LinearCasino The challenge requires us to distinguish between $A * B_0 * C$ and $A * B_1 * C$, where $A \in \mathbb{F}_2^{110 \times 110}$, $D_1 \in \mathbb{F}_2^{60 \times 100}$, $D_2 \in \mathbb{F}_2^{50 \times 100}$, $B_0$ is a random matrix in $\mathbb{F}_2^{110 \times 200}$ and $C$ is a permutation matrix. $$ \displaylines{ \begin{align} B_1 = \left( \begin{array}{cc} D_1 & D_1 \ 0 & D_2 \end{array}

CRYPTO kleinvieh We are given strange = phi^2 = (pq - p - q + 1)^2 = (p + q - 1)^2 (mod n). As the difference between (p + q - 1)^2 and strange is small multiples of n, we can bruteforce the difference to recover (p + q - 1)^2 and square root, then calculate phi to recover the flag. from math import isqrt from Crypto.Util.number import long_to_bytes n = 123478096241280364670962652250405187135677205589718111459493149962577739081187795982860395854714430939628907753414209475535232237859888263943995193440085650470423977781096613357495769010922395819095023507620908240797541546863744965624796522452543464875196533943396427785995290939050936636955447563027745679377 c = 77628487658893896220661847757290784292662262378387512724956478473883885554341297046249919230536341773341256727418777179462763043017367869438255024390966651705078565690271228162236626313519640870358976726577499711921457546321449494612008358074930154972571393221926233201707908214569445622263631145131680881658 strange = 11519395324733889428998199861620021305356608571856051121451410451257032517261285528888324473164306329355782680120640320262135517302025844260832350017955127625053351256653287330703220294568460211384842833586028123185201232184080106340230097212868897257794101622865852490355812546172336607114197297201223620901