Classic CTF Ciphers in Crypto-Tasks
The Crypto category at the competition does not start with the RSA. The first tasks are wildcards and polyalphavite ciphers, where the flag is hidden behind an algorithm that is several hundred years old. Three patterns that occur most often. More details – in our review, creating ctf tasks.
Caesar's cheat: decryption by overkill 25 shifts
Caesar's cipher is the shift of each letter of the alphabet to a fixed number of positions. In the Latin alphabet 26 letters, possible keys are only 25. On the CTF, the problem with the shift cipher is solved trivially: to sort through all the options and find a meaningful text.
A particular case is ROT13, a shift of 13 positions. The chip is that the reuse of ROT13 returns the source text (26 / 2 = 13). In crypto CTF, ROT13 tasks are often masked under “unknown encoding.” You see a line of Latin letters without a visible structure - try ROT13 first, you will not lose.
Recognizing the Caesar code in the condition is simple: the text consists of only letters of the same alphabet, the length is preserved, the spaces and punctuation marks are in place. In practice, it is enough to throw the text in CyberChef with a recipe ROT13 Brute Force – all 25 options with one click.
Vigener Code: Frequency analysis instead of overkill
The Vigener cipher is a polyalphavite substitution, where each letter is shifted by the value determined by the corresponding letter of the keyword. The key is repeated cyclically. Unlike Caesar, there is no direct overkill here - the space of the keys grows exponentially from the length of the key.
Classic approach to cryptoanalysis for beginners on CTF:
Determine the length of the key - the Kasiski method (searching for repeated trigrams and calculating the NOD distances between them) or the match index. If the IC for the substring is close to 0.065 (English text) - the key length is correct.
Break the code text into blocks - one for each position of the key. Each block is encrypted by the usual Caesar.
Frequency analysis of each block is to compare the frequency of letters with the reference distribution of the language and find a shift.
For English texts with a short key (3-8 characters), the entire process is automated. dcode.fr copes in seconds. For Russian-language texts, reference frequencies are different (the letter "o" is the most frequent, about 11%), but the principle is the same.
CyberChef for Cryptography: Swiss Knife
CyberChef (gchq.github.io/CyberChef) is a browser-based tool with a drag-and-drop interface that covers most of the tasks with classic cryptographic ciphers. Recipes that really save time:
Magic is the automatic definition of encoding and cipher. Downloading the CyberChef Codex – trying dozens of transformations and showing the most likely.
From Base64 / From Hex / From Binary – conversion between formats. Often the flag is encoded in several layers: base64 → hex → ASCII. This doll is found on every second CTF.
XOR / XOR Brute Force — overkill of one-byte XOR key. If the XOR'en codex is with one byte, CyberChef will find the key to the frequency analysis.
ROT13 / ROT47 is an instant check of rotational ciphers.
A typical beginner’s mistake is to rush to write Python script when the task is solved in CyberChef in 30 seconds. The rule is simple: first, try Magic, then open the code editor.
RSA for CTF: Mathematics without pain
RSA is an asymmetric encryption algorithm based on the complexity of factorization of large numbers. In the real world, RSA sticks everywhere, from TLS to packet signature. In crypto CTF tasks, RSA appears in every second mid-level task, and CTF cryptography for beginners without understanding RSA is impossible.
Key RSA Formulas
To solve crypto tashka CTF, it is enough to keep five formulas in your head:
n = p × q is a module, a product of two large prime numbers
φ
= (p − 1)(q − 1) — Euler function (in some implementations use λ = lcm(p−1, q−1), but for CTF the difference is insignificant)
e × d ≡ 1 (mod φ) — communication of public exhibitors e and private exhibitors d
c = m^e mod n — encryption: plain text m is erected to the degree e by module n
m = c^d mod n — decryption: ciphertext c is built into a degree d by module n
Public key is a pair (n, e). The private key is d (or, equivalently, knowledge of p and q from which d is calculated). All RSA security is kept on one assumption: it is impossible to factor n on p and q computationally with sufficient key length. On the CTF, the authors break this assumption – intentionally.
What breaks in CTF tasks
In real systems, RSA parameters are selected strictly: n ≥ 2048 bit, e = 65537, p and q are random simple of the same length. In CTF, the authors deliberately weaken one or more parameters. The task of the participant is to find weakness and exploit it.
