Verilicious

10 minutes to read

We are given the following Python source code that encrypts the flag:

from Crypto.Cipher import PKCS1_v1_5
from Crypto.Random import get_random_bytes
from Crypto.PublicKey import RSA
from Crypto.Util.number import getPrime, long_to_bytes as l2b, bytes_to_long as b2l
from random import seed, randbytes
from data import R, s

seed(s)

class Verilicious:
    def __init__(self):
        self.key = RSA.import_key(open('privkey.pem', 'rb').read())
        self.cipher = PKCS1_v1_5.new(self.key, randbytes)

    def verify(self, c):
        c = b'\x00'*(self.key.n.bit_length()//8-len(c)) + c
        return int(self.cipher.decrypt(c, sen := get_random_bytes(self.key.n.bit_length()//8)) != sen)

    def encrypt(self, m):
        return self.cipher.encrypt(m)

orac = Verilicious()

enc_flag = orac.encrypt(open('flag.txt', 'rb').read()).hex()

assert all(orac.verify(l2b(pow(r, orac.key.e, orac.key.n) * int(enc_flag, 16) % orac.key.n)) for r in R)

import os ; os.system('openssl rsa -in privkey.pem -pubout -out pubkey.pem')

with open('output.txt', 'w') as f:
    f.write(f'{enc_flag = }\n')
    f.write(f'{R = }\n')

We also have pubkey.pem:

And output.txt:

