$ cat writeup.md…
$ cat writeup.md…
gpnctf
Task: custom NTRU-like cryptosystem over the dihedral group ring Z[D_N]; server prints public key h and ciphertext c, asks for the ternary message. Solution: ciphertext c[i] = 3*t[i] + msg[i] is printed without reducing mod q, so msg[i] = c[i] mod 3 leaks the entire plaintext — no lattice, no private key.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
You can't eat the entire time, so why not gamble a bit?
A remote SSL service (ncat --ssl <host> 443) implements a custom NTRU-like
cryptosystem and challenges you to recover a hidden ternary "fortune wheel"
message within a 60-second SIGALRM window. The server prints the public key
h and a ciphertext c, then asks for the message encoded as a string over
{A, C, B}. Get it right → flag.
Provided files: fortune2.py (service) and fortuneUtils2.py (crypto classes).
The scheme is a faithful NTRU port, but instead of the usual cyclic polynomial
ring Z[x]/(x^N - 1) it operates over the group ring (group algebra) of the
dihedral group, Z[D_N].
FortuneWheel — an element of D_N. The base elements are N rotations
r^0 … r^{N-1} (labels are cyclic shifts of [0..N-1]) and N reflections
s·r^k (mirrored labels). __mul__ composes the underlying permutations,
i.e. it is group multiplication in D_N.FortuneForest — an element of Z[D_N]. to_vector() returns a length
2N coefficient vector: the first N entries are coefficients on the
rotation wheels, the next N are coefficients on the reflection wheels. It
supports +, * (group-algebra convolution), % q (coefficient reduction),
rescale(s) (scalar multiply of all coefficients), and inv(mod) — a
group-ring inverse computed via the regular representation: it builds the
2N × 2N block matrix [[M1, M0], [M0, M1]] and inverts it modulo the given
modulus.Parameters: N=100, p=3, d=floor(N/3)=33,
q=2^floor(log2((6d+1)*p))=2^9=512.
...
$ grep --similar