CTF密码学挑战速查指南 | 经典/现代密码攻击、RSA/ECC/流密码实战技巧

ctf-crypto by ljagiello/ctf-skills

648 周安装量

694 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-crypto

教育科技安全

🇨🇳中文介绍

CTF 密码学

CTF 密码学挑战快速参考。每种技术在此处都有一行描述；完整细节和代码请参阅支持文件。

额外资源

classic-ciphers.md - 经典密码：维吉尼亚（+ Kasiski 检验）、Atbash、替换轮、XOR 变体（+ 多字节频率分析）、确定性 OTP、级联 XOR、书本密码、OTP 密钥重用 / 多次一密本、变长同音替换、网格置换密码密钥空间缩减、基于图像的凯撒移位密码
modern-ciphers.md - 现代密码攻击：AES（CFB-8、ECB 泄漏）、CBC-MAC/OFB-MAC、填充预言机、S 盒碰撞、GF(2) 消元法、LCG 部分输出恢复、CBC 填充预言机（完整块解密）、Bleichenbacher RSA PKCS#1 v1.5 填充预言机（ROBOT）、生日攻击 / 中间相遇攻击、CRC32 碰撞签名伪造、Blum-Goldwasser 比特扩展预言机、哈希长度扩展攻击、压缩预言机（CRIME 风格）、OFB 模式可逆 RNG 反向解密、通过公钥哈希 XOR 的弱密钥派生
stream-ciphers.md - 流密码攻击：LFSR（Berlekamp-Massey、相关性攻击、已知明文、Galois 与 Fibonacci、通过自相关恢复 Galois 抽头）、RC4 第二字节偏差、XOR 连续字节相关性
rsa-attacks.md - RSA 攻击：小 e（立方根）、公共模数、Wiener 攻击、Pollard p-1 攻击、Hastad 广播攻击、Fermat/连续素数、多素数、受限数字、Coppersmith 结构化素数、Manger 预言机、多项式哈希、RSA p=q 验证绕过、立方根 CRT gcd(e,phi)>1、从 phi(n) 倍数分解、乘法同态签名伪造、通过基数表示的弱密钥生成、gcd(e,phi)>1 的 RSA 指数约简
ecc-attacks.md - ECC 攻击：小子群、无效曲线、Smart 攻击（异常曲线，含 Sage 代码）、故障注入、时钟群 DLP、Pohlig-Hellman、ECDSA 随机数重用、Ed25519 扭侧信道
zkp-and-advanced.md - ZKP/图三着色、Z3 求解器指南、混淆电路、Shamir SSS、二元语法约束求解、竞态条件、Groth16 损坏设置、DV-SNARG 伪造、用于置换恢复的 KZG 配对预言机
prng.md - PRNG 攻击（MT19937、通过 GF(2) 魔法矩阵进行 MT 浮点数恢复以预测令牌、LCG、GF(2) 矩阵 PRNG、通过 Z3 恢复 V8 XorShift128+ Math.random 状态、平方取中法、确定性 RNG 爬山法、随机模式预言机、基于时间的种子、通过 ctypes 同步 C 语言的 srand/rand、密码破解、逻辑映射混沌 PRNG）

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

现代密码攻击（补充）

复合模上的仿射密码： c = A*x+b (mod M)，M 为合数（例如，65=5*13）。通过独热向量进行选择明文恢复，每个素因子进行 CRT 求逆。参见 modern-ciphers.md。
自定义线性 MAC 伪造： 基于 XOR 的签名在秘密块中是线性的。从约 5 个已知对中恢复秘密，为目标伪造签名。参见 modern-ciphers.md。
Manger 预言机（RSA 阈值）： RSA 乘法 + 在 m*s < 2^128 上的二分搜索。约 128 次查询以恢复 AES 密钥。

CBC 填充预言机攻击

服务器揭示有效/无效填充 → 无需密钥即可解密任何 CBC 密文。每 16 字节块约 4096 次查询。使用 PadBuster 或 padding-oracle Python 库。参见 modern-ciphers.md。

Bleichenbacher RSA 填充预言机（ROBOT）

RSA PKCS#1 v1.5 填充验证预言机 → 自适应选择密文明文恢复。RSA-2048 约需 10K 次查询。通过时序影响 TLS 实现。参见 modern-ciphers.md。

