r3ctf 2025 - ottol r3pus

task.py

from Crypto.Util.number import getPrime
from random import randint
import signal

def _handle_timeout(signum, frame):
    raise TimeoutError('function timeout')

timeout = 60
signal.signal(signal.SIGALRM, _handle_timeout)
signal.alarm(timeout)



print("Welcome to ottoL repus.")

bitsize = 1024
flag = open("flag",'r').read()
p,q = getPrime(bitsize // 2),getPrime(bitsize // 2)
score = 0
chances = 0

for _ in range(16):
    print("1. Game Start.")
    print("2. Check score.")
    print("Score:", score)
    coi = int(input())
    
    if coi == 1:
        secret = randint(0, 2 ** 64)
        r1,r2 = randint(0, q), randint(0,p)
        u = randint(0, 2 ** (bitsize // 2))
        v = (secret * 2 ** 128 + randint(0, 2 ** 128)) - u
        x = u + r1 * p
        y = v + r2 * q
        print("x =", x)
        print("y =", y)
        guess = int(input("Give me the secret number: "))
        if guess == secret:
            score += 1
            print("You are smart!")
        else:
            print("~")
    elif coi == 2:
        print("Your scores:", score)
        if score >= 10:
            print(flag)
        else:
            print("Fighting!")
    elif coi == p:
        print("Wtf? You known the real secret number!")
        print(flag)

test.py

from lll_cvp import *
from Crypto.Util.number import *


bitsize = 1024
p, q = getPrime(bitsize // 2), getPrime(bitsize // 2)


def get():
    secret = randint(0, 2**64)
    r1, r2 = randint(0, q), randint(0, p)
    u = randint(0, 2 ** (bitsize // 2))
    v = (secret * 2**128 + randint(0, 2**128)) - u
    x = u + r1 * p
    y = v + r2 * q
    return x, y, u, v, r1, r2


xs, ys, us, vs, r1s, r2s = map(vector, zip(*[get() for _ in range(15)]))
ss = us + vs
ot = find_ortho(None, xs, ys)
print(ot * ss, ot * r1s, ot * r2s)
rk = ot[:11].right_kernel_matrix(basis="LLL")
# rk[0]=+-ss
assert xs + ys - ss == p * r1s + q * r2s
ot2 = find_ortho(None, xs, ys - ss)
print(ot2 * us)
rk2 = ot2[:12].right_kernel_matrix(basis="LLL")
print(rk2.solve_left(us))
for usc in enum_brute(None, rk2):
    pc = gcd(xs - usc)
    if is_pseudoprime(pc) and pc.bit_length() == bitsize // 2:
        print(pc == p, pc)