[🥉 Bronze 1] 금지된 역연산을 허용 모드로 재조립하다 — DreamHack Textbook-DES 풀이

class TDES:
    def __init__(self, key1, key2):
        self.keys = [key1, key2, key1]                         # ← K1, K2, K1
        self.cipher = [DES.new(key, DES.MODE_ECB) for key in self.keys]
 
    def encrypt(self, plaintext, mode):                        # mode: 3글자, 각 'E'/'D'
        for cipher, m in zip(self.cipher, mode):
            if m == 'E':
                plaintext = cipher.encrypt(plaintext)          # 자리 0,2 → K1 / 자리 1 → K2
            else:
                plaintext = cipher.decrypt(plaintext)
        return plaintext

encrypt(x, mode) = A^s2 · B^s1 · A^s0 (x)      # s = +1('E'), -1('D')

EDE = A·B⁻¹·A        ← 플래그 암호화:  C = EDE(P)
DED = A⁻¹·B·A⁻¹      ← 복호에 필요    (금지!)

DEE = A⁺ B⁺ A⁻
DDD = A⁻ B⁻ A⁻
EED = A⁻ B⁺ A⁺

EED · DDD · DEE
= A⁻ B⁺ (A⁺·A⁻) B⁻ (A⁻·A⁺) B⁺ A⁻
= A⁻ B⁺ ·  id  · B⁻ ·  id  · B⁺ A⁻
= A⁻ (B⁺·B⁻·B⁺) A⁻
= A⁻¹ · B · A⁻¹          # = DED 의 효과

# verify.py — 랜덤 키로 chain == DED(C) == P 임을 증명
from cipher import TDES
import os
k1, k2 = os.urandom(8), os.urandom(8)
t = TDES(k1, k2)
P = b"DH{example_plaintext_block_x16!}"      # 32바이트
C = t.encrypt(P, "EDE")                       # 옵션 2가 주는 형태
chain     = t.encrypt(t.encrypt(t.encrypt(C, "DEE"), "DDD"), "EED")
forbidden = t.encrypt(C, "DED")
print("  chain    == P      :", chain == P)
print("  DED(C)   == P      :", forbidden == P)
print("  chain    == DED(C) :", chain == forbidden)

#!/usr/bin/env python3
# Textbook-DES — flag ct C = EDE(P).  P = DED(C) is forbidden, so rebuild it:
#   EED ∘ DDD ∘ DEE = A^-1·B·A^-1 = DED  (none of which is the forbidden DED)
from pwn import *
context.log_level = "error"
 
def conn():
    if args.REMOTE:
        return remote(args.HOST, int(args.PORT))
    return process(["python3", "prob.py"])
 
def oracle(p, data, mode):
    p.sendlineafter(b"> ", b"1")
    p.sendlineafter(b"message(hex) > ", data.hex().encode())
    p.sendlineafter(b"mode > ", mode.encode())
    p.recvuntil(b"encrypted message > ")
    return bytes.fromhex(p.recvline().strip().decode())
 
def get_flag_ct(p):
    p.sendlineafter(b"> ", b"2")
    p.recvuntil(b"encrypted flag > ")
    return bytes.fromhex(p.recvline().strip().decode())
 
p = conn()
C = get_flag_ct(p)                  # C = EDE(flag)
x = oracle(p, C, "DEE")
y = oracle(p, x, "DDD")
P = oracle(p, y, "EED")             # = DED(C) = flag (padded)
p.close()
 
print("[+] FLAG :", P[:-P[-1]].decode(errors="replace"))   # strip padding

[+] FLAG : DH{a9988f8eb8eb3e3a92656ca77738cf4ed1ac38bc04757b00071ac804342a27b8}