生日攻击 / 中间相遇攻击

n 位哈希碰撞约需 2^(n/2) 次尝试。中间相遇攻击以 O(2^k) 而非 O(2^(2k)) 破解双重加密。参见 modern-ciphers.md。

基于 CRC32 碰撞的签名伪造（iCTF 2013）

CRC32 是线性的——附加 4 个选定字节以强制任何目标 CRC32，无需秘密即可伪造 CRC32(msg || secret) 签名。参见 modern-ciphers.md。

Blum-Goldwasser 比特扩展预言机（PlaidCTF 2013）

通过每次预言机查询扩展密文一个比特，通过奇偶性泄露明文。操纵 BBS 平方序列以产生有效的扩展密文。参见 modern-ciphers.md。

哈希长度扩展攻击

利用 Merkle-Damgard 哈希（hash(SECRET || user_data)）——附加任意数据并在不知道秘密的情况下计算有效哈希。使用 hashpump 或 hashpumpy。参见 modern-ciphers.md。

压缩预言机（CRIME 风格）

加密前的压缩通过密文长度变化泄露明文。发送选定的明文；匹配的 n-gram 压缩得更短。与 CRIME/BREACH 同类。参见 modern-ciphers.md。

RC4 第二字节偏差

RC4 的第二输出字节偏向 0x00（概率 1/128 对比 1/256）。约 2048 个样本即可将 RC4 与随机区分开。参见 stream-ciphers.md。

RSA 乘法同态签名伪造

无填充 RSA：S(a) * S(b) mod n = S(a*b) mod n。如果预言机将目标消息列入黑名单，则对其因子签名并相乘。参见 rsa-attacks.md。

RSA 基础： phi = (p-1)*(q-1), d = inverse(e, phi), m = pow(c, d, n)。完整示例请参见 rsa-attacks.md。
XOR： from pwn import xor; xor(ct, key)。XOR 变体请参见 classic-ciphers.md。

通过 ctypes 预测 C 语言的 srand/rand（L3akCTF 2024, MireaCTF）

模式： 二进制使用 srand(time(NULL)) + rand() 生成密钥/XOR 掩码。Python 的 random 模块使用不同的 PRNG。使用 ctypes.CDLL('./libc.so.6') 直接调用 C 语言的 srand(int(time())) 和 rand()，重现完全相同的序列。XOR 解密示例和时序技巧请参见 prng.md。

V8 XorShift128+（Math.random）状态恢复

模式： V8 JavaScript 引擎使用 xs128p PRNG 实现 Math.random()。给定 5-10 个连续的 Math.floor(CONST * Math.random()) 输出，使用 Z3 QF_BV 求解器恢复内部状态（state0, state1）并预测未来值。值必须反转（LIFO 缓存）。工具：d0nutptr/v8_rand_buster。参见 prng.md。

从浮点数输出恢复 MT 状态（PHD CTF Quals 2012）

模式： 服务器暴露 random.random() 浮点数。标准的逆态需要 624 × 32 位整数，但浮点数每个只产生约 8 个可用比特。预计算的 GF(2) 魔法矩阵（not_random 库）从 3360+ 个浮点数观察中恢复完整的 MT 状态。用于预测从 random.random() 派生的密码重置令牌、会话 ID 或 CSRF 令牌。参见 prng.md。

混沌 PRNG（逻辑映射）

逻辑映射： x = r * x * (1 - x), r ≈ 3.99-4.0；通过暴力破解高精度小数恢复种子
密钥流： 每次迭代 struct.pack("<f", x)；与密文进行 XOR

完整代码请参见 prng.md。

Python： pip install pycryptodome z3-solver sympy gmpy2
SageMath： sage -python script.py（ECC、Coppersmith、格攻击必需）
RsaCtfTool： python RsaCtfTool.py -n <n> -e <e> --uncipher <c> —— 自动化 RSA 攻击套件（尝试 Wiener、Hastad、Fermat、Pollard 等多种攻击）
quipqiup.com： 自动化替换密码求解器（频率 + 单词模式分析）

