后来拿到的 wuzi-bianzhu(1).zip 文件哈希和原 ZIP 不同，乍看确实像是重新生成了一份题目。但逐字节比较后，只有 4 个字节不同：
Crypto
Spring Hints-HHB2026
题目给了一个py和json文件，可以看出是一个小参数的LWE，这题的核心解题逻辑是：1. 由 b = As + e mod q 得到整数关系然后用格把“短误差 + 小 secret”编码进去，2.LLL 找短向量恢复 s，3.通过 SHA256(\"Spring Hints::\" + s) 还原 AES key，最后解出flag
其中b 是 centered 表示，所以可以把模方程写成整数方程，这是一个关键
还有\langle a\_i, s \rangle + e\_i - b\_i = q k\_i其中 k_i 是整数推到可得qk\_i - \langle a\_i, s \rangle + b\_i = e\_i 然后就是构造一个维度为 m + n + 1 = 161 的格了。
取如下基：
按“行向量”方式实现：
前 m 行是 q 倍标准基
接着 n 行把 -A 的列塞进去，并在 secret 对应位置放 1
最后一行放 b 和最后一维的 1
如果取系数：
那么线性组合得到：
由于 e 很小、s 也很小，这个向量就会非常短，也就是说，LLL 找到的短向量里就藏着 secret。最后就可以写脚本来实现了
exp：
import json, hashlib, sympy as sp
from Crypto.Cipher import AES
d = json.load(open(\"output.json\", encoding=\"utf-8\"))
A, b, q = d[\"A\"], d[\"b\"], d[\"params\"][\"q\"]
m, n = len(A), len(A[0])
rows = [[q if i == j else 0 for j in range(m + n + 1)] for i in range(m)]
for j in range(n):
row = [0] * (m + n + 1)
for i in range(m):
row[i] = -A[i][j]
row[m + j] = 1
rows.append(row)
rows.append([*b, *([0] * n), 1])
R = sp.Matrix(rows).lll()
s = next(r[m:m+n] for r in map(list, R.tolist()) if abs(r[-1]) == 1 and all(x in (-1, 0, 1) for x in r[m:m+n]))
if s[-1] == -1: s = [-x for x in s]
key = hashlib.sha256(b\"Spring Hints::\" + \",\".join(map(str, s)).encode()).digest()
print(AES.new(key, AES.MODE_GCM, nonce=bytes.fromhex(d[\"nonce\"])).decrypt_and_verify(bytes.fromhex(d[\"ciphertext\"]), bytes.fromhex(d[\"tag\"])).decode())
# flag{b0846b35-d1b9-4ead-ad91-2ed7f1356914}
使用 t = A\*s + e 筛选 多项式乘法是在 x^64 + 1 下的负循环卷积，高次项折返时需要取负号：
def negacyclic_mul(a, b):
result = [0] * N
for i, x in enumerate(a):
for j, y in enumerate(b):
degree = i + j
if degree < N:
result[degree] += x * y
else:
result[degree - N] -= x * y
return [x % Q for x in result]
flag = AESGCM(key).decrypt(
bytes.fromhex(data[\"nonce\"]),
bytes.fromhex(data[\"ciphertext\"] + data[\"tag\"]),
None,
)
exp：
import itertools, json, runpy
from hashlib import sha256
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
d = runpy.run_path(str(Path(__file__).with_name(\"chall.py\")))
q, n, k, eta = d[\"Q\"], d[\"N\"], d[\"K\"], d[\"ETA\"]
def center(x):
x %= q
return x - q if x > q // 2 else x
def comp(x, bits):
return ((x % q) * (1 << bits) + q // 2) // q % (1 << bits)
def mul(a, b):
r = [0] * n
for i, x in enumerate(a):
for j, y in enumerate(b):
z = i + j
r[z % n] += (-1 if z >= n else 1) * x * y
return [x % q for x in r]
diff = {comp(d[\"TRACE_BIAS\"] + d[\"TRACE_SCALE\"] * x, d[\"D\"]): x
for x in range(-2 * eta, 2 * eta + 1)}
g = [[] for _ in range(k * n)]
for row, value in zip(d[\"trace_rows\"], d[\"trace\"]):
x = next(i for i, w in row if w == d[\"TRACE_SCALE\"])
y = next(i for i, w in row if w == -d[\"TRACE_SCALE\"])
z = diff[value]
g[y].append((x, z))
g[x].append((y, -z))
rel, groups, choices = {}, [], []
for root in range(k * n):
if root in rel:
continue
rel[root], stack, group = 0, [root], []
while stack:
u = stack.pop()
group.append(u)
for v, z in g[u]:
if v not in rel:
rel[v] = rel[u] + z
stack.append(v)
groups.append(group)
choices.append(range(
max(-eta - rel[i] for i in group),
min(eta - rel[i] for i in group) + 1,
))
def make(offsets):
s = [0] * (k * n)
for group, offset in zip(groups, offsets):
for i in group:
s[i] = rel[i] + offset
return [s[i * n:(i + 1) * n] for i in range(k)]
def valid(s):
for i in range(k):
p = [0] * n
for j in range(k):
z = mul(d[\"A\"][i][j], s[j])
p = [(x + y) % q for x, y in zip(p, z)]
if any(abs(center(a - b)) > eta
for a, b in zip(d[\"t\"][i], p)):
return False
return True
secret = next(make(x) for x in itertools.product(*choices)
if valid(make(x)))
w = d[\"v\"][:]
for s, u in zip(secret, d[\"u\"]):
z = mul(s, u)
w = [(a - b) % q for a, b in zip(w, z)]
payload = bytes(
sum(comp(x, 1) << j for j, x in enumerate(w[i:i + 8]))
for i in range(0, n, 8)
)
encap = json.dumps([d[\"u\"], d[\"v\"]], separators=(\",\", \":\")).encode()
key = sha256(payload + sha256(encap).digest()).digest()
ct = bytes.fromhex(d[\"ciphertext\"] + d[\"tag\"])
print(AESGCM(key).decrypt(bytes.fromhex(d[\"nonce\"]), ct, None).decode())
# flag{8d5f7c7e-2b66-42de-a3c0-91b6b0c450d5}
总结 本题的攻击链为：
Trace 差值
-> 连通图恢复相对秘密系数
-> 枚举 32 个分量偏移
-> 使用 t = A*s + e 筛选唯一 secret
-> 使用 w = v - s^T*u 恢复 payload
-> SHA256 KDF
-> AES-GCM
-> flag
![cover_image](/d/file/p/2026/10-17/63aaa8b5b678a17219916470cce26ee0.png\")gray = cv2.cvtColor(image, cv2.COLOR_BGR2GRAY)binary = cv2.threshold( gray, 70, 255, cv2.THRESH_BINARY_INV)[1]cleaned = cv2.morphologyEx( binary, cv2.MORPH_OPEN, cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (2, 2)),)cleaned = cv2.morphologyEx( cleaned, cv2.MORPH_CLOSE, cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (3, 3)),)
</code></pre></div>
<div class=)
![](/d/file/p/2026/10-17/a59144e38b75756eb31f6fb8d5185e00.png\").write_bytes(png_data)
</code></pre></div>
<p>还原结果：</p>
<div class=)
![](/d/file/p/2026/10-17/5c071570095fca02573589a6f44fd139.png\")
</code></pre></div>
<p>还原出的原始二维码如下，手机相机也可以直接扫：</p>
<p><img alt=)
Crypto
评论