Cryptohack6(AES_2)

1. Diffusion through Permutation

We've provided code to perform MixColumns and the forward ShiftRows operation. After implementing inv_shift_rows, take the state, run inv_mix_columns on it, then inv_shift_rows, convert to bytes and you will have your flag.

문제에서 shift_rows를 mix_columns로 암호화를 진행했기 때문에 복호화는 암호화 과정의 역과정으로 진행하면 됨.

문제 코드

def shift_rows(s):

s[0][1], s[1][1], s[2][1], s[3][1] = s[1][1], s[2][1], s[3][1], s[0][1]

s[0][2], s[1][2], s[2][2], s[3][2] = s[2][2], s[3][2], s[0][2], s[1][2]

s[0][3], s[1][3], s[2][3], s[3][3] = s[3][3], s[0][3], s[1][3], s[2][3]

def inv_shift_rows(s):

s[1][1], s[2][1], s[3][1], s[0][1] = s[0][1], s[1][1], s[2][1], s[3][1]

s[2][2], s[3][2], s[0][2], s[1][2] = s[0][2], s[1][2], s[2][2], s[3][2]

s[3][3], s[0][3], s[1][3], s[2][3] = s[0][3], s[1][3], s[2][3], s[3][3]

learned from http://cs.ucsb.edu/~koc/cs178/projects/JT/aes.c

xtime = lambda a: (((a << 1) ^ 0x1B) & 0xFF) if (a & 0x80) else (a << 1)

def mix_single_column(a):

see Sec 4.1.2 in The Design of Rijndael

t = a[0] ^ a[1] ^ a[2] ^ a[3]

u = a[0]

a[0] ^= t ^ xtime(a[0] ^ a[1])

a[1] ^= t ^ xtime(a[1] ^ a[2])

a[2] ^= t ^ xtime(a[2] ^ a[3])

a[3] ^= t ^ xtime(a[3] ^ u)

def mix_columns(s):

for i in range(4):

mix_single_column(s[i])

def inv_mix_columns(s):

see Sec 4.1.3 in The Design of Rijndael

for i in range(4):

u = xtime(xtime(s[i][0] ^ s[i][2]))

v = xtime(xtime(s[i][1] ^ s[i][3]))

s[i][0] ^= u

s[i][1] ^= v

s[i][2] ^= u

s[i][3] ^= v

mix_columns(s)

state = [

[108, 106, 71, 86],

[96, 62, 38, 72],

[42, 184, 92, 209],

[94, 79, 8, 54],

]

inv_mix_columns(state)

inv_shift_rows(state)

print(bytes(sum(state, [])))

flag'crypto{d1ffUs3R}'