decrypt.py

def str2num(s):
    return int(s.encode('hex'), 16)

def num2str(n, block=16):
    s = hex(n)[2:].strip('L')
    s = '0' * ((32-len(s)) % 32) + s
    return s.decode('hex')

P = 0x100000000000000000000000000000087
A = 0xc6a5777f4dc639d7d1a50d6521e79bfd
B = 0x2e18716441db24baf79ff92393735345
N = 76716889654539547639031458229653027958

assert N != 0
def process1(m, k):
    res = 0
    for i in bin(k)[2:]:
        res = res << 1;
        if (int(i)):
            res = res ^ m
        if (res >> 128):
            res = res ^ P
    return res

def process2(a, b):
    res = []
    res.append(process1(a[0], b[0]) ^ process1(a[1], b[2]))
    res.append(process1(a[0], b[1]) ^ process1(a[1], b[3]))
    res.append(process1(a[2], b[0]) ^ process1(a[3], b[2]))
    res.append(process1(a[2], b[1]) ^ process1(a[3], b[3]))
    return res

def nextrand(rand):
    global N, A, B
    tmp1 = [1, 0, 0, 1]
    tmp2 = [A, B, 0, 1]
    s = N
    N = process1(N, N)
    while s:
        if s % 2:
            tmp1 = process2(tmp2, tmp1)
        tmp2 = process2(tmp2, tmp2)
        s = s / 2
    return process1(rand, tmp1[0]) ^ tmp1[1]


def keygen():
    key = 88759977654662465230648243503936608956 
    while True:
        yield key
        key = nextrand(key)

def str2num(s):
    return int(s.encode('hex'), 16)

def num2str(n, block=16):
    s = hex(n)[2:].strip('L')
    s = '0' * ((32-len(s)) % 32) + s
    return s.decode('hex')

f = open('ciphertxt','r')
l = f.readline().strip().decode('hex')
blocks = [ l[16*i:16*(i+1)] for i in range(6) ]
print(blocks)
m = "One-Time Pad is used here. You won't know that the flag is flag{"
mblocks = [ m[16*i:16*(i+1)] for i in range(4) ]
print(mblocks)
keys = [ str2num(a) ^ str2num(b) for (a,b) in zip(blocks, mblocks) ]
rng = keygen()

s = ''
for c in blocks:
    k1 = rng.next()
    s += num2str(str2num(c) ^ k1)
print(s)