numberri

2026 OICC Qualifiers - Baby Shark

2026-02-04T00:00:00+10:00

It’s been a while since I’ve written on this blog! Since I last posted, I’ve gotten better at crypto challenges, and was able to solve one for the Team Oceania Qualifiers this year.

The Challenge

from fastecdsa import curve, ecdsa, keys
import ast, os

FLAG = os.getenv('FLAG', 'oiccflag{?????????????????????????????????????}')

p = (3<<256) - (3<<128) + 1
EC = curve.Curve("BabyShark258", p, 0, 22, p, 3, 7)
priv, pub = keys.gen_keypair(EC)

msgs = ['Baby shark', 'Doo doo doo doo doo doo']
for msg in msgs:
    print(f'{msg}: {ecdsa.sign(msg, priv, EC)}')
sig = ast.literal_eval(input('Combined signature: '))
print(all(ecdsa.verify(sig, msg, pub, EC) for msg in msgs) and FLAG)

First thing I notice - we aren’t given the public key, but with either one of the signatures, it’s possible to recover. I used some of the code from the recover_public_keys function in the python ecdsa library, modified to work with the custom curve.

from ecdsa import numbertheory
from hashlib import sha256

def msg_bytes(msg) -> bytes:
    if isinstance(msg, bytes):
        return msg
    elif isinstance(msg, str):
        return msg.encode()
    elif isinstance(msg, bytearray):
        return bytes(msg)

def recover_pubkey(r, s, msg):
    x = r
    e = int(sha256(msg_bytes(msg)).hexdigest(), 16)

    alpha = (pow(x, 3, p) + (a * x) + b) % p
    beta = numbertheory.square_root_mod_prime(alpha, p)
    y = beta if beta % 2 == 0 else p - beta

    # Compute the public key
    R1 = E(x, y)
    Q1 = pow(r, -1, n) * (s * R1 + (-e % n) * G)
    Pk1 = Q1

    # And the second solution
    R2 = E(x, -y)
    Q2 = pow(r, -1, n) * (s * R2 + (-e % n) * G)
    Pk2 = Q2

    return [Pk1, Pk2]

For both signatures, one of the valid public keys was shared, and that is the public key we need.

Second thing to notice - this curve is anomolous! This means that the order of the generator point is the same as the curve order, and it is possible to use Smart’s Attack. This means that the points on the elliptic curve can be “lifted” to a curve defined over p-adic numbers, and you can then recover the private key. This github page has a good example of the attack, which I used.

def lift(P, E, p):
    # lift point P from old curve to a new curve
    Px, Py = map(ZZ, P.xy())
    for point in E.lift_x(Px, all=True):
         # take the matching one of the 2 points corresponding to this x on the p-adic curve
        _, y = map(ZZ, point.xy())
        if y % p == Py:
            return point

P = pubkey
E_adic = EllipticCurve(Qp(p), [a+p*13, b+p*37])
newG = p * lift(G, E_adic, p)
P = p * lift(P, E_adic, p)

# Calculate discrete log
Gx, Gy = newG.xy()
Px, Py = P.xy()
d = int(GF(p)((Px / Py) / (Gx / Gy)))
assert pubkey == d * G

After getting the private key, the last challenge is making a signature using a chosen value $k$ - instead of a random one - where $(r, s)$ is the same for the hashes of both messages, denoted $z_1$ and $z_2$.

As $k=z+r\cdot d$, when using $k_2=k_1^{-1}$, it is possible to force the same value of $r$ by solving for $r$ when $\frac{k_1}{k_2} = \frac{z_1 + r\cdot d}{z_2 + r\cdot d}$. After re-arranging, you find $k_1$ (and $k_2$, as it is the inverse of $k_1$) by lifting $r$ to the p-adic curve - finding $k_1$ the same way as the private key. With this crafted value of $k$, you can calculate $s$ as normal, and it will a valid signature for both $z_1$ and $z_2$.

msgs = ["Baby shark", "Doo doo doo doo doo doo"]

z1 = int(sha256(msg_bytes(msgs[0])).hexdigest(), 16)
z2 = int(sha256(msg_bytes(msgs[1])).hexdigest(), 16)

r = -(z1 + z2) * pow(2 * d, -1, p) % p
R = E.lift_x(r)
Rx, Ry = (p * lift(R, E_adic, p)).xy()
k1 = ZZ(-(Rx / Ry) / -(Gx / Gy)) % p

r1 = (k1 * G).xy()[0] % p
s = pow(k1, -1, p) * (z1 + r1 * d) % p

print("(" + str(r1) + ", " + str(s) + ")")

As the signature is valid for both messages, submitting the signature to the server will result in a flag :)

The full code can be found on this gist.

