Static Client 2

cryptohack

Task: interactive DH (socket.cryptohack.org 13378) where Bob keeps a STATIC private exponent b, rejects suspicious g/A, but still computes B'=g^b mod whatever prime p the client sends. Solution: send a ~1605-bit prime whose p-1 = 2 * product of distinct small primes (<2^24, fully smooth) with g=2; Bob returns B'=g^b mod p, and Pohlig-Hellman + BSGS over each small subgroup recovers b mod (p-1) in one query; since b < p_real < p-1 this is the EXACT static b, so shared_real = A_alice^b mod p_real (RFC3526 1536-bit prime) AES-CBC decrypts the eavesdropped flag.