🇺🇸English

CTF Cryptography

Quick reference for crypto CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Additional Resources

classic-ciphers.md - Classic ciphers: Vigenere (+ Kasiski examination), Atbash, substitution wheels, XOR variants (+ multi-byte frequency analysis), deterministic OTP, cascade XOR, book cipher, OTP key reuse / many-time pad, variable-length homophonic substitution, grid permutation cipher keyspace reduction, image-based Caesar shift ciphers
modern-ciphers.md - Modern cipher attacks: AES (CFB-8, ECB leakage), CBC-MAC/OFB-MAC, padding oracle, S-box collisions, GF(2) elimination, LCG partial output recovery, CBC padding oracle (full block decryption), Bleichenbacher RSA PKCS#1 v1.5 padding oracle (ROBOT), birthday attack / meet-in-the-middle, CRC32 collision signature forgery, Blum-Goldwasser bit-extension oracle, hash length extension, compression oracle (CRIME-style), OFB mode invertible RNG backward decryption, weak key derivation via public key hash XOR
stream-ciphers.md - Stream cipher attacks: LFSR (Berlekamp-Massey, correlation attack, known-plaintext, Galois vs Fibonacci, Galois tap recovery via autocorrelation), RC4 second-byte bias, XOR consecutive byte correlation
rsa-attacks.md - RSA attacks: small e (cube root), common modulus, Wiener's, Pollard's p-1, Hastad's broadcast, Fermat/consecutive primes, multi-prime, restricted-digit, Coppersmith structured primes, Manger oracle, polynomial hash, RSA p=q validation bypass, cube root CRT gcd(e,phi)>1, factoring from phi(n) multiple, multiplicative homomorphism signature forgery, weak keygen via base representation, RSA with gcd(e,phi)>1 exponent reduction
ecc-attacks.md - ECC attacks: small subgroup, invalid curve, Smart's attack (anomalous, with Sage code), fault injection, clock group DLP, Pohlig-Hellman, ECDSA nonce reuse, Ed25519 torsion side channel
zkp-and-advanced.md - ZKP/graph 3-coloring, Z3 solver guide, garbled circuits, Shamir SSS, bigram constraint solving, race conditions, Groth16 broken setup, DV-SNARG forgery, KZG pairing oracle for permutation recovery
prng.md - PRNG attacks (MT19937, MT float recovery via GF(2) magic matrix for token prediction, LCG, GF(2) matrix PRNG, V8 XorShift128+ Math.random state recovery via Z3, middle-square, deterministic RNG hill climbing, random-mode oracle, time-based seeds, C srand/rand synchronization via ctypes, password cracking, logistic map chaotic PRNG)
historical.md - Historical ciphers (Lorenz SZ40/42, book cipher implementation)
advanced-math.md - Advanced mathematical attacks (isogenies, Pohlig-Hellman, baby-step giant-step (BSGS) for general DLP, LLL, Merkle-Hellman knapsack via LLL, Coppersmith, quaternion RSA, GF(2)[x] CRT, S-box collision code, LWE lattice CVP attack, affine cipher over non-prime modulus)
exotic-crypto.md - Exotic algebraic structures (braid group DH / Alexander polynomial, monotone function inversion, tropical semiring residuation, Paillier cryptosystem, Hamming code helical interleaving, ElGamal universal re-encryption, FPE Feistel brute-force, icosahedral symmetry group cipher, Goldwasser-Micali replication oracle)

Classic Ciphers

Caesar: Frequency analysis or brute force 26 keys
Vigenere: Known plaintext attack with flag format prefix; derive key from (ct - pt) mod 26. Kasiski examination for unknown key length (GCD of repeated sequence distances)
Atbash: A<->Z substitution; look for "Abashed" hints in challenge name
Substitution wheel: Brute force all rotations of inner/outer alphabet mapping
Multi-byte XOR: Split ciphertext by key position, frequency-analyze each column independently; score by English letter frequency (space = 0x20)
Cascade XOR: Brute force first byte (256 attempts), rest follows deterministically
XOR rotation (power-of-2): Even/odd bits never mix; only 4 candidate states
Weak XOR verification: Single-byte XOR check has 1/256 pass rate; brute force with enough budget
Deterministic OTP: Known-plaintext XOR to recover keystream; match load-balanced backends
OTP key reuse (many-time pad): C1 XOR C2 XOR known_P = unknown_P; crib dragging when no plaintext known
Homophonic (variable-length): Multi-character ciphertext groups map to single plaintext chars. Find n-grams with identical sub-n-gram frequencies, replace with symbols, solve as monoalphabetic. See classic-ciphers.md.
5x5 grid with independent row/column permutations collapses keyspace to 5! x 5! = 14,400; brute-force in milliseconds. See .

