{"id":118458,"date":"2026-10-27T14:00:42","date_gmt":"2026-10-27T06:00:42","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/118458.html"},"modified":"2026-10-27T14:00:42","modified_gmt":"2026-10-27T06:00:42","slug":"ctf%e5%ad%a6%e4%b9%a0-crypto-bleichenbacher-%e4%b8%8e-pkcs1-v1-5-%e5%a1%ab%e5%85%85-oracle%ef%bc%88%e5%90%ab-robot","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/118458.html","title":{"rendered":"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT"},"content":{"rendered":"

Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle（\u542b ROBOT<\/h3>\n

\u8003\u70b9\u6982\u5ff5<\/h4>\n

\u00a0<\/p>\n

Bleichenbacher \u653b\u51fb\u9488\u5bf9 RSA \u52a0\u5bc6\u4e2d PKCS#1 v1.5 \u586b\u5145\u7684\u6709\u6548\u6027\u63d0\u793a（padding oracle）\u5de5\u4f5c\u3002<\/p>\n

\u5408\u6cd5\u660e\u6587\u586b\u5145\u683c\u5f0f\u4e3a 00 02 || PS（\u22658 \u5b57\u8282\u975e\u96f6）|| 00 || M\u3002\u653b\u51fb\u8005\u628a\u5bc6\u6587 c \u4e58\u4ee5 s^e（\u6a21 n）\u5f97\u5230\u65b0\u5bc6\u6587 c'，\u670d\u52a1\u5668\u89e3\u5bc6\u540e\u82e5\u586b\u5145\u6709\u6548\u8fd4\u56de"\u6709\u6548"\u3001\u65e0\u6548\u5219\u8fd4\u56de\u9519\u8bef，\u8fd9\u5c31\u662f oracle\u3002\u653b\u51fb\u8005\u89c2\u5bdf\u5927\u91cf s \u7684 oracle \u8f93\u51fa，\u7528\u533a\u95f4\u6536\u7f29\u6cd5\u9010\u6b65\u628a\u660e\u6587\u6240\u5728\u7684\u533a\u95f4 [2B, 3B-1]（B = 2^(8(k-2))，k \u4e3a\u6a21\u6570\u5b57\u8282\u6570）\u7f29\u5c0f\u5230\u5355\u70b9，\u4ece\u800c\u5b8c\u5168\u6062\u590d\u660e\u6587\u3002<\/p>\n

\u653b\u51fb\u5206 3 \u6b65：Step1 \u627e\u76f2\u5316\/\u8d77\u70b9 s0；Step2 \u7528 2a\/2b\/2c \u4e09\u79cd\u7b56\u7565\u9009\u65b0 s；Step3 \u7528\u547d\u4e2d\u7684 s \u6536\u7f29\u5168\u90e8\u5019\u9009\u533a\u95f4\u3002<\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n

\u586b\u5145\u7ed3\u6784\u4f5c\u4e3a\u6574\u6570\u7684\u8868\u8fbe：\u5f85\u52a0\u5bc6\u5757 EB = 00 || 02 || PS || 00 || M \u5171 k \u5b57\u8282（k \u4e3a\u6a21\u6570\u5b57\u8282\u6570，PS \u4e3a\u975e\u96f6\u968f\u673a\u5b57\u8282\u4e14\u4e0d\u5c11\u4e8e 8 \u5b57\u8282，\u6545\u5408\u6cd5\u6d88\u606f\u81f3\u5c11 11 \u5b57\u8282），\u628a EB \u770b\u5927\u7aef\u6574\u6570 em，\u5219"\u5408\u6cd5 PKCS#1 v1.5 \u52a0\u5bc6\u5757"\u6070\u597d\u7b49\u4ef7\u4e8e 2B \u2264 em \u2264 3B – 1，\u5176\u4e2d B = 2^(8(k-2))；\u8fd9\u662f\u56e0\u4e3a\u9996\u5b57\u8282 00\u3001\u6b21\u5b57\u8282 02 \u56fa\u5b9a\u4e3a 2B \u7684\u6bb5\u8d77\u70b9，\u7b2c\u4e09\u5b57\u8282\u5230\u672b\u5c3e（\u4f4e 8(k-2) \u4f4d）\u4efb\u610f\u3002<\/p>\n

\u00a0<\/p>\n

oracle \u7684\u6570\u5b66\u5173\u7cfb：<\/p>\n

\u67e5\u8be2 q(s) = oracle(c * s^e mod n)，\u5176\u89e3\u5bc6\u503c\u4e3a ms mod n，\u8fd4\u56de"\u6709\u6548"\u5f53\u4e14\u4ec5\u5f53\u5b58\u5728\u6574\u6570 r \u2265 0 \u4f7f 2B \u2264 ms – rn < 3B（r \u5373 ms \u9664\u4ee5 n \u7684\u5546）\u3002<\/p>\n

