JAVA RSAES-OAEP攻击
我需要使用 unix 可执行 oracle 和 ASCII 格式的质询文件来实施 RSAES-OAEP PKCS#1 V2.1 攻击。 Challenge ASCII 文件的格式为，
{n}
{e}
{c}
其中 N（整数）是 1024 位模数，e（整数）是公共指数，c（整数）是公共指数。 八位字节串）是一些未知的RSAES-OAEP加密对应的密文 公钥 (N, e) 下的明文 m（八位字节字符串）。注意明文是ASCII文本 （即，每个八位字节都是一个 ASCII 编码字符），并且 RSAES-OAEP 加密将 使用 SHA-1 作为散列函数和空标签（即，在所有情况下标签都是八位字节 长度为零的字符串）。 该可执行文件代表 RSAES-OAEP 解密预言机：当从 BASH 执行时 shell 使用命令
bash$ ./ USER < USER . challenge
尝试使用私钥 (N, d) 解密从 stdin 读取的密文。请注意，N 是 从 stdin 读取（即从挑战中读取），但 d （整数）是嵌入的私有指数 进入预言机（即，您无权访问它）。
挑战文件如下：
99046A2DB3D185D6D2728E799D66AC44F10DDAEE1C0A1AC5D7F34F04EDE17B96A5B486D95D927AA9B58FC91865DBF3A1685141345CC31B92E13F06E8212BAB22529F7D06B503AAFEEB89800E12EABA50C3F3BBE86F5966A88CCCF5C843281F8B98DF97A3111458FCA89B8085A96AE68EAEBAE270831D41C956159B81D29503
80A3C4043F940BE6AC16B11A0A77016DBA96B0239311AF182DD70E214E07E7DF3523CE1E269B176A3AAA0BA8F02C59262F693D6A248F22F2D561ED7ECC3CB9ABD0FE7B7393FA0A16C4D07181EEF6E27D97F48B83B90C58F51FD40DCDA71EF5E3C3E97D1697DC8E26B694B5CAFE59E427B12EE82A93064C81AAB74431F3A735
57D808889DE1417235C790CB7742EB76E537F55FD49941EBC862681735733F8BB095EDBB3C0DA44AB8F1176E69A61BBD3F0D31EB997071758A5DD850730A1D171E9EC92788EBA358974CE521537EE4A809BF1607D04EFD4A407866970981B88F44D5260D25C9E8864D5FC2AFB2CB90994DD1934BCEA728B38A00D4712AE0EE
关于如何进行这次攻击有什么想法吗？！
谢谢 有人指导我吗？！！！！！！！！！
I need to implement an RSAES-OAEP PKCS#1 V2.1 attack, using a unix executable oracle and a ASCII format challenge file. The format of challenge ASCII file is
{n}
{e}
{c}
where N (an integer) is a 1024-bit modulus, e (an integer) is the public exponent and c (an
octet string) is the ciphertext corresponding to the RSAES-OAEP encryption of some unknown
plaintext m (an octet string) under the public key (N, e). Note that the plaintext is ASCII text
(i.e., each octet is an ASCII encoded character), and that the RSAES-OAEP encryption will
have used SHA-1 as the hash function and a null label (i.e., in all cases the label is an octet
string of length zero).
The executable represents an RSAES-OAEP decryption oracle: when executed from a BASH
shell using the command
bash$ ./ USER < USER . challenge
it tries to decrypt the ciphertext read from stdin using the private key (N, d). Note that N is
read from stdin (i.e., from the challenge) but d (an integer) is a private exponent embedded
into the oracle (i.e., you do not have access to it).
The challenge file is as follows:
99046A2DB3D185D6D2728E799D66AC44F10DDAEE1C0A1AC5D7F34F04EDE17B96A5B486D95D927AA9B58FC91865DBF3A1685141345CC31B92E13F06E8212BAB22529F7D06B503AAFEEB89800E12EABA50C3F3BBE86F5966A88CCCF5C843281F8B98DF97A3111458FCA89B8085A96AE68EAEBAE270831D41C956159B81D29503
80A3C4043F940BE6AC16B11A0A77016DBA96B0239311AF182DD70E214E07E7DF3523CE1E269B176A3AAA0BA8F02C59262F693D6A248F22F2D561ED7ECC3CB9ABD0FE7B7393FA0A16C4D07181EEF6E27D97F48B83B90C58F51FD40DCDA71EF5E3C3E97D1697DC8E26B694B5CAFE59E427B12EE82A93064C81AAB74431F3A735
57D808889DE1417235C790CB7742EB76E537F55FD49941EBC862681735733F8BB095EDBB3C0DA44AB8F1176E69A61BBD3F0D31EB997071758A5DD850730A1D171E9EC92788EBA358974CE521537EE4A809BF1607D04EFD4A407866970981B88F44D5260D25C9E8864D5FC2AFB2CB90994DD1934BCEA728B38A00D4712AE0EE
Any ideas as to how to proceed for this attack?!
thanks
Anyone to guide me for this?!!!!!!!!!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以尝试的第一件事是确定是否可以通过以下方式应用攻击
J. Manger，来自论文“RSA 最优非对称加密的选择密文攻击”
填充（OAEP）在 PKCS #1 v2.0 中标准化。”Crypto 2001。
这意味着您必须找出可以从预言机获得什么样的信息。
即选择两个任意整数m0，m1，使得m1是小于n的1024位整数
m0 的长度为 1023 位或更少。如果将 m0^e mod n 和 m1^e mod n 传递给预言机，您会得到不同的响应吗？如果是这样，那么您也许可以应用上面论文中的攻击。否则你将不得不寻找解密神谕中的另一个缺陷。
另一种可能有效的方法是尝试修改模数 n。如果预言机确实从用户提供的输入中读取模数，那么看起来修改模数应该有效，并且攻击变得非常容易。我无法访问预言机的实现，所以我只能猜测可能发生的情况。如果您可以检查任何选择的
n',c' c'^d mod n' 是否是有效的 OAEP 编码明文，那么解密原始消息并不是您能做的全部，事实上您还可以恢复 d ，从而计算原始 RSA 模数。
（此外，这确实是一个非常好的谜题，所以我不想因为给
有关如何解决该问题的逐步收据。）
The first thing you could try is to find out whether you can apply the attack by
J. Manger from the paper "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption
Padding (OAEP) as Standardized in PKCS #1 v2.0." Crypto 2001.
That means you have to find out what kind of information you can get from the oracle.
I.e. Choose two arbitrary integers m0, m1 such that m1 is a 1024-bit integer smaller than n
and m0 is 1023 or less bits long. If you pass m0^e mod n and m1^e mod n to the oracle do you get a different response? If so then you might be able to apply the attack in the paper above. Otherwise you will have to search for another flaw in the decryption oracle.
Another approach that might work is to try to modify the modulus n. If the oracle really reads the modulus from user supplied input, then it looks like modifying the modulus should work and the attack becomes quite easy. I don't have access to the implementation of the oracle so I can only guess what might be possible. If you can check for any chosen
n',c' whether c'^d mod n' is a valid OAEP encoded plaintext then you decrypting the original message is not all you can do, in fact you can also recover d and hence factor the original RSA modulus.
(Furthermore this would indeed be a very nice puzzle, so I don't want to spoil the fun by giving
a step by step receipe on how to solve it.)