See classic-ciphers.md for full code examples.

Modern Cipher Attacks

AES-ECB: Block shuffling, byte-at-a-time oracle; image ECB preserves visual patterns
AES-CBC: Bit flipping to change plaintext; padding oracle for decryption without key
AES-CFB-8: Static IV with 8-bit feedback allows state reconstruction after 16 known bytes
CBC-MAC/OFB-MAC: XOR keystream for signature forgery: new_sig = old_sig XOR block_diff
S-box collisions: Non-permutation S-box (len(set(sbox)) < 256) enables 4,097-query key recovery
GF(2) elimination: Linear hash functions (XOR + rotations) solved via Gaussian elimination over GF(2)
Padding oracle: Byte-by-byte decryption by modifying previous block and testing padding validity
LFSR stream ciphers: Berlekamp-Massey recovers feedback polynomial from 2L keystream bits; correlation attack breaks combined generators with biased combining functions
Galois LFSR tap recovery: XOR known file header (PNG/PDF/ZIP) with ciphertext to get keystream; split into N-bit windows, compute (state >> 1) XOR next_state for LSB=1 transitions to directly recover tap mask. Autocorrelation sliding finds correct length. See stream-ciphers.md.
OFB with invertible RNG: Known plaintext in any block leaks RNG state; if state transition is bijective, run RNG backwards to decrypt all blocks. See .

See modern-ciphers.md for full code examples.

RSA Attacks

Small e with small message: Take eth root
Common modulus: Extended GCD attack
Wiener's attack: Small d
Fermat factorization: p and q close together
Pollard's p-1: Smooth p-1
Hastad's broadcast: Same message, multiple e=3 encryptions
Consecutive primes: q = next_prime(p); find first prime below sqrt(N)
Multi-prime: Factor N with sympy; compute phi from all factors
Restricted-digit primes: Digit-by-digit factoring from LSB with modular pruning
Coppersmith structured primes: Partially known prime; f.small_roots() in SageMath
Manger oracle (simplified): Phase 1 doubling + phase 2 binary search; ~128 queries for 64-bit key
Manger on RSA-OAEP (timing): Python or short-circuit skips expensive PBKDF2 when Y != 0, creating fast/slow timing oracle. Full 3-step attack (~1024 iterations for 1024-bit RSA). Calibrate timing bounds with known-fast/known-slow samples.
Polynomial hash (trivial root): g(0) = 0 for polynomial hash; craft suffix for msg = 0 (mod P), signature = 0

See rsa-attacks.md and advanced-math.md for full code examples.

Elliptic Curve Attacks

Small subgroup: Check curve order for small factors; Pohlig-Hellman + CRT
Invalid curve: Send points on weaker curves if validation missing
Singular curves: Discriminant = 0; DLP maps to additive/multiplicative group
Smart's attack: Anomalous curves (order = p); p-adic lift solves DLP in O(1)
Baby-step giant-step (BSGS): General DLP in O(sqrt(n)) time/space. Combined with Pohlig-Hellman for smooth-order groups (all factors of p-1 or curve order are small). Sage: discrete_log(Mod(h,p), Mod(g,p)). See advanced-math.md.
Fault injection: Compare correct vs faulty output; recover key bit-by-bit
Clock group (x^2+y^2=1): Order = p+1 (not p-1!); Pohlig-Hellman when p+1 is smooth
Isogenies: Graph traversal via modular polynomials; pathfinding via LCA
ECDSA nonce reuse: Same r in two signatures leaks nonce k and private key d via modular arithmetic. Check for repeated values

See ecc-attacks.md, advanced-math.md, and exotic-crypto.md for full code examples.

Lattice / LWE Attacks

LWE via CVP (Babai): Construct lattice from [q*I | 0; A^T | I], use fpylll CVP.babai to find closest vector, project to ternary {-1,0,1}. Watch for endianness mismatches between server description and actual encoding.
LLL for approximate GCD: Short vector in lattice reveals hidden factors
Multi-layer challenges: Geometry → subspace recovery → LWE → AES-GCM decryption chain

See advanced-math.md for full LWE solving code and multi-layer patterns.

