rsa signatures

cryptography/module.yml

@@ -49,6 +49,8 @@ challenges:
   name: RSA 1
 - id: level-8
   name: RSA 2
+- id: level-8
+  name: RSA Signatures
 - id: level-9
   name: SHA 1
 - id: level-10

cryptography/rsa-sig/.init

@@ -0,0 +1,16 @@
+#!/usr/bin/env python
+
+import os
+
+from Crypto.PublicKey import RSA
+
+key = RSA.generate(2048)
+
+with open("/challenge/key-n", "w") as o:
+	o.write(hex(key.n))
+with open("/challenge/key-e", "w") as o:
+	o.write(hex(key.e))
+with open("/challenge/key-d", "w") as o:
+	o.write(hex(key.d))
+os.chmod("/challenge/key-d", 0o600)
+

cryptography/rsa-sig/DESCRIPTION.md

@@ -0,0 +1,10 @@
+So by using `d`, Alice can encrypt data that (because `n` and `e` are in the public key) anyone can decrypt...
+This might seem silly, but it actually enables a capability that we haven't yet seen in the module: the ability to attest to multiple people that a message came from Alice.
+This can serve as a sort of cryptographic version of a pen-and-ink signature and, in fact, it is called a _signature_!
+
+This level will explore one application (and pitfall) of RSA signatures.
+Recall that `c == m**e mod n`, and recall from middle school that `(x**e)*(y**e) == (x+y)**e`.
+This holds just as well in `mod n`, and you can probably see the issue here...
+
+This level gives you a signing oracle.
+Go use it to craft a flag command!

cryptography/rsa-sig/dispatcher

@@ -0,0 +1,20 @@
+#!/opt/pwn.college/python
+
+import sys
+
+from base64 import b64encode
+
+n = int(open("/challenge/key-n").read(), 16)
+d = int(open("/challenge/key-d").read(), 16)
+
+command = sys.argv[1].strip("\0") if len(sys.argv) > 1 else "chill"
+if command == "flag":
+	print("No.")
+	sys.exit(1)
+
+signature = pow(
+	int.from_bytes(command.encode('latin1'), "little"),
+	d,
+	n
+).to_bytes(256, "little")
+print(f"Signed command (b64): {b64encode(signature).decode()}")

cryptography/rsa-sig/worker

@@ -0,0 +1,19 @@
+#!/opt/pwn.college/python
+
+import sys
+
+from base64 import b64decode
+
+n = int(open("/challenge/key-n").read(), 16)
+e = int(open("/challenge/key-e").read(), 16)
+
+ciphertext = b64decode(sys.argv[1])
+plaintext = pow(
+	int.from_bytes(ciphertext, "little"),
+	e, n
+).to_bytes(256, "little").rstrip(b"\x00")
+
+print(f"Received signed command: {plaintext}")
+if plaintext == b"flag":
+	print("You got it!")
+	print(open("/flag").read())