ctf-crypto

CTF crypto methodology

Tool-first: use suggest_for_ctf("crypto") first, then this checklist for depth.

0. Where the libraries live

Crypto work runs out of tools and into arithmetic fast. The installer puts the Python side in a venv the server can hand to scripts:

run_script(code, venv="crypto")   # ~/.ctf-venvs/crypto

Contents: pycryptodome (from Crypto...), sympy, gmpy2, numpy, z3, fpylll (+cysignals), cypari2. Install with ./install.sh --module crypto; check with check_installed("ctf-crypto-venv").

run_script is gated behind CYBERSEC_MCP_ALLOW_SCRIPTS=1 and is off by default. If a challenge needs solver code, say so and let the user enable it and restart the server — do not route around the gate with a shell.

SageMath is not installed by default — it is packaged on Debian and Arch but not in current Ubuntu, Fedora or openSUSE, and the image is 1.4 GB. --enable-docker pulls sagemath/sagemath:latest. Reach for it only for what the venv cannot do: Coppersmith with small_roots, Groebner bases, generic curve arithmetic.

1. Identify what you have

file <input>
xxd <input> | head -50
strings <input> | head -50

• .pem, .pub → public key crypto (RSA/ECC)
• BEGIN CERTIFICATE → x509 — extract pubkey with openssl x509 -in cert -pubkey -noout
• High entropy ~7.99 bits/byte → encrypted/compressed
• Repeating block patterns → ECB
• Base64/hex prefix → decode first

2. RSA — the decision tree

Extract n, e, c:

openssl rsa -in pubkey.pem -pubin -text -noout

Then route by what n and e look like:

Symptom	Attack	Tool
Small e (3, 5), small message	Cube root attack	RsaCtfTool, python3 -c "from gmpy2 import iroot..."
n factorable on FactorDB	Factor + decrypt	RsaCtfTool --uncipher c -n n -e e
Two ciphertexts, same n, coprime e	Common modulus	RsaCtfTool --attack commonmodulus
Multiple users, small e=k, k pubkeys	Håstad broadcast	RsaCtfTool --attack hastads
Close p and q	Fermat factorization	RsaCtfTool --attack fermat
Wiener-applicable (d small)	Wiener's	RsaCtfTool --attack wiener
Partial p known	Coppersmith	sage / RsaCtfTool --attack boneh_durfee
Same m, two keys	Common plaintext	manual gcd