Rating:
# C2: Flipping Bits
**Author:** Kaushik S Kalmady, Swathi S Bhat
```
ct1: 13981765388145083997703333682243956434148306954774120760845671024723583618341148528952063316653588928138430524040717841543528568326674293677228449651281422762216853098529425814740156575513620513245005576508982103360592761380293006244528169193632346512170599896471850340765607466109228426538780591853882736654
ct2: 79459949016924442856959059325390894723232586275925931898929445938338123216278271333902062872565058205136627757713051954083968874644581902371182266588247653857616029881453100387797111559677392017415298580136496204898016797180386402171968931958365160589774450964944023720256848731202333789801071962338635072065
e1: 13
e2: 15
modulus: 103109065902334620226101162008793963504256027939117020091876799039690801944735604259018655534860183205031069083254290258577291605287053538752280231959857465853228851714786887294961873006234153079187216285516823832102424110934062954272346111907571393964363630079343598511602013316604641904852018969178919051627
You have two captured ciphertexts. The public key is (e1, n). But,
due to a transient bit flip, the second ciphertext was encrypted with a faulty
public key: (e2, n). Recover the plaintexts.
(The algorithm is RSA.)
```
This one was fun and easy challenge. @SwathiSBhat found this [post](https://crypto.stackexchange.com/questions/54286/consequences-of-flipping-a-bit-in-an-rsa-public-key) which explains the solution.
Here is the decryption script. (Check out [rsasim](https://github.com/kaushiksk/rsasim) :p)
```python
from rsasim.gcd_utils import inverse
from Crypto.Util.number import long_to_bytes
n = 103109065902334620226101162008793963504256027939117020091876799039690801944735604259018655534860183205031069083254290258577291605287053538752280231959857465853228851714786887294961873006234153079187216285516823832102424110934062954272346111907571393964363630079343598511602013316604641904852018969178919051627
m13 = 13981765388145083997703333682243956434148306954774120760845671024723583618341148528952063316653588928138430524040717841543528568326674293677228449651281422762216853098529425814740156575513620513245005576508982103360592761380293006244528169193632346512170599896471850340765607466109228426538780591853882736654
m15 = 79459949016924442856959059325390894723232586275925931898929445938338123216278271333902062872565058205136627757713051954083968874644581902371182266588247653857616029881453100387797111559677392017415298580136496204898016797180386402171968931958365160589774450964944023720256848731202333789801071962338635072065
m2 = (m15 * inverse(m13, n)) % n
m11 = (m13 * inverse(m2, n)) % n
m4 = (m15 * inverse(m11, n)) % n
m9 = (m13 * inverse(m4, n)) % n
m5 = (m9 * inverse(m4, n)) % n
m = (m5 * inverse(m4, n)) % n
print long_to_bytes(m)
```
## Flag
> flag-54d3db5c1efcd7afa579c37bcb560ae
