zrax-x

# https://github.com/ashutosh1206/Crypton/tree/master/Authenticated-Encryption/AES-GCM/Attack-Forbidden 

from Crypto.Util.number import bytes_to_long, long_to_bytes
from Crypto.Util.strxor import strxor
from hashlib import *
import itertools
from sage import *
from sage.all_cmdline import *

import socket

zrax-x

from Crypto.Util.number import isPrime, bytes_to_long, long_to_bytes
from gmpy2 import *


n = 2063976825250272595388593010902135884890103500050668819831297298752625852801511751408065791793019547189652146900555099774958963484251389843293161492169372162099883268521841628059721206917183539122495978771222844176897602295938111287844515247614001317395469781055421827261855002882782439392377329027883959379213
c = 1547619272568821977924291607912472468030540633498046405850444894565247157649485437790107315326889134051033004979821144414033498309691970259960647249579974375705070385006255462150657629039234264256644150151347889353513962706887104364057437209020689956808789043545320455581507831694598090423468743540228515368341

rp, rq = (2328957326808590967503, 1461823189315446122067)

# factor iroot(n, 4)[0] 

zrax-x

# date: 2020-8-23
# coding: utf-8
from pwn import *

rotl = lambda x, n:((x << n) & 0xffffffff) | ((x >> (32 - n)) & 0xffffffff)

def rol(bb):
    return bb ^ (rotl(bb, 2)) ^ (rotl(bb, 10)) ^ (rotl(bb, 18)) ^ (rotl(bb, 24))

box = []

zrax-x

from sage.all_cmdline import * 

def pad(x):
    pad_length = 8 - len(x)
    return '0'*pad_length+x

N = 100

rr = '01001100111011110111110110101001110010100101000011111101101111010111100111110100100101110111001101110110011000010100100111011010001101100000111110111100000101000010010000110010110110110110011111101011'

zrax-x

from sage.all_cmdline import * 

class Hash():

    def __init__(self):
        self.h = 144066263297769815596495629667062367629
        self.g = (1 << 88) + 315
        self.mask = 0xffffffffffffffffffffffffffffffff
    
    def encode(self,message):

zrax-x

from Crypto.Util.number import long_to_bytes, bytes_to_long, inverse
from hashlib import sha512

p = 12039102490128509125925019010000012423515617235219127649182470182570195018265927223
g = 10729072579307052184848302322451332192456229619044181105063011741516558110216720725
q = 1039300813886545966418005631983853921163721828798787466771912919828750891
phi = p - 1
r1 = 31245182471
M1 = 'Hi! I am Vadim Davydov from ITMO University'

zrax-x

from Crypto.Util.number import GCD, long_to_bytes
from hashlib import sha1
from tqdm import *

n = 26318358382258215770827770763384603359524444566146134039272065206657135513496897321983920652242182112479484135343436206815722605756557098241887233837248519031879444740922789351356138322947108346833956405647578838873425658405513192437479359531790697924285889505666769580176431360506227506064132034621123828090480606055877425480739950809109048177976884825589023444901953529913585288143291544181183810227553891973915960951526154469344587083295640034876874318610991153058462811369615555470571469517472865469502025030548451296909857667669963720366290084062470583318590585472209798523021029182199921435625983186101089395997
m = 262754933207060261441969663988861968338151704138077058052877634130131009628317037746403327655038380874349048356579882760646603044278029616091859979646654408674169007111285178592675046576271605987002486897380452431421114891796733758193087795352472146606942116987994610443543522009503093923218610219209682

zrax-x

from gmpy2 import *

h= mpz(h)
A= mpz(A)
B= mpz(B)
p= mpz(p)
q= mpz(q)
c1= mpz(c1)
c2= mpz(c2)

zrax-x

from sage.all_cmdline import *
from gmpy2 import iroot, invert, is_prime
from Crypto.Util.number import long_to_bytes
from random import shuffle

s = pow(2, 790-256)

primes = [6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503118559, 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503126443, 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503193349, 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503562289, 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503734189, 6703903964971298549787012499102923063739682910296196688861780721860

zrax-x

# author: badmonkey

from Crypto.Util.number import *


x1 = 123702839015756050884261730350882737708358949223717439499184803586403380580917033774031115610745320766887583414238651786366942713037837183155670218651008201659397071753885966029204756119524199815830117337679903000409946531282131341544499373725768763177481236458288527526859422459135345981831473247316555618560
x2 = 53924539754438007029501782029367518619266978487508630921932520518338714507664032847344261722536853774745396939590212348751300654791168048424611586167435934594214127893014772880318410947388412139484910911558913354881832668949036424760411326983813389804113790149675585445672972740198653398937213550096612898644
x3 = 63167700157587157707659591399396856546372104423703909698033441469110658576803656359757694321232303912965997844863919208184964899691086676221424510238937996039639020372184420079106454203010811220417415790732729673830907444478937628707872186593129029778616120328244635824580198884662150104071084993653737914022
x4 = 60900060027375388502