The main patterns of weakening RSA at competitions:
What is weakened Sign in condition Type of attack
Small exhibit e (e=3) e=3, c significantly less n Extracting the root
One message, e recipients e pair (n_i, c_i), identical m Attack by Hastada (CRT)
Too big an e e is close to n in length The Viner Attack
Small simple p or q n < 512 bits or has a pattern Factorization (yafu, FactorDB)
Common Divisor at Several n Two modules n_1 and n_2 GCD(n_1, n_2)
This table is a cheat sew for crypto CTF drags. According to the parameters, the condition immediately shows which attack to use.
Attack on RSA with a small exhibitor
The most frequent RSA attack for beginners on CTF. If the public exponent e is small (usually e=3) and the open text m is short enough, encryption does not actually engage the modular arithmetic of cryptography. And it's a gift.
Why e=3 is a gift for the attacker
Encryption of RSA: c = m^e mod n. If m^e < n, mod n does nothing – the ciphertext c is simply m^e. To get m, it is enough to extract the root of the e-th degree from c. For e=3, it's a cubic root, an operation in milliseconds.
When m^e still exceeds n, but not by much, the codetext “turned” through the module only a few times. Then we sort k in formula m = (c + k × n)^(1/e) for k = 0, 1, 2, ... until we get the whole root. As described on jorianwoltjer.com, a good attack indicator is a much smaller n: the wrappers are small or not at all.
Key feature in the condition of the task: c noticeably shorter n (by order), e = 3 (less often 5 or 7). You see such a combination, it's almost guaranteed to attack with root extraction.
Solution: Python code
from gmpy2 import iroot
def small_e_attack(c, e, n):
for k in range(e):
m, exact = iroot(c + k * n, e)
if exact:
return int(m)
# e=3, c и n из условия задачи
m = small_e_attack(c, 3, n)
print(bytes.fromhex(hex(m)[2:]))
iroot of gmpy2 calculates an integer root and returns the flag exact whether the result is accurate. The cycle on k goes through the "turnover" of the module. Theoretically k < e (because m < n, then m^e < n^e, the number of revolutions does not exceed e − 1). In practice, for e=3 k almost always equal to 0, 1 or 2. Alternative without gmpy2 - from sympy import integer_nthroot, works similarly. To convert the number into readable text instead of manual hex-juggling is more convenient from Crypto.Util.number import long_to_bytes.
The Crypto category at the competition does not start with the RSA. The first tasks are wildcards and polyalphavite ciphers, where the flag is hidden behind an algorithm that is several hundred years old. Three patterns that occur most often. More details – in our review, creating ctf tasks.
Caesar's cheat: decryption by overkill 25 shifts
Caesar's cipher is the shift of each letter of the alphabet to a fixed number of positions. In the Latin alphabet 26 letters, possible keys are only 25. On the CTF, the problem with the shift cipher is solved trivially: to sort through all the options and find a meaningful text.
A particular case is ROT13, a shift of 13 positions. The chip is that the reuse of ROT13 returns the source text (26 / 2 = 13). In crypto CTF, ROT13 tasks are often masked under “unknown encoding.” You see a line of Latin letters without a visible structure - try ROT13 first, you will not lose.
Recognizing the Caesar code in the condition is simple: the text consists of only letters of the same alphabet, the length is preserved, the spaces and punctuation marks are in place. In practice, it is enough to throw the text in CyberChef with a recipe ROT13 Brute Force – all 25 options with one click.
Vigener Code: Frequency analysis instead of overkill
The Vigener cipher is a polyalphavite substitution, where each letter is shifted by the value determined by the corresponding letter of the keyword. The key is repeated cyclically. Unlike Caesar, there is no direct overkill here - the space of the keys grows exponentially from the length of the key.
Classic approach to cryptoanalysis for beginners on CTF:
Determine the length of the key - the Kasiski method (searching for repeated trigrams and calculating the NOD distances between them) or the match index. If the IC for the substring is close to 0.065 (English text) - the key length is correct.
Break the code text into blocks - one for each position of the key. Each block is encrypted by the usual Caesar.
Frequency analysis of each block is to compare the frequency of letters with the reference distribution of the language and find a shift.
For English texts with a short key (3-8 characters), the entire process is automated. dcode.fr copes in seconds. For Russian-language texts, reference frequencies are different (the letter "o" is the most frequent, about 11%), but the principle is the same.
