6. 小蓝鲨的LFSR系统（线性反馈移位寄存器）<\/h2>
题目背景<\/h3>
基于LFSR的流密码系统，需要从输出状态恢复初始掩码。<\/p>
解题思路<\/h3>

利用初始状态和输出状态的前128位构建线性方程组<\/li>
使用高斯消元法求解128位掩码<\/li>
使用恢复的掩码解密密文<\/li>
<\/ol>
解密代码<\/h3>
def<\/span> gaussian_elimination_mod2<\/span>(A, b):
<\/span><\/span>    n =<\/span> len(A[0<\/span>])
<\/span><\/span>    m =<\/span> len(A)
<\/span><\/span>    M =<\/span> [A[i][:] +<\/span> [b[i]] for<\/span> i in<\/span> range(m)]
<\/span><\/span>    
<\/span><\/span>    row =<\/span> 0<\/span>
<\/span><\/span>    for<\/span> col in<\/span> range(n):
<\/span><\/span>        if<\/span> row >=<\/span> m: break<\/span>
<\/span><\/span>        
<\/span><\/span>        # 找主元<\/span>
<\/span><\/span>        pivot =<\/span> next((r for<\/span> r in<\/span> range(row, m) if<\/span> M[r][col]), None<\/span>)
<\/span><\/span>        if<\/span> pivot is<\/span> None<\/span>: continue<\/span>
<\/span><\/span>        
<\/span><\/span>        M[row], M[pivot] =<\/span> M[pivot], M[row]
<\/span><\/span>        
<\/span><\/span>        # 消元<\/span>
<\/span><\/span>        for<\/span> r in<\/span> range(m):
<\/span><\/span>            if<\/span> r !=<\/span> row and<\/span> M[r][col]:
<\/span><\/span>                M[r] =<\/span> [M[r][c] ^<\/span> M[row][c] for<\/span> c in<\/span> range(n +<\/span> 1<\/span>)]
<\/span><\/span>        
<\/span><\/span>        row +=<\/span> 1<\/span>
<\/span><\/span>    
<\/span><\/span>    # 返回解<\/span>
<\/span><\/span>    sol =<\/span> [0<\/span>] *<\/span> n
<\/span><\/span>    for<\/span> r in<\/span> range(row):
<\/span><\/span>        for<\/span> c in<\/span> range(n):
<\/span><\/span>            if<\/span> M[r][c]:
<\/span><\/span>                sol[c] =<\/span> M[r][n]
<\/span><\/span>                break<\/span>
<\/span><\/span>    return<\/span> sol
<\/span><\/span>
<\/span><\/span>def<\/span> recover_mask<\/span>(init_state, output_state):
<\/span><\/span>    n =<\/span> len(init_state)
<\/span><\/span>    m =<\/span> min(len(output_state), n)
<\/span><\/span>    
<\/span><\/span>    A, state =<\/span> [], init_state.<\/span>copy()
<\/span><\/span>    for<\/span> t in<\/span> range(m):
<\/span><\/span>        A.<\/span>append(state.<\/span>copy())
<\/span><\/span>        state =<\/span> state[1<\/span>:] +<\/span> [output_state[t]]  # 状态左移<\/span>
<\/span><\/span>    
<\/span><\/span>    return<\/span> gaussian_elimination_mod2(A, output_state[:m])
<\/span><\/span>
<\/span><\/span># 应用求解<\/span>
<\/span><\/span>initState =<\/span> [0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>]
<\/span><\/span>outputState =<\/span> [0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,1<\/span>,0<\/span>,1<\/span>,1<\/span>,0<\/span>,0<\/span>,0<\/span>,0<\/span>,1<\/span>]
<\/span><\/span>
<\/span><\/span>mask =<\/span> recover_mask(initState, outputState)
<\/span><\/span># 使用mask解密密文...<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

LFSR的工作原理和数学基础<\/li>
线性方程组在密码分析中的应用<\/li>
高斯消元法在模2运算中的实现<\/li>
<\/ul>
7. 小蓝鲨的RSA密文（多项式RSA）<\/h2>
题目背景<\/h3>
基于多项式变种的RSA加密，需要利用数学技巧恢复密钥。<\/p>
解题思路<\/h3>