enc_flag = '34509971d6ff1775669115038c5d35e2ccb3443f9d4561dd2e4e39f079778d0a587c0781ec02239985df7e01e81c671015be5a64817741e54bc5556e0a4bc4f83d56cc0528248b4e4acf369f510d4b34e227e4b56974453833c304bdc454d3c3cf14388a3ffb7b2bc7726a13e12f1467c3c6398f550a3d1a0b9f71ed0e47d0a1'
R = [29216441245427424481971344788726286335420340149505338985909302115308114045090311930815627937429612119249657796350684387969399917217073610650936284862730207361701320583356315807444874503640512345109019070190404302172475026268410372756668047675193225426769322002379944992189484317124217979307512309691333226518, 100829215664543795715395572218313432245812473255734662883324610034304445644595279045923470347244381233324999264869493015920355457156049680342128164161447231197224476512595047214543463800878302564835310173364554485876739610606754950181113531170026724846030312169825483296239840016036085698004427705965224177430, 82543044469400605438977850019317708672159713819368638150157185454815486333301855785346686108229286419286291525168655431792702574229206707894430492184589592298674103960212089548306377077876764576867025623510707058410256833061177005871840718101184302167438230771675340479815847192642456585824734315386484520305, 74359505026762363917722773885865704859131494996501984243251228052262429828712081886984533540274480417509785645448000061013068083692044344184332722054025864030951269855651349964376495773884751267722951574766620046020684648616065458109572071021709525282950202622489427725550028900429822068394876056019061457199, 39719091275715526942101662930153331942267812952619584364365811915297533209170510310102433991595883856371909401715749228386475391773872010750529989628610837079975486005043664146880021001409169498058398491983493947277521877636066554677657116338029016760372162840791492148898429298910437039756882166397202330795, 53108616857266683659163997510660993049925508417027015971846832607715984412786674505463857224465198010774831269865187913648401917418585573337702599901690695470467034236013036255187882350081294060010216953283565420843953810047561514816647526653599907916469418168107966207573791942514214313203289414376074845799, 34121393228863004093921531526746031082974958039825460706737821797730889866287771464899555602959831753538110486325257751977775428266320343364291375806083509768934116298137274084440698602973973694719970091965045155537388917443060975349349297838325370683364242104599914295317232047750604546079252618440375615848, 60078071810524797221259947251546002607701421770282452366823313148233481861428345845648980775989738145841987837469722243125605498306306758419993851610409969604333699640429667249434199439164743503735817151888565162888124543611637056628648133447541017410016599512748582800810179795614545694724720108186809003455, 93806970398327441583656855137804471280291845140503586233855304173592366515137487969225612854936559913757495192724716049966523071053888761437408823500205633382652247842038109610197089184426733709870332033211439669207462424137128839973944913265714236381337658523534738273450209365821674699394342196138082842393, 99274612516319612398818248638267481319292693881273782560618885890857381109827882473207170664961177959030029517357780669033146596101703429617881744593565658527222023458559063181115834265836875285755777872687308578783315748990367626281050914379442669292621367466661568237912461192829636978099107143804408560671, 67734052170717346535252602815157960962747182275149185163521893482893042421415588395290296297576283366762592485679480036337172464056564434220724079120171529620100155861689943208802887522222363061127891568142947940085428343781181801743538702130977716949328630625910580359093818721696198530636524705315597929507, 63896521923231617632868444492462903866723245496656501871769070512704772558131951699585518792117557067253911394681928588596100446252055575804858219596266804567268896703264360268213970891070948982904208093668300418839180966459860938189560319722949446860665995575248627019134982382648743265228867666819474593506, 1094328986957659223907541248634357153148186933710178481991151113042935880434961193532949817191644444715391159693840923443174369407261321568054569421444921553199821423090570198340440670103554040124796003075784866813458099283395166956087739880559637119318787131024848453769323808782002720540802588951968564851, 42491463769325437385501375661305716838840158701437183883621492068550539191758350757958865143652892806615203602450706350605126128453871511041949749149193882323491752548740031549099228131595219903329555659937076528422239890526557948398160254516833160617657363428259396044051620021820656496581033650249964362011, 76787294013254739236953487516301962642414613801939069020374005221456574571441008959385511016079617256768352581913680863956395918582849620043666988244901498616779659179854097591423056105752609987843039406067471360048327399796014933961131227656426245399147741388899069332173511542026799223629200659781507779673, 95957026943959136581176963234906561284339812275535179997920480949813356921523384568986617079870231177894805277667465530913305054450765840529330092222500648840966370009830519431967885394660445854985274790390874293662856082184854145634747089490469902304715140817195827833913056151870447138353259985297588480652, 13016937222585948100924028175360287405709420344716661998586835356418863072066281784840232732580905474845550004077357637759161583417982593461626588163203796426916748543624059388207298010071580149965038216139619515844556792460296476148422061680885572784707657800747806624747281556690027165249655730484564320273, 448762266735341216157188583339270493793727859998990994163681337483678677699030146062389376082319695935361913525778670655682725395491280194551750225606362331676915898520062471716513381540893500339123315867058020789047323349514196794938755309491987777558107890144356226739469732927129272898003622078523446908, 43685411876757964919027626071321020341838667385002088877392135649910115819324151992484827574367130535587668371541747463495024289896670122309000244514491991258986741426932947308406349315410573923873627024953737076881169455608974294304513933179911657853872382198041185755504190491413074390691969538576476258186, 