CyberChef for Cryptography: Swiss Knife
CyberChef (gchq.github.io/CyberChef) is a browser-based tool with a drag-and-drop interface that covers most of the tasks with classic cryptographic ciphers. Recipes that really save time:
Magic is the automatic definition of encoding and cipher. Downloading the CyberChef Codex – trying dozens of transformations and showing the most likely.
From Base64 / From Hex / From Binary – conversion between formats. Often the flag is encoded in several layers: base64 → hex → ASCII. This doll is found on every second CTF.
XOR / XOR Brute Force — overkill of one-byte XOR key. If the XOR'en codex is with one byte, CyberChef will find the key to the frequency analysis.
ROT13 / ROT47 is an instant check of rotational ciphers.
A typical beginner’s mistake is to rush to write Python script when the task is solved in CyberChef in 30 seconds. The rule is simple: first, try Magic, then open the code editor.
RSA for CTF: Mathematics without pain
RSA is an asymmetric encryption algorithm based on the complexity of factorization of large numbers. In the real world, RSA sticks everywhere, from TLS to packet signature. In crypto CTF tasks, RSA appears in every second mid-level task, and CTF cryptography for beginners without understanding RSA is impossible.
Key RSA Formulas
To solve crypto tashka CTF, it is enough to keep five formulas in your head:
n = p × q is a module, a product of two large prime numbers
φ
= (p − 1)(q − 1) — Euler function (in some implementations use λ = lcm(p−1, q−1), but for CTF the difference is insignificant)e × d ≡ 1 (mod φ
) — communication of public exhibitors e and private exhibitors dc = m^e mod n — encryption: plain text m is erected to the degree e by module n
m = c^d mod n — decryption: ciphertext c is built into a degree d by module n
Public key is a pair (n, e). The private key is d (or, equivalently, knowledge of p and q from which d is calculated). All RSA security is kept on one assumption: it is impossible to factor n on p and q computationally with sufficient key length. On the CTF, the authors break this assumption – intentionally.
What breaks in CTF tasks
In real systems, RSA parameters are selected strictly: n ≥ 2048 bit, e = 65537, p and q are random simple of the same length. In CTF, the authors deliberately weaken one or more parameters. The task of the participant is to find weakness and exploit it.
The main patterns of weakening RSA at competitions:
What is weakened Sign in condition Type of attack
Small exhibit e (e=3) e=3, c significantly less n Extracting the root
One message, e recipients e pair (n_i, c_i), identical m Attack by Hastada (CRT)
Too big an e e is close to n in length The Viner Attack
Small simple p or q n < 512 bits or has a pattern Factorization (yafu, FactorDB)
Common Divisor at Several n Two modules n_1 and n_2 GCD(n_1, n_2)
This table is a cheat sew for crypto CTF drags. According to the parameters, the condition immediately shows which attack to use.
Attack on RSA with a small exhibitor
The most frequent RSA attack for beginners on CTF. If the public exponent e is small (usually e=3) and the open text m is short enough, encryption does not actually engage the modular arithmetic of cryptography. And it's a gift.
Why e=3 is a gift for the attacker
Encryption of RSA: c = m^e mod n. If m^e < n, mod n does nothing – the ciphertext c is simply m^e. To get m, it is enough to extract the root of the e-th degree from c. For e=3, it's a cubic root, an operation in milliseconds.
When m^e still exceeds n, but not by much, the codetext “turned” through the module only a few times. Then we sort k in formula m = (c + k × n)^(1/e) for k = 0, 1, 2, ... until we get the whole root. As described on jorianwoltjer.com, a good attack indicator is a much smaller n: the wrappers are small or not at all.
Key feature in the condition of the task: c noticeably shorter n (by order), e = 3 (less often 5 or 7). You see such a combination, it's almost guaranteed to attack with root extraction.
Solution: Python code
from gmpy2 import iroot
def small_e_attack(c, e, n):
for k in range(e):
m, exact = iroot(c + k * n, e)
if exact:
return int(m)
# e=3, c и n из условия задачи
m = small_e_attack(c, 3, n)
print(bytes.fromhex(hex(m)[2:]))
iroot of gmpy2 calculates an integer root and returns the flag exact whether the result is accurate. The cycle on k goes through the "turnover" of the module. Theoretically k < e (because m < n, then m^e < n^e, the number of revolutions does not exceed e − 1). In practice, for e=3 k almost always equal to 0, 1 or 2. Alternative without gmpy2 - from sympy import integer_nthroot, works similarly. To convert the number into readable text instead of manual hex-juggling is more convenient from Crypto.Util.number import long_to_bytes.
