Advanced Cryptography
Beyond classical ciphers, modern crypto breaks because of how it is implemented, not the math itself. You will factor RSA moduli with Pollard's p-1 and shared-prime GCDs, mount differential power-analysis attacks on AES, exploit nonce reuse in ECDSA, and apply lattice reduction to recover secrets from too few shares. This path assumes you are comfortable with encoding, hashing, and basic RSA.
Guides for this path
Read these alongside the challenges below. The first one orients you; the rest go deeper on the techniques each step needs.
- RSA Attacks for CTF CryptographyRSA attacks for CTF: small public exponent, weak modulus factoring, common modulus, Wiener's attack, and oracle decryption, with picoCTF challenge links.
- Modular Arithmetic for CTF Crypto: The Math Behind RSA, DH, and ECCModular arithmetic for CTF: congruence, modular inverses, Euler and Fermat, fast exponentiation, the Chinese Remainder Theorem, and discrete logs in Python.
- AES for CTF: Read the Ciphertext, Not the MathAES bugs in picoCTF are mode bugs, not math bugs. Three modes (ECB, CBC, CTR), three visible ciphertext fingerprints, three one-line attacks, three picoCTF receipts.
- Stream Ciphers in CTFs: LFSR, Vigenere, and Keystream ReuseStream ciphers in CTF: three weaknesses break almost every one, short keys, reused keystreams, and linear feedback, with Berlekamp-Massey and Kasiski in Python.
- Padding Oracle and CBC Bit-Flipping Attacks for CTFDecrypt AES-CBC with no key. The padding oracle leaks plaintext one byte at a time, and CBC bit-flipping forges it. Working Python, padbuster, and the math.
- Insecure Randomness for CTF: Predicting PRNGs and the Mersenne TwisterPredict Python's random, crack the Mersenne Twister with randcrack from 624 outputs, brute a time() seed, and recover an LCG. Working code for CTF guessing games.
- Step 01
RSA Factoring Attacks
Textbook RSA is secure; the implementations in CTFs are not. These challenges exploit specific structural weaknesses: a tiny exponent that lets you take a plain cube root, a smooth p-1 that falls to Pollard's algorithm, a leaked sum and product of the primes, and moduli that share a prime factor recoverable by GCD.
- Step 02
Broken Key Generation and Recovery
When key generation uses bad randomness or the key file is partially corrupted, the private key becomes recoverable. These challenges make you exploit a weak exponent choice, reconstruct a damaged RSA key from its intact fields and the CRT relationships, and rebuild missing prime factors from partial data.
- Step 03
Symmetric and Mode Attacks
Symmetric crypto fails when a mode is misused. AES-ABC chains blocks in a broken way you can unwind, Double DES collapses to a meet-in-the-middle search, ChaCha Slide loses integrity when you tamper with a Poly1305 ciphertext, and XtraORdinary falls to the parity property of repeated XOR.
- Step 04
Side-Channel and Oracle Attacks
You do not always attack the algorithm directly. Power analysis correlates simulated power traces against predicted SubBytes outputs to recover an AES key byte by byte, a compression oracle leaks plaintext through ciphertext length, and a biased ECDSA nonce gives up the private key across signatures.
- Step 05
Lattices and Advanced Number Theory
The hardest crypto challenges reach for heavier mathematics. You reconstruct secrets from partial outputs with the Chinese Remainder Theorem and polynomial interpolation, tame fast-growing sequences with matrix exponentiation, and apply lattice-based attacks to recover a Shamir secret from insufficient shares.