45098090041417091797656249364527858459432923934888836153876123757227518709858933735670941325627242441320405255743840699418656719103020284121269603434662939672463499004518984931968593683134423887244335380049104288673653959295257854889398388931961688114356791664903680678089132942149650783927439309504861316364, 107149629704447337104750268116346367397262898556415844458284295174634113578706840300095610049254597167345946129754641892398436506123654573055782404847136108260080096074473494930443637470961517963610746661374121444415989615715796925379462506508689909146173060796864453366802119031732090942691629307605374100099, 20510144809063873244394096398804658281415108240373397483330803042481220529436930025541209060532363156685874431413532015480805659796291608986910377594938741671940536466492285755205887927945883905427844275967777439734924435961459656358640097714368560577157901435461578455070652220062021162469905693446042732721, 46026202356577949638272275338952919092967400493709458373183428812237994917510085948698685630468296321469796776231841850623738598029023755744644932962796425886076917160108377204122654516160440379486553360339469310835296475225308233613750722019833693174564212071803236551713991821382099743468366885315621760986, 48204502600394914524324030938461422626021543893770480074672134004079903407545919061263933478502103669204774086693340090558082834622656701587571796292185916465036417818239171857870080913949204758514563766685560966313740529891041855108362991287703167303156207874631865244359374107567010487161891394581031884272, 103389585078899194873019635836731064918123151262852112886543560632352938695335717376472440165085052088118466785320258948263841091307562382607774807587920675006979543642691635636877333710226380816627866910870052331846852444489104466285035324077484657632104969705132349001004402228325803511109494309238582019431, 39782829427496314725602789209349376878982507373065234016396637199352088189366767856010491211744066768491094645016690448288086133621311561525886964502521914283604632775831234012495265660977871334025091554126237504742179788687946745923783915476656947637003023027307224156537757730285261687005850756349761236243, 78277005968088512959529504080921929150013503851737210619164185953564901363763754986732286163507117519519324662884069100851829996162043659173039362104922113937923066868969782814653008179934486975059965884506199861916969716556638911631110489920209125415374348765054550583017024730565700857656465743012622267722, 112526357692861938799022264201815881680927462902892447499319020443538119044955817823753355944927489818771158571260553755899814127576107739956866306363722699728096838282549372546871471969789564930513411003515815652909610646520081729901173249921573126505757699211454801932760138508354877963303332200902622802288, 29131774409540192088010920087799275324264549627402838338251617693238355414959796123111941691745175714444745487477081222662321197019217296766625789931370116400248926298970058520930627900568193559754612002105355318682286029238297203442578790848398100745595247858236754909688864538484320599910503071592417317818, 38639996058951354151140633310171140268593974349226001606219003069119972504354088331177642647853518211808072694971199910520855195937522078304307594128245108890956928356391608355798284744650989405656681176694053756674698793718447730977976148186711840640640813562713922382287143171332293288834086758622475734275, 69556617355392001543225523529443307561734881275830725014999222867881635403692259165592644599183371757726032140286414285310100709317280365615173009520683051871503683735739820519806615254074139007148801070217406730293088331207798060493154314151653359323146290064492148711133528513544005131393006623806382502113, 88230027798247375887228754424655976082967930243666591092258343753995086373761729171886681788541100935160931649640969189399427374686963599251579464289784409326593389106048417974766011410957816938800731956266039199893071549695572181956213655627252661384533618600446765402722643389022104141928234989552414597603, 49156277756409557446562734462764170475733339694195096841182680774716932583997976425472243720058236492301186518369121768790197470080746450635497075311123827381154604670923157554818895939932268826047600667091963020043415902141552790184282809222858527733877584419312839095027701178978292869874744571771246738404, 107471905132782407254735114767873449612364198040168614009285340551969660566640713928829175505712223857032705237946460498562397218717091072869860564936092320877001158854481814871672269228962755595609623740230258042709808063350874004076688928708232164920222837639427405588678066233609251749696496393265756854906, 86039000349525680484386657655171783317486276077093715062608332689917914894865747169044384308328947915331451076859181491082331789424937445874614069964773611474392745211794203523346723360072526352307949606412103985213532352912776422427829330616265545402753854014075811157346526072774334474377823927915963311222, 88750044578965152776475171668392442790812927180796652997894476946212339009710434841855898385790733874950442812670177285470347683971679803915717681660744545780371284013053601267686408285881875539813688864096298745379716067350414298121005298381069256225428981447972723790608221160148150052247341798198843952071, 41863747630235270503211914504301844142440706539693388711509994167040231905398012236755121799563038224289305926454238172455733948567995458695824224886015168944567287251678944964368815204177860601118388423910315155619277868100637178128971573666047796350078050963450090336872311345016703776070320259936678192770, 97801913587380269539471896159546497695295222041469731779674110363405224178518828016030113753047198899062295814472146145087737622838178737102340040386196925142917747749269141323167487497659645341378012048363738896356475414854355203240185835401532095613970830395324655842742375826844926352871715980046792331017, 42340071790830872841024150468683965733477022871431564908159913711842432430851268975210510586670366976707095166510313794896831319578529341868381590863132159598238305280224871466581183313930899165643786533771253202116094735655268454008522739326822313040049499785523885991264668097260719453026574872969355379921, 