识别加密公式：c = m³ + a₂m² + a₁m + a₀ (mod N)<\/li>
由于m³的数量级较小，可以忽略模N运算<\/li>
使用数值方法求解多项式方程<\/li>
<\/ol>
解密代码<\/h3>
from<\/span> decimal import<\/span> Decimal, getcontext
<\/span><\/span>from<\/span> Crypto.Cipher import<\/span> AES
<\/span><\/span>from<\/span> Crypto.Util.Padding import<\/span> unpad
<\/span><\/span>
<\/span><\/span>getcontext().<\/span>prec =<\/span> 200<\/span>
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>c =<\/span> 3756824985347508967549776773725045773059311839370527149219720084008312247164501688241698562854942756369420003479117<\/span>
<\/span><\/span>a2_high =<\/span> 9012778<\/span>
<\/span><\/span>LOW_BITS =<\/span> 16<\/span>
<\/span><\/span>a1 =<\/span> 621315<\/span>
<\/span><\/span>a0 =<\/span> 452775142<\/span>
<\/span><\/span>
<\/span><\/span>c_dec =<\/span> Decimal(c)
<\/span><\/span>A =<\/span> Decimal(a2_high <<<\/span> LOW_BITS)
<\/span><\/span>a1_dec =<\/span> Decimal(a1)
<\/span><\/span>a0_dec =<\/span> Decimal(a0)
<\/span><\/span>
<\/span><\/span># 牛顿迭代法求解<\/span>
<\/span><\/span>x =<\/span> Decimal(c) **<\/span> (Decimal(1<\/span>)\/<\/span>Decimal(3<\/span>))
<\/span><\/span>for<\/span> i in<\/span> range(50<\/span>):
<\/span><\/span>    Q =<\/span> x**<\/span>3<\/span> +<\/span> A*<\/span>x**<\/span>2<\/span> +<\/span> a1_dec*<\/span>x +<\/span> a0_dec -<\/span> c_dec
<\/span><\/span>    Qp =<\/span> 3<\/span>*<\/span>x**<\/span>2<\/span> +<\/span> 2<\/span>*<\/span>A*<\/span>x +<\/span> a1_dec
<\/span><\/span>    x_new =<\/span> x -<\/span> Q \/<\/span> Qp
<\/span><\/span>    if<\/span> abs(x_new -<\/span> x) <<\/span> Decimal(1<\/span>):
<\/span><\/span>        x =<\/span> x_new
<\/span><\/span>        break<\/span>
<\/span><\/span>    x =<\/span> x_new
<\/span><\/span>
<\/span><\/span>m_approximated =<\/span> int(x)
<\/span><\/span>
<\/span><\/span># 小范围爆破<\/span>
<\/span><\/span>for<\/span> delta in<\/span> range(-<\/span>2<\/span>**<\/span>16<\/span>, 2<\/span>**<\/span>16<\/span>+<\/span>1<\/span>):
<\/span><\/span>    m =<\/span> m_approximated +<\/span> delta
<\/span><\/span>    if<\/span> m <=<\/span> 0<\/span>: continue<\/span>
<\/span><\/span>    num =<\/span> c -<\/span> m**<\/span>3<\/span> -<\/span> a1*<\/span>m -<\/span> a0
<\/span><\/span>    if<\/span> num %<\/span> (m*<\/span>m) !=<\/span> 0<\/span>: continue<\/span>
<\/span><\/span>    a2_candidate =<\/span> num \/\/<\/span> (m*<\/span>m)
<\/span><\/span>    if<\/span> a2_candidate >><\/span> LOW_BITS ==<\/span> a2_high:
<\/span><\/span>        key =<\/span> m.<\/span>to_bytes(16<\/span>, 'big'<\/span>)
<\/span><\/span>        # AES解密...<\/span>
<\/span><\/span>        break<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

多项式加密的安全性分析<\/li>
数值方法在密码分析中的应用<\/li>
牛顿迭代法求解方程的原理<\/li>
<\/ul>
8. 小蓝鲨的后门（CM因子分解）<\/h2>
题目背景<\/h3>
基于复数乘法(CM)方法的RSA后门，需要利用特殊数学性质分解大数。<\/p>
解题思路<\/h3>

使用Hilbert类多项式构建代数结构<\/li>
在特定曲线上进行点运算<\/li>
利用CM方法恢复RSA因子<\/li>
<\/ol>
关键代码<\/h3>
def<\/span> CMfactor<\/span>(D, N, verb=<\/span>1<\/span>, ctries=<\/span>10<\/span>, utries=<\/span>10<\/span>):
<\/span><\/span>    Hx =<\/span> hilbert_class_polynomial(-<\/span>D)
<\/span><\/span>    ZN =<\/span> Integers(N)
<\/span><\/span>    R.<<\/span>x><\/span> =<\/span> PolynomialRing(ZN)
<\/span><\/span>    HxR =<\/span> R(Hx)
<\/span><\/span>    Q.<<\/span>j><\/span> =<\/span> QuotientRing(R, R.<\/span>ideal(HxR))
<\/span><\/span>    
<\/span><\/span>    # 构造椭圆曲线并寻找因子<\/span>
<\/span><\/span>    # ...详细实现见完整代码<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