CrikeyCon 2025 - I CHOOSE YOU

2025-03-24T00:00:00+10:00

Category: Crypto
Points: 100
Solves: 3

Prove you are timk:

I’ve chosen a Pokemon and encrypted it using timk’s public key.

To prove you are timk, use your private key to decrypt the ciphertext which will tell you the Pokemon to select.

I know timk has lots of keypairs so I’ve supplied the public key for him to know which private key to use.

To ensure things stay safe, I’ll rotate the Pokemon and key every 5 minutes.

Don’t bother trying to guess as I will block you for 30 seconds on an incorrect attempt!

The go plan - and where I mess things up

Upon inspecting the website, this comment is also revealed:

Pretty solid… of an attack strategy :)

The TL;DR of what needs to be done is:

Take the public key provided and the list of all 808 Pokemon.
Pad the Pokemon with leading null bytes, and then encrypt that string with the public key provided.
Compare this ciphertext with the encrypted Pokemon provided. If you find a match, then you have the Pokemon!

Pretty easy! First problem I run into… parsing the .pem key to an RSA public key. I opt to pass this to openssl:

def pad_with_null_bytes(pokemon):
    max_data_size = 244 # This was first done by trial and error...
    # I found out there was a reason why this was 244 and not 256 later, which was why my code was failing. :P
    padding_length = max_data_size - len(pokemon)
    padded = b"\x00" * padding_length + pokemon
    return padded

with open('character.enc', 'rb') as file:
    encrypted_solution = file.read().strip()

pokemon = open("pokemon_list.txt", "r")

for p in pokemon:
    p = pad_with_null_bytes(p.strip())
    with open('current.txt', 'w') as current:
        current.write(p)
    
    os.system('cat current.txt | openssl pkeyutl -encrypt -pubin -inkey public.pem > text.enc')
    # This was a lot messier and had full paths, but I'm shortening it for privacy and to make it easier to read

    with open('text.enc', 'rb') as c:
        pokemon_encrypted = c.read()

    if pokemon_encrypted == encrypted_solution:
        print(p)

Great! Code to encrypt Pokemon done! And yet… I wasn’t getting any matches.

A bit of hindsight, and more mistakes

I think that a common theme of write-ups on this blog so far has been “I spend too long barking up the wrong tree, and I should have figured out what was going on earlier”.

What was actually happening was I was double-padding the text! Most libraries that encrypt things using RSA public keys hope that you use sane and secure padding, which is fantastic for IRL implementations, however for this CTF challenge it wasn’t what I wanted.

This is also why I couldn’t encrypt things when the plaintext was longer than 244 bytes, instead of the 256 byte key length I expected - it’s because of PKCS#1 v1.5 padding overhead.

I unfortunately didn’t realize this, and spent more time writing incorrect code, and a LOT of time debugging it.

from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import serialization

def load_public_key(pem_path):
    with open(pem_path, "rb") as key_file:
        return serialization.load_pem_public_key(key_file.read())
    # It was good to find a library that let me load a public key in Python, but for future reference I should understand it more before using it. :)

def pad_with_null_bytes(pokemon):
    max_data_size = 244
    padding_length = max_data_size - len(pokemon)
    padded = b"\x00" * padding_length + pokemon
    return padded

def encrypt_pokemon(public_key, pokemon):
    key_size = public_key.key_size // 8  
    # Converting the RSA key size from bits to bytes.
    padded = pad_with_null_bytes(pokemon)

    encrypted = public_key.encrypt(
        padded,
        padding.PKCS1v15()
        # I definitely knew that it was double padding at this point, but I didn't know how the library worked so trying to not pad this threw errors.
        # At some point, I even had the comment of "how do I get rid of this shit"...
    )
    return encrypted

pubkey = load_public_key("public.pem")

with open('character.enc', 'rb') as file:
    encrypted_solution = file.read().strip()
pokemon = open("pokemon_list.txt", "r")

for p in pokemon:
    p = pad_with_null_bytes(p.strip())
    pokemon_encrypted = encrypt_pokemon(pubkey, p.encode())
    if pokemon_encrypted == encrypted_solution:
        print(p)

The solution, finally

Partially because I was running around the con and talking to people as well as doing the CTF, I only got the solution 10 minutes before the CTF ended.