2463125119049075884441468998754263837557093123513500101337179311108167466173340334348269547573633314848854343405859906572896773199841815474211487906325437401723685286697983252893749062550389221413038767103825250598842719884876345636361770751387356662456270220828768590684867455041785214269005489263827190574, 66952822623627109905733007838340299496002389390772199825111153182941132380563049698861391903818213471784194497241574803778333134276861406982581718377068224305356838968913653298548334074838604793451538943992061692956527616941078574845285775120417481243637918077797606947574967531301935221352971988519255905968, 112097003885012333804224740839774554810781737636398288419504132936162204927252622732601133190026575252423225585843961555251483766607453112035218957294939943356523213767144431081972502517071481397040764586356341074818391165406153531844102950083829295593683521914596989403684924947479143584678487530325904045921, 7490810243128323505917051619650717384351132258471032840335974875796423021001660229843049814860993281118188341038224667123040972237277028706105054714407369278135646991223226261806684145863708899831665546347110408145698693544959797641688875379482044060118168394640385054449565484141905108917669154853333167524, 15939375490829466880466493076449340670942143856423406817429148106082474442654542907023459466943113941834345268093400017593858314111558368346876961579776550714629039045401802796616304009790616016829798879232409981155555216889578952953300902842355210103239211192429132359669197208489437804351657286725528034938, 108710771218538250091213176669438543035634559416617466071819961315352805500554030587474152725280944533915566549538424375693481674048959062131807961164114219160140741937199484656692896371291694891908783229107923511663521986843211338228441163932015107316359669060469101804485384398211238630878169060035457919437, 57083786828481677138613374614100610060465801609933761641568027259300869417938355838029199523146593807219854041124357510293854043770589574066304157682672103797065246958641260056237952314495807812680929788654624990406904621412417384500332402344703264304310543145522369551274242779863769589101809241595439600599, 21452341980179535466634326875492501630737958464095492132364087705336759200868062160856176707529940956686628733692841047391860306066389067265107817641580641081306951025555804060880977591406054280421718578266087567032091281105784544093974747558197348820781216335234252741389251708176883031597873317416803267413, 62623320797916755887276415418009945486402566017137636136347056502295668785612253936447389039553423262724352668846111962265900056277069554200684199181366441192524768134305636743639445448144958323458596354072543979375869377958983482509890945637408129090798777568831941061398341452859472254557254624147823530981, 77719586817605386619266324478930296292349468130006927689922696070061586276103744718946924069294425987016821755203495334451896053369869095374619539295495086877088823716939226838829063577947983162407982546239088686326363736806352481745777226470809590103015208115760022134336623111159503617938480847878235142330, 78944364950149134216540929123485282498906245432898915462775547385261086332281568329940150474298619641860724359048842334617572816016561981635895029412040442495252690352160927676733814355995807729841892030506119862836093395284164571797822711193502171971116836623912512174012592928691291843455301536102290759394, 52004297011590452195962446480817400999726895182394837753153927461175524815746074535130348573843129273153558324641265495648304027529533143658511539104377139310215112933078006004149576478728876027498481809967692349297958889476573472533648155563606409546613448097567494434971313208827236747907768742788655503076, 69880628640619341528684889484734426063365026721708033965147129660837233501644357794941793595985963402850736568906508757078105711634348337795887201040863067637804667155488647107049027023703898464480319894510169752209076232644578801485861824501149606362578917339444538510839028396898783374226833234552178690619, 59948468195120631824705364151148026995994839921110673687319258467339019893973391311957969079884617876956651137013144206447067856660686074814371022693224616874830758622392397627996165472419135022184105139464411090994469975414821300003837031492583812549241003030236637055129120044036584203022405696381435329738, 10853484360728396391667387666209917655860821664747532251192526399063334124002312209289318362664175483020765977175249776295560985728228931081681338164334042421948539999860457091893764596664361878682100126891960117142076603691670435071073747767216780978531739646820197542324131674258526770969732533162171648160, 483736827523374132796902774367184788781696287982518545387314821997461512508657456890045631993763013832428779903549799129558728300359435040457386071477949343468017626644786798234117488174356345004136369432751929543373378703521137910997408306783877415249569196399721588127475568059291069145437719821115828330, 49761011311628572308228535605302711135365125274107641778930412309744209921332990323857832719182990953133051057077650335169013359664330685816638499239267884228267036411500182732299452534320630679738634378954920954795229429410690133123473994736241190661884582654446812119542458970289939485235306135884353125743, 6951809635254438595769406827675294272543591801867254667480170960327653797865863522037617722814316125925131580390808584409304395540259714679680273525093377331243975298553743652212067511130116854546691513988994939266358400041317662795076389080259776265213768536835704361926251421202757213418326543755330579962, 107161675700924405661442188517856401123138161912450914189809513979835577168383195003545145646441455486425200529085846170209769614445352667374999809513133536587208057208230363099316353685023873551276250394485837993524596318473289904844269523857526766251040600616225304493610338818266574145990619838890903934130, 