复数乘法在密码学中的应用<\/li>
Hilbert类多项式的数学性质<\/li>
椭圆曲线在因子分解中的特殊用途<\/li>
<\/ul>
9. 小蓝鲨的密码箱（密码映射）<\/h2>
题目背景<\/h3>
黑盒密码系统，需要通过构建映射表进行密码分析。<\/p>
解题思路<\/h3>

识别密码系统的输入输出特性<\/li>
构建明密文映射关系<\/li>
利用映射表解密目标密文<\/li>
<\/ol>
解密代码<\/h3>
def<\/span> build_mapping<\/span>(plain_chars, cipher_ints):
<\/span><\/span>    mapping =<\/span> {}
<\/span><\/span>    for<\/span> ch, val in<\/span> zip(plain_chars, cipher_ints):
<\/span><\/span>        mapping[val] =<\/span> ch
<\/span><\/span>    return<\/span> mapping
<\/span><\/span>
<\/span><\/span># 应用映射表解密<\/span>
<\/span><\/span>plain =<\/span> "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890<\/span>{}<\/span>!@#$%^&*()_+-=`,.\/<>?;':<\/span>\"<\/span>[]<\/span>\\<\/span>|"<\/span>
<\/span><\/span>cipher_vals =<\/span> [int(h, 16<\/span>) for<\/span> h in<\/span> cipher_hex.<\/span>split()]
<\/span><\/span>flag_vals =<\/span> [int(h, 16<\/span>) for<\/span> h in<\/span> flag_hex.<\/span>split()]
<\/span><\/span>
<\/span><\/span>mapping =<\/span> build_mapping(plain, cipher_vals)
<\/span><\/span>flag_chars =<\/span> [mapping[val] for<\/span> val in<\/span> flag_vals]
<\/span><\/span>print(""<\/span>.<\/span>join(flag_chars))  # ISCTF{1ac04b37-3652-42e7-95dd-1d3b18a1b5f0}<\/span>
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

黑盒密码分析的基本方法<\/li>
映射表在密码分析中的应用<\/li>
密码系统的输入输出特性分析<\/li>
<\/ul>
10. 小蓝鲨的费马谜题（RSA因子分解）<\/h2>
题目背景<\/h3>
基于费马定理的RSA变种，需要利用提示信息进行因子分解。<\/p>
解题思路<\/h3>

从提示信息中提取数学关系<\/li>
使用GCD方法寻找公因子<\/li>
恢复RSA私钥进行解密<\/li>
<\/ol>
解密代码<\/h3>
from<\/span> math import<\/span> gcd
<\/span><\/span>import<\/span> re
<\/span><\/span>
<\/span><\/span>def<\/span> find_factor_from_hints<\/span>(hints, n):
<\/span><\/span>    for<\/span> i in<\/span> range(len(hints)):
<\/span><\/span>        for<\/span> j in<\/span> range(i+<\/span>1<\/span>, len(hints)):
<\/span><\/span>            a1, b1, s1 =<\/span> hints[i]
<\/span><\/span>            a2, b2, s2 =<\/span> hints[j]
<\/span><\/span>            g =<\/span> gcd(abs(s1-<\/span>s2), n)
<\/span><\/span>            if<\/span> g !=<\/span> 1<\/span> and<\/span> g !=<\/span> n:
<\/span><\/span>                return<\/span> g
<\/span><\/span>    return<\/span> None<\/span>
<\/span><\/span>
<\/span><\/span># 应用求解<\/span>
<\/span><\/span>hints =<\/span> [(a1, b1, s1), (a2, b2, s2), ...<\/span>]  # 从题目提取<\/span>
<\/span><\/span>p =<\/span> find_factor_from_hints(hints, n)
<\/span><\/span>q =<\/span> n \/\/<\/span> p
<\/span><\/span>d =<\/span> pow(e, -<\/span>1<\/span>, (p-<\/span>1<\/span>)*<\/span>(q-<\/span>1<\/span>))
<\/span><\/span>m =<\/span> pow(c, d, n)
<\/span><\/span><\/code><\/pre>教学要点<\/h3>

费马定理在密码学中的应用<\/li>
大数分解的实用技巧<\/li>
提示信息在密码分析中的利用<\/li>
<\/ul>
11. 沉迷数学的小蓝鲨（椭圆曲线密码）<\/h2>
题目背景<\/h3>
基于椭圆曲线的离散对数问题，需要利用无效曲线攻击。<\/p>
解题思路<\/h3>

