Bespoke Padding

cryptohack

Task: an interactive RSA service encrypts the same flag m under the same modulus N with e=11, each time applying a known linear padding a*m+b (a,b disclosed) so c=(a*m+b)^11 mod N. Solution: Franklin–Reiter related-message attack — for two queries form g_i(x)=(a_i*x+b_i)^11 - c_i over Z_N[x]; their polynomial GCD modulo N collapses to the linear factor (x - m), revealing the flag directly. Affine padding provides no protection against related-message attacks.