21154991842131859308791236502521238534834657641541423691364671913815370641109171893380148695564366702865609749910610363069990529554269098656926326719320382742090437312570888044518352779029013089471162276199407004649661643875852629045374071881858613987682414516213023138749119723435361783759806960973092078474, 31176816235768311310703695891904840566432595846774691524567936080417481633854643943097544798147757175587327169251529937690138623447179091124625786202277968282659675979560520880537481847687366984986324885792863756310989866078182563202868232746140784057130707742735902137860551563637941510530002566766576310397, 95527943039033846968616520977806208853767465323198143154416192315745546056761517507489401936824848220062934219666512526633762627944842359904466985358982351854231880697652555713167150120416979637994869777062476686740214709980693777504853982585874373263097161595908248571785134242032989716830187929558308738917, 113364185181190726107385473056130496465923816096929716758161068443286356423420561072600906734855928644849493537737487411791191250626270741161616905764987846082225090939301485772822397844054387369111968374271975075487269688854454829413415759524404492671449030790676131159340372503222891573450223355559378179063, 99699632608464168335848622604988970549773777624401370579812976192545887323253154669833450362851818200868773794765128048682770063875020304815004194938985976572240718342779681223773632618334304232033299022035340159559760302890832193085345835431684096932684234259043898982624880624092282919055419069946881576373, 105728303334661183139718378746694521338154563591375027962131561728120398324535683227677750386029036348861394515558294830644097093463538029977232605330861874662947846685473994693150698303611407461243545835866185540495627648843610654227848855797360704679754939227594004567937658267260699540061002336611196013144, 108854167307832160400105043558479726638752974545342819968170310393578671679630009604668721809519695970786787999531042752779747027250004714499944972722689280485125409214926880464227986888971060252900338772436541394564385007938157249973164312519535806765191984288436775659330995757484854813718635707350563671645, 97115834489693200991685912723727238368218090820137521386833376236179494720233183433544536655181436916370367527214096636270236742870102912839958979198651709765432686536701608456161335801683063564803925014000462123838290115971690912072836827900454245778073057835914353477567166472487806166089615467357525056813, 49573173321840497044966348870270727877604904940877630326432314340316181615915357519058566977786920879661187197517913151402671898711575290031556122023356634829464029858060822947518731951119755955090202901735572460497808690730910292035030125498012096617143785815698745720991907032653111549997781081926007982869, 89725478804315538023654053151598874416168361378551021178651122733607376046222787115104389561332989216835971215732298113658650786007957698224240333242238997986299379561593006547561853861296997053046398396604589744938053419687183704564915246682583080163587113823408157623303811901513345786632556249841333149842, 8555700992347112056299577636316393912010272286338596019119388177017108793946239436138721219996724818357072878603725426939139310108935581073073092662302551671870195406597567088617378137688720299147234362624328909830562973498028218068965508615609085778272370756711456430850023763432473791427439043463459626620, 5123975877029135019621248482768624851568097384604803047031758770486461424074057765732461751354099577403843840094264222104956254095568801036878246534604383037595093471886749092190610792131862086241757706336051160374022954788387318791261229691298577027371174478149371943451364096800293305473208379507515193042, 18068709476608195660928001882780018998265775634320476941403272503763605086710933375457427204057974498946600364936943144306440375524570070932355067455386719841374812107516906403913722622305756080894401705492033951081662980391422200656864369115583916297436695469758983610493307068343478155624772351446554016068, 77303460227064073514480688453886253270093030692777196755061547023050121509625173457015323069565050739787453231303833782099933595800070117320705337546851399838704209776425689563162948132440442571345082579085952202739740584305745409257693469642147028893055077254397047602415198706100206785585876920988404583289, 29392213640908958292346516239206678806196865761774606136072844903424415703969999578711027220017433330530104937261463716070372396129257270996848128757257294689299988378422676781420594033562449781354801957191335283536050393681685270754383111335703947728592655374500346499564937496363693499916830384554350409885, 58989214510930361685555838416420786103507672704307184682999577662387283846380954845774472408231939712077281927373827572374884310874156565655566021343024302222597058958438795836789413261842049668168883439756417368136917179828883843129137708440968249357621843042937825817971325603767316621873582602222751397274, 10381447756060258624929555617668510490309866597805046571363581696827863772231712137389123587131437833449633676771854171315390020628097671678809319850585813600014360862038227737838089159844628317585489877324985039092199140285203756211178771788927103987011527797614708928556169438435486693389472820129258007461, 80207270160880102920562513221006431170210455990917077647214459831648103497007246218461181206794492544397170717348808523639829861824867957784806188363740393175856078780114422367799140386945031355026165831513100839458336523425236897971494431094997188761962943976591966858434999647180131793010233542329814809998, 23587812803272430181933893655435501051655166900461244233073737706370037967061413152025243351554428817559361941835158472651860362106073900448894906307344858993972291130839541386355991332723454569918451537581249963072253434588620744438790687335633983410147969191029715084618188026205631143020888221723930000675, 61450929032491087759343182649129210944563743124269026348747500598813581358451630820078684152036750130507624261612839341816356022978333550693310344013587579106244550891160869862268322273611055856651135326929517053409263081985701221414937593461377237813075356339288588185411608274458934580072495732350153783560]