from cryptography.hazmat.primitives import serialization

def load_public_key(pem_path):
    with open(pem_path, "rb") as key_file:
        return serialization.load_pem_public_key(key_file.read())

def encrypt_pokemon(public_key, pokemon):
    key_size = public_key.key_size // 8
    # Converting the RSA key size from bits to bytes.
    encrypted = public_key.public_numbers().n.to_bytes(key_size, 'big')
    encrypted = pow(int.from_bytes(pokemon, 'big'), public_key.public_numbers().e, public_key.public_numbers().n)
    return encrypted.to_bytes(key_size, 'big')

pubkey = load_public_key("i_choose_you/public.pem")

with open('i_choose_you/character.enc', 'rb') as file:
    encrypted_solution = file.read().strip()
pokemon = open("i_choose_you/pokemon_list.txt", "r")

for p in pokemon:
    p = p.strip()
    tst = encrypt_pokemon(pubkey, p.encode())
    if tst == encrypted_solution:
        print(p)

And then…

# python3 ./final.py
Chimecho

Finally! I’m able to submit the Pokemon with 10 minutes left in the CTF.

Well done! flag{                  }

Finishing notes and self reflection

I actually wasn’t planning on taking part in this CTF, however I got a text from one of the members from my uni society asking me to join the team as they need someone who understands crypto. I know I’ve always said that crypto doesn’t like me, but it turns out that kind of half understanding crypto is a pretty high bar. We ended up coming third in the CTF as well, which is incredible!

On the flip side, I ended up meeting the crypto player of the winning team, as well. He ended up getting over half the points for his team, and he was pretty incredible…. I may have gotten a bit of a case of impostor syndrome after the CTF. I think that this is definitely going to encourage me to work harder on training for CTFs in the future, although this motivation may be killed by university work in the near future.

(also, you should check this guy out. he’s pretty cool.)

Overall, I think that what I need to get better at is being able to script well, and knowing the libraries and ins and outs of the tools I use for CTFs. Unfortunately this is something where the solution is “just play more”, but I think that’s life.

ACECTF 1.0 - Harder Disk

2025-03-03T00:00:00+10:00

Alternative tiltle for this one: How noob ways of thinking can shoot you in the back

One of the first things I learnt when I started learning to hack was linux. It was fun until I hit a ceiling of understanding about the differences in Operating Systems, what’s a Shell, Kernel, etc.

But once I got better I started developing a liking towards the terminal and how the Linux operating system is better than say Windows, or worse in some cases. How none of them is superior, nor the other inferior. We shall find out with this challenge.

Be careful, a lot of fake galfs around.

For the challenge you were given an unmarked file named challenge. Upon running file challenge, you see that it is a Windows file system.

I change the file to challenge.iso and I mount it. Naively, I try to strings and grep for the flag:

for i in *; do strings "$i" | grep -e ACECTF; done

With this I am rewarded with…

ACECTF{50_much_f0r_50_l177l3}
ACECTF{50_much_f0r_50_l177l3}
ACECTF{50_much_f0r_50_l177l3}
ACECTF{50_much_f0r_50_l177l3}
ACECTF{50_much_f0r_50_l177l3}
ACECTF{50_much_f0r_50_l177l3}
ACECTF{What are you looking at?}
ACECTF{What are you looking at?}
ACECTF{What are you looking at?}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}
ACECTF{4ll_7h47_ju57_70_g37_f4k3_64lf}

…And so on. Overall, 1830 lines of fake “galf”s and no real flag. Clearly, I need a different approach - and I hopefully have learned my lesson that if I get a bunch of fake flags while using grep, I probably have the wrong approach.

A new approach, and a bit of hindsight

If you have ever worked with NTFS before, you may have heard of Alternate Data Streams - ADS - on Windows. The TLDR of it is that more than one data stream can be associated with one file, with the format filename.extention:streamname. This can hold metadata, malware, or… flags.

On Linux, you can use testdisk to look at these alternate data streams. On selecting the mounted disk image, selecting Advanced, and then List, I can look at what files are on the disk - and what data streams exist on the files. Lo and behold…

The file 666c61672e747874.jpg has a flag and key! The data stream 666c61672e747874.jpg:Flag has the string CTCHHW{7t3_h1hw3p3sq3_s37i33r_a0l_4li_a3}, and 666c61672e747874.jpg:Key has the string cryforme. After this, it’s a simple Vigenère decode:

This gets the flag: ACECTF{7h3_d1ff3r3nc3_b37w33n_y0u_4nd_m3}