RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.
An RSA cryptanalysis playbook aimed at CTF challenges and authorized security assessments, for when you are given RSA parameters (typically n, e, c) and need to recover plaintext or private keys by exploiting weak parameter choices. It opens with a quick attack-selection table that maps observable conditions to the correct technique and tool, for example small n to direct factorization (factordb, yafu, msieve), e=3 with a small message to a cube root, multiple ciphertexts under the same small e to a Hastad broadcast attack, and very small d to Wiener or Boneh-Durfee. This selection guidance addresses a common failure where attacks are attempted that do not match the given parameters.
Coverage spans factorization attacks (direct factoring, Fermat's method when p and q are close, Pollard's p-1 for B-smooth p-1, and batch GCD to find shared factors across many moduli), small-exponent attacks (cube-root, Hastad broadcast via CRT, and Franklin-Reiter related-message), large-e/small-d attacks (Wiener's continued-fraction method and lattice-based Boneh-Durfee), Coppersmith's method for stereotyped messages and partial key exposure, the common-modulus attack via extended GCD, and oracle attacks (LSB/parity oracle and Bleichenbacher PKCS#1 v1.5 padding oracle). Many techniques include ready Python or SageMath snippets using libraries such as gmpy2, sympy, and SageMath polynomial rings.
Use it to diagnose which weakness applies to a given key and to execute the matching recovery. It routes to companion skills for deeper lattice theory (lattice-crypto-attacks), hash-based signature forgery (hash-attack-techniques), and hybrid encryption where RSA protects a symmetric key (symmetric-cipher-attacks), and references an advanced RSA_ATTACK_CATALOG.md with detailed implementations, mathematical derivations, and per-attack failure conditions. The framing is practical and diagnostic: read what is known about the parameters, pick the attack the evidence supports, and apply the corresponding script.
When you have RSA parameters such as n, e, and c and need to recover plaintext or a private key by exploiting weak keys, small exponents, shared factors, or padding oracles in CTF or authorized assessments.
A quick attack-selection table maps observable conditions (small n, e=3, repeated small e, very small d, partial p knowledge, shared factors, padding oracle) to the recommended attack and tool.
The Hastad broadcast attack, which combines the ciphertexts with CRT and then takes the e-th root.
Wiener's attack (continued fractions, when d is below about n^(1/4)/3) and the lattice-based Boneh-Durfee attack, which extends to d below about n^0.292.
External factoring tools like factordb, yafu, and msieve, plus Python and SageMath code using gmpy2, sympy, and SageMath polynomial rings for methods like Coppersmith and Franklin-Reiter.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills