CTF学习/crypto/滑动攻击/相关密钥/不可能差分/AES缓存时序
又 E_A(F_i) = L(F_i) XOR t_A,其中 t_A = E_A(0),所以 L(F_i) = E_A(F_i) XOR E_A(0)。针对轮函数完全相同的迭代分组密码,寻找"滑动对" (P, F(P)),满足 E(F(P)) = F(E(P))(E = F^r)。print("s[x]==0x2a*x^0x2a(前32项):", all(sbox[x] == (gmul(0x2a, x) ^ 0x2a) for x in range(32)))需要本地目标机与精确计时。
nocti10162026-10-27 14:31:10