ZKP & Constraint Solving

ZKP cheating: For impossible problems (3-coloring K4), find hash collisions or predict PRNG salts
Graph 3-coloring: nx.coloring.greedy_color(G, strategy='saturation_largest_first')
Z3 solver: BitVec for bit-level, Int for arbitrary precision; BPF/SECCOMP filter solving
Garbled circuits (free XOR): XOR three truth table entries to recover global delta
Bigram substitution: OR-Tools CP-SAT with automaton constraint for known plaintext structure
Trigram decomposition: Positions mod n form independent monoalphabetic ciphers
Shamir SSS (deterministic coefficients): One share + seeded RNG = univariate equation in secret
Race condition (TOCTOU): Synchronized concurrent requests bypass counter < N checks
Groth16 broken setup (delta==gamma): Trivially forge: A=alpha, B=beta, C=-vk_x. Always check verifier constants first
Groth16 proof replay: Unconstrained nullifier + no tracking = infinite replays from setup tx
DV-SNARG forgery: With verifier oracle access, learn secret v values from unconstrained pairs, forge via CRS entry cancellation

See zkp-and-advanced.md for full code examples and solver patterns.

Modern Cipher Attacks (Additional)

Affine over composite modulus: c = A*x+b (mod M), M composite (e.g., 65=5*13). Chosen-plaintext recovery via one-hot vectors, CRT inversion per prime factor. See modern-ciphers.md.
Custom linear MAC forgery: XOR-based signature linear in secret blocks. Recover secrets from ~5 known pairs, forge for target. See modern-ciphers.md.
Manger oracle (RSA threshold): RSA multiplicative + binary search on m*s < 2^128. ~128 queries to recover AES key.

CBC Padding Oracle Attack

Server reveals valid/invalid padding → decrypt any CBC ciphertext without key. ~4096 queries per 16-byte block. Use PadBuster or padding-oracle Python library. See modern-ciphers.md.

Bleichenbacher RSA Padding Oracle (ROBOT)

RSA PKCS#1 v1.5 padding validation oracle → adaptive chosen-ciphertext plaintext recovery. ~10K queries for RSA-2048. Affects TLS implementations via timing. See modern-ciphers.md.

Birthday Attack / Meet-in-the-Middle

n-bit hash collision in ~2^(n/2) attempts. Meet-in-the-middle breaks double encryption in O(2^k) instead of O(2^(2k)). See modern-ciphers.md.

CRC32 Collision-Based Signature Forgery (iCTF 2013)

CRC32 is linear — append 4 chosen bytes to force any target CRC32, forging CRC32(msg || secret) signatures without the secret. See modern-ciphers.md.

Blum-Goldwasser Bit-Extension Oracle (PlaidCTF 2013)

Extend ciphertext by one bit per oracle query to leak plaintext via parity. Manipulate BBS squaring sequence to produce valid extended ciphertexts. See modern-ciphers.md.

Hash Length Extension Attack

Exploits Merkle-Damgard hashes (hash(SECRET || user_data)) — append arbitrary data and compute valid hash without knowing the secret. Use hashpump or hashpumpy. See modern-ciphers.md.

Compression Oracle (CRIME-Style)

Compression before encryption leaks plaintext via ciphertext length changes. Send chosen plaintexts; matching n-grams compress shorter. Same class as CRIME/BREACH. See modern-ciphers.md.

RC4 Second-Byte Bias

RC4's second output byte is biased toward 0x00 (probability 1/128 vs 1/256). Distinguishes RC4 from random with ~2048 samples. See stream-ciphers.md.

RSA Multiplicative Homomorphism Signature Forgery

Unpadded RSA: S(a) * S(b) mod n = S(a*b) mod n. If oracle blacklists target message, sign its factors and multiply. See rsa-attacks.md.

Common Patterns

RSA basics: phi = (p-1)*(q-1), d = inverse(e, phi), m = pow(c, d, n). See rsa-attacks.md for full examples.
XOR: from pwn import xor; xor(ct, key). See classic-ciphers.md for XOR variants.

C srand/rand Prediction via ctypes (L3akCTF 2024, MireaCTF)

Pattern: Binary uses srand(time(NULL)) + rand() for keys/XOR masks. Python's random module uses a different PRNG. Use ctypes.CDLL('./libc.so.6') to call C's srand(int(time())) and rand() directly, reproducing the exact sequence. See prng.md for XOR decryption examples and timing tips.