识别曲线参数与标准曲线的差异<\/li>
利用无效曲线攻击恢复私钥<\/li>
使用恢复的私钥解密flag<\/li>
<\/ol>
关键步骤<\/h3>

使用secp256k1标准参数<\/li>
在无效曲线上进行点运算<\/li>
利用特殊数学性质求解离散对数问题<\/li>
<\/ul>
教学要点<\/h3>

椭圆曲线密码的基本原理<\/li>
无效曲线攻击的技术细节<\/li>
标准密码参数的重要性<\/li>
<\/ul>
总结<\/h2>
本教学文档详细分析了2025 ISCTF Crypto方向的各个题目，涵盖了古典密码、现代密码、数学难题等多个方面。通过这些题目的解析，可以深入学习：<\/p>

密码分析的基本方法<\/strong>：代数攻击、数值分析、黑盒测试等<\/li>
数学工具的应用<\/strong>：数论、代数、数值计算等<\/li>
密码算法的安全性<\/strong>：各种密码算法的潜在漏洞和攻击方法<\/li>
解题技巧的培养<\/strong>：多角度思考、工具使用、算法优化等<\/li>
<\/ol>
这些知识对于密码学学习和CTF竞赛参赛都具有重要价值。<\/p>

2025 ISCTF Crypto方向题目解析与密码学教学文档<\/h1>

1. Ez_Caesar（变异凯撒密码）<\/h2>

题目背景<\/h3> 本题实现了一个变异的凯撒密码，加密时偏移量会动态变化。<\/p>

2. Power Tower（幂塔问题）<\/h2>

题目背景<\/h3> 涉及模运算和幂塔计算，需要利用中国剩余定理(CRT)求解。<\/p>

3. baby_equation（方程求解）<\/h2>

题目背景<\/h3> 需要通过代数变换将多元方程转化为单变量方程求解。<\/p>

4. baby_math（数学计算）<\/h2>

题目背景<\/h3> 基于三角函数的加密问题，需要利用LLL算法求解。<\/p>

5. easy_RSA（RSA加密）<\/h2>

题目背景<\/h3> 基于RSA加密的变种，需要利用数学关系进行解密。<\/p>

关键洞察<\/h3> 根据欧拉定理有：msg^(N+1) ≡ msg^(p+q) (mod N) = ct₂<\/p>

6. 小蓝鲨的LFSR系统（线性反馈移位寄存器）<\/h2>

题目背景<\/h3> 基于LFSR的流密码系统，需要从输出状态恢复初始掩码。<\/p>

7. 小蓝鲨的RSA密文（多项式RSA）<\/h2>

题目背景<\/h3> 基于多项式变种的RSA加密，需要利用数学技巧恢复密钥。<\/p>

8. 小蓝鲨的后门（CM因子分解）<\/h2>

题目背景<\/h3> 基于复数乘法(CM)方法的RSA后门，需要利用特殊数学性质分解大数。<\/p>

9. 小蓝鲨的密码箱（密码映射）<\/h2>

题目背景<\/h3> 黑盒密码系统，需要通过构建映射表进行密码分析。<\/p>

10. 小蓝鲨的费马谜题（RSA因子分解）<\/h2>

题目背景<\/h3> 基于费马定理的RSA变种，需要利用提示信息进行因子分解。<\/p>

11. 沉迷数学的小蓝鲨（椭圆曲线密码）<\/h2>

题目背景<\/h3> 基于椭圆曲线的离散对数问题，需要利用无效曲线攻击。<\/p>

题目背景<\/h3>
本题实现了一个变异的凯撒密码，加密时偏移量会动态变化。<\/p>

题目背景<\/h3>
涉及模运算和幂塔计算，需要利用中国剩余定理(CRT)求解。<\/p>

题目背景<\/h3>
需要通过代数变换将多元方程转化为单变量方程求解。<\/p>

题目背景<\/h3>
基于三角函数的加密问题，需要利用LLL算法求解。<\/p>

题目背景<\/h3>
基于RSA加密的变种，需要利用数学关系进行解密。<\/p>

关键洞察<\/h3>
根据欧拉定理有：msg^(N+1) ≡ msg^(p+q) (mod N) = ct₂<\/p>

题目背景<\/h3>
基于LFSR的流密码系统，需要从输出状态恢复初始掩码。<\/p>

题目背景<\/h3>
基于多项式变种的RSA加密，需要利用数学技巧恢复密钥。<\/p>

题目背景<\/h3>
基于复数乘法(CM)方法的RSA后门，需要利用特殊数学性质分解大数。<\/p>

题目背景<\/h3>
黑盒密码系统，需要通过构建映射表进行密码分析。<\/p>

题目背景<\/h3>
基于费马定理的RSA变种，需要利用提示信息进行因子分解。<\/p>

题目背景<\/h3>
基于椭圆曲线的离散对数问题，需要利用无效曲线攻击。<\/p>