Source code analysis

The challenge’s code is pretty short. In brief, it defines a class Verilicious that imports an RSA key from privkey.pem which we do not have and uses PKCS #1 v1.5 as a cryptographic scheme:

class Verilicious:
    def __init__(self):
        self.key = RSA.import_key(open('privkey.pem', 'rb').read())
        self.cipher = PKCS1_v1_5.new(self.key, randbytes)

    def verify(self, c):
        c = b'\x00'*(self.key.n.bit_length()//8-len(c)) + c
        return int(self.cipher.decrypt(c, sen := get_random_bytes(self.key.n.bit_length()//8)) != sen)

    def encrypt(self, m):
        return self.cipher.encrypt(m)

The flag is encrypted with this scheme:

orac = Verilicious()

enc_flag = orac.encrypt(open('flag.txt', 'rb').read()).hex()

And we are given additional information with this line:

assert all(orac.verify(l2b(pow(r, orac.key.e, orac.key.n) * int(enc_flag, 16) % orac.key.n)) for r in R)

The verify method tries to decrypt a given ciphertext and unpads it using the PKCS #1 v1.5 scheme. If the process fails, the decrypt method from PKCS1_v1_5 returns the sentinel value (sen), so verify will return False. Otherwise, decrypt returns the decrypted value and verify will return True.

Notice that we are given the public key, the encrypted flag and the list R:

import os ; os.system('openssl rsa -in privkey.pem -pubout -out pubkey.pem')

with open('output.txt', 'w') as f:
    f.write(f'{enc_flag = }\n')
    f.write(f'{R = }\n')

There are other values that are kept secret, such as s, used to initialize the seed in Python’s random module, but it’s not relevant for the solution:

from random import seed, randbytes
from data import R, s

seed(s)

PKCS #1 v1.5

The encryption/decryption scheme is defined in Section 7.2 of RFC 8017. Basically, the padding format is as follows:

0x00 || 0x02 || PS || 0x00 || m

Where || denotes byte concatenation, m is the plaintext message and PS is a string of random bytes to fill the whole padded message until it has the maximum possible size. For example, using RSA-1024 (128 bytes), a 30-byte plaintext message will have a PS string consisting og 128 - 3 - 30 = 95 bytes.

Bleichenbacher’s attack

The RFC mentions that this scheme is vulnerable to Bleichenbacher’s attack, which is presented in this paper. This attack takes advantage of the malleability property of RSA. Namely, let

We can get an arbitrary integer times by the plaintext by multiplying times the ciphertext prior decryption:

So, when decrypting , we will get exactly .

The attack itself requires a decryption oracle that is able to tell if a given ciphertext decrypts correctly or not. This means that given an arbitrary ciphertext , the oracle will say if the decrypted plaintext starts with 0x0002 in hexadecimal (and also contains an additional null byte, but it is not that relevant).

The idea is to increase the value of until getting one that results in a valid PKCS #1 v1.5 format, so the attackers knows that

Where , the byte-size of minus 2 bytes. In other words,

Using some techniques an optimizations (described in the paper), the attacker is able to query the oracle several times, and successfully narrow down the interval until getting a single value inside, which is the value of . Thus, this subtle nuance in PKCS #1 v1.5 results in a Padding Oracle Attack that can be exploited to decrypt a ciphertext with no access to the private key.

