WOTS Up

cryptohack

Task: forge a Winternitz one-time signature (WOTS) for b'Sign for flag' given only one published signature for a different message, then use the forged signature's first bytes as an AES-CBC key to decrypt the flag. Solution: WOTS chains are one-way (hash forward only), so a second signature is normally impossible where target digest bytes are smaller; but this keygen LINKS the 32 private keys into a single hash chain (priv_key[i+1]=hash(priv_key[i])), so a known later signature element reveals earlier private values. For each index, find a known sig1[j] (j>=i) whose chain level relative to priv_key[i] is <= the needed target level, then hash it forward to reach the required position; the forged first bytes give the AES key.