After setting all unknown bytes of FLAG at Y number to\ x00, I tried to find the solution of ^3-c = 0 mod N when the value converted to an integer is m' (m'+x). However, if I use SageMath's small_roots function shown in the hint, it says that there is no harm, so is there any other processing needed?

I've solved A and B, but I don't know how to find p and q from the C problem. I've looked for several prime factorization algorithms, but they all took a few hours to complete.. is it correct to solve it by finding p or q? Or is there another solution method?

from Crypto.Util.number import * from Crypto.Random import get_random_bytes FLAG = b"ZH{" + get_random_bytes(218) + b'}' print(long_to_bytes((bytes_to_long(FLAG + b" is secret") >> 80) + (b

I did a search for Franklin-Reiter Related Message Attack listed in the hint. In the data I found, it was explained that it is often used when a linear relationship of $M_1 and M_2$ is given, or when the public key $e = 3$. However, this problem is that $e$ is a very large prime number of $12323$ and at the same time a linear relationship between $M_1 and M_2$ (

Y번 문제에 풀 때 RSA Cube Root Attack을 이용하는 거 맞나요? e = 3이여서 Cube Root Attack 할 수 있을 거 같은데,,, message = [b"While hiking in the Blue Mountains, I discovered '" ; FLAG ; b"' carved into a rock. Pondering