For more information about Bleichenbacher’s attack, and if the original paper is not enough, I recommend this video and the analogous writeup.

Solution

Going back to the challenge, the values in R are raised to the power of and multiplied by , and the assert implies that all of the modified ciphertexts decrypt and unpad correctly in PKCS #1 v1.5. Therefore, for each we have

We might want to apply Bleichenbacher’s attack here, but these values are not enough:

$ python3 -q
>>> with open('output.txt') as f:
...     exec(f.read())
... 
>>> len(R)
78
>>> sorted({r.bit_length() for r in R})
[1020, 1021, 1022, 1023, 1024]

Bleichenbacher’s attack is also called “million-message” attack because it is an adaptive chosen-ciphertext attack that needs two bytes to be exactly 0x0002, which has a low probability. Thus, the number of unsuccessful queries to the oracle is much greater than the number of successful queries.

Still, 78 valid integers such that unpads correctly are not enough to apply Bleichenbacher’s attack. Notice that all are around 1024-bit integers, and Bleichenbacher’s attack starts with small values and keeps increasing and narrowing down the set of intervals where can be found. With a starting value of 1024 bits, we have a huge interval that is unfeasible to shorten without an oracle. Therefore, we must find another approach to solve this challenge.

Lattices to the rescue

While doing research about other approaches to perform Bleichenbacher’s attack, I saw this paper. This one assumes that the attacker has limited queries to the oracles, so they start the attack in parallel and when they reach the limit, they use the intermediate values to find using a lattice approach.

Let’s translate this to our situation: we have 78 values such that for some values and . If we consider only the lower bound and get rid of the modulus, the expression is equivalent to:

If we apply this to all 78 samples, we have

However, we don’t like inequalities. We can transform the above to use equalities, but we need to update the by , each of them different:

Does it look familiar? Well, it is very similar to a Hidden Number Problem (HNP). The HNP is usually defined as:

Where is the hidden number, is bounded, and both and are known, given equations and a prime number .

Actually, we can take from each of the , and get a system of congruences that fits better with the HNP instance:

The HNP can be solved by defining a lattice that contains the solution. For instance, we can use the lattice spanned by the columns of:

Where is an upper bound for the values. Notice that the vector is in the lattice because:

Observe that are just arbitrary integer numbers, they are irrelevant because we are working . The target vector is supposed to be short, so that it can be found in the reduced lattice basis after applying LLL.

Therefore, we can define the following lattice basis matrix to solve the challenge:

After applying LLL, we will expect the following target vector to be in the reduced lattice basis: .

Implementation

I had a hard time implementing this lattice attack in SageMath. If it doesn’t work at the very beginning, then you need to adjust the lattice and do a bit of fine-tuning to make it work. Normally, this involves adding weights to relevant rows of the matrix, or helping with a small brute force.

This time, I changed the value by , which is kind of brute force, because I am helping LLL to find a shorter vector. Also, I needed to sort the values in R, which is totally weird to me and I can’t explain why. Maybe these issues have something to do with the fact that the HNP is defined modulo a prime number and here we are considering , which is not prime.

Anyways, this is the SageMath code that defines the lattice, calls LLL and finds the target vector:

n = key.n

k = -(-n.bit_length() // 8)
B = 2 ** (8 * (k - 2))

W = 3 * B - 1
H = 2 * B + B // 4

a = [H] * len(R)
t = list(sorted(R))

M = Matrix(QQ, [
    *[
        [0] * i + [n] + [0] * (len(R) - i + 1) for i in range(len(R))
    ],
    t + [W / n, 0],
    a + [0, W],
])

L = M.LLL()
row = L[-1]
assert abs(row[-1]) == W

With this, we can now take any of the values to get from one equation and hence get the flag:

for i in range(len(R) - 1):
    m = int(abs(row[i]) + a[i]) * pow(R[i], -1, n) % n
    M = m.to_bytes(128, 'big')

    if M.startswith(b'\0\x02') and b'HTB' in M:
        print(M.split(b'\0')[-1].decode())
        break

Notice that the value enc_flag is never used!

Flag

If we run the script, we will capture the flag:

$ python3 solve.py
HTB{HNP_1s_t00_str0ng_h0n3stly___4ls0_ch3ck_l4st_p4g3_0f_https://eprint.iacr.org/2023/032.pdf}

The full script can be found in here: solve.py.