V8 XorShift128+ (Math.random) State Recovery

Pattern: V8 JavaScript engine uses xs128p PRNG for Math.random(). Given 5-10 consecutive outputs of Math.floor(CONST * Math.random()), recover internal state (state0, state1) with Z3 QF_BV solver and predict future values. Values must be reversed (LIFO cache). Tool: d0nutptr/v8_rand_buster. See prng.md.

MT State Recovery from Float Outputs (PHD CTF Quals 2012)

Pattern: Server exposes random.random() floats. Standard untemper needs 624 × 32-bit integers, but floats yield only ~8 usable bits each. A precomputed GF(2) magic matrix (not_random library) recovers the full MT state from 3360+ float observations. Use to predict password reset tokens, session IDs, or CSRF tokens derived from random.random(). See prng.md.

Chaotic PRNG (Logistic Map)

Logistic map: x = r * x * (1 - x), r ≈ 3.99-4.0; seed recovery by brute-forcing high-precision decimals
Keystream: struct.pack("<f", x) per iteration; XOR with ciphertext

See prng.md for full code.

Useful Tools

Python: pip install pycryptodome z3-solver sympy gmpy2
SageMath: sage -python script.py (required for ECC, Coppersmith, lattice attacks)
RsaCtfTool: python RsaCtfTool.py -n <n> -e <e> --uncipher <c> — automated RSA attack suite (tries Wiener, Hastad, Fermat, Pollard, and many more)
quipqiup.com: Automated substitution cipher solver (frequency + word pattern analysis)

Weekly Installs

579

Repository

ljagiello/ctf-skills

GitHub Stars

664

First Seen

Feb 1, 2026

Security Audits

Gen Agent Trust HubPass SocketWarn SnykPass

Installed on

codex567

opencode564

github-copilot552

gemini-cli550

amp550

kimi-cli549

Docker专家技能：容器优化、安全加固、多阶段构建与生产部署最佳实践

8,800 周安装

Grid permutation cipher:

Image-based Caesar shift: Pixel rows/columns shifted by per-strip offsets; compare original vs shifted image to extract ASCII-encoded flag from shift amounts. See classic-ciphers.md.

Weak key derivation (public key hash XOR): AES key derived from SHA256(public_key) XOR seed is fully recoverable without private key; "hybrid" RSA+AES provides no security. See modern-ciphers.md.

Polynomial CRT in GF(2)[x]: Collect ~20 remainders r = flag mod f, filter coprime, CRT combine

Affine over composite modulus: CRT in each prime factor field; Gauss-Jordan per prime

RSA p=q validation bypass: Set p=q so server computes wrong phi=(p-1)^2 instead of p*(p-1); test decryption fails, leaking ciphertext

RSA cube root CRT (gcd(e,phi) >1): When all primes ≡ 1 mod e, compute eth roots per-prime via nthroot_mod, enumerate CRT combinations (3^k feasible for small k)

Factoring from phi(n) multiple: Any multiple of phi(n) (e.g., e*d-1) enables factoring via Miller-Rabin square root technique; succeeds with prob ≥ 1/2 per attempt

Weak keygen via base representation: Primes p = kp*B + tp with small kp create mixed-radix structure in n; brute-force kp*kq (2^24) to factor

RSA with gcd(e,phi) >1 (exponent reduction): Reduce e' = e/g, compute d' = e'^(-1) mod phi, partial decrypt to m^g, then take g-th root over integers

Braid group DH: Alexander polynomial is multiplicative under braid concatenation — Eve computes shared secret from public keys. See exotic-crypto.md

Ed25519 torsion side channel: Cofactor h=8 leaks secret scalar bits when key derivation uses key = master * uid mod l; query powers of 2, check y-coordinate consistency

Tropical semiring residuation: Tropical (min-plus) DH is broken — residual b* = max(Mb[i] - M[i][j]) recovers shared secret directly from public matrices

FPE Feistel brute-force: Format-preserving encryption with 16-bit round key is brute-forceable; remaining affine GF(2) mixing layer solved via Gaussian elimination. See exotic-crypto.md

Icosahedral symmetry cipher: Dodecahedron face permutations form order-120 group; build lookup table of all permutations via API probing, match visible face patterns. See exotic-crypto.md

Goldwasser-Micali replication oracle: GM encrypts one bit per ciphertext; replaying a single ciphertext value N times as an N-bit key forces all-zero or all-one key, distinguishable via hash oracle. 128 queries recover full AES key. See exotic-crypto.md