Tags: cryptography blockcipher polynomial algebraic s-box crypto feistel ddt 

Rating: 0

Here we have a block-cipher in ternary: operating on trits in GF(3) grouped into 135-trit branches treated as elements of GF(3^135). The structure is a short 6-round Feistel Network with squaring as the Feistel function:

```python
left, right = SuperEncrypt.f(block), SuperEncrypt.f(message_hash)
for k in self.keys: # 6 rounds
right += (k + left) ^ 2
left, right = right, left
```

The goal is to recover the master key. This can be done by recovering the 6 round subkeys, and then using the key schedule to recover the master key from them, which is the more involved part.

Original writeup (https://affine.group/writeup/2023-07-CorCTF-Superbox).