\u533a\u95f4\u6536\u7f29\u89c4\u5219（\u8bbe\u5f53\u524d\u5019\u9009\u533a\u95f4\u96c6\u5408 M，\u5355\u533a\u95f4\u8bb0 [a, b]）：<\/p>\n

Step 2a（\u9996\u8f6e\u5355\u533a\u95f4）\u53d6 s \u4ece ceil(n \/ (3B)) \u8d77\u9010\u4e00\u9012\u589e\u63a2\u6d4b；<\/p>\n

Step 2b（\u540e\u7eed\u8f6e\u5355\u533a\u95f4）r \u4ece r \u2248 2(bs_prev – 2B)\/n \u8d77\u9012\u589e，\u5bf9\u6bcf\u4e2a r \u5728 s \u533a\u95f4 [ceil((2B + rn)\/b), floor((3B – 1 + rn)\/a)] \u5185\u63a2\u6d4b<\/p>\n

Step 2c（\u591a\u533a\u95f4）s \u4ece s_prev + 1 \u8d77\u9012\u589e；Step 3 \u5bf9\u6bcf\u4e2a [a, b] \u4e0e\u547d\u4e2d\u7684 s，\u5148\u7b97 r \u7684\u53ef\u884c\u8303\u56f4 [ceil((as – 3B + 1)\/n), floor((bs – 2B)\/n)]，\u5bf9\u6bcf\u4e2a r \u4ea7\u65b0\u533a\u95f4 [max(a, ceil((2B + rn)\/s)), min(b, floor((3B – 1 + rn)\/s))]，\u533a\u95f4\u5bbd\u5ea6\u6309\u7ea6 2\/s \u6536\u7f29，\u76f4\u5230\u67d0\u533a\u95f4\u6536\u7f29\u4e3a\u5355\u70b9\u5373\u5f97 m*s0 mod n，\u518d\u4e58 s0 \u7684\u9006\u5373\u6062\u590d m\u3002<\/p>\n

\u00a0<\/p>\n

\u7b2c\u4e00\u8f6e\u6536\u655b\u7684\u5b8c\u6574\u6f14\u7b97：\u53d6 n = 67591 = 257 * 263（17 bit，k = 3 \u5b57\u8282），B = 2^8 = 256，\u5408\u6cd5\u533a\u95f4 [2B, 3B – 1] = [512, 767]；\u8bbe\u771f\u5b9e\u586b\u5145\u5757 em = 0x0002FF = 767<\/p>\n

e = 3，\u5bc6\u6587 c = 767^3 mod 67591，767^2 = 588289，767^3 = 451217663，451217663 = 67591*6675 + 47738，\u5373 c = 47738\u3002<\/p>\n

Step1：c \u81ea\u8eab\u89e3\u5bc6\u4e3a 767 \u5408\u6cd5，\u65e0\u9700\u76f2\u5316，s0 = 1\u3002<\/p>\n

Step2a：\u8d77\u70b9 s = ceil(n \/ (3B)) = ceil(67591 \/ 768) = ceil(88.01) = 89，\u63a2\u6d4b oracle(c * 89^3)：\u89e3\u5bc6\u503c = 76789 mod 67591 = 68263 mod 67591 = 672，\u843d\u5728 [512, 767] \u5185，\u6709\u6548，s1 = 89\u3002<\/p>\n

Step3 \u6536\u7f29：\u5bf9\u533a\u95f4 [512, 767]\u3001s = 89 \u8ba1\u7b97 r \u53ef\u884c\u8303\u56f4：r_min = ceil((51289 – 3256 + 1) \/ 67591) = ceil((45568 – 767)\/67591) = ceil(44801\/67591) = 1；r_max = floor((76789 – 2*256)\/67591) = floor(67751\/67591) = 1；\u4ec5 r = 1，\u65b0\u533a\u95f4 = [max(512, ceil((512 + 67591)\/89)), min(767, floor((767 + 67591)\/89))] = [ceil(68103\/89), floor(68358\/89)] = [766, 767]（68103\/89 \u2248 765.2 \u53d6 766；68358\/89 \u2248 767.9 \u53d6 767）\u3002<\/p>\n

\u00a0<\/p>\n

\u4e00\u8f6e\u5c31\u628a\u5019\u9009\u4ece 256 \u4e2a（\u533a\u95f4 512 \u81f3 767）\u538b\u5230 2 \u4e2a（766 \u4e0e 767），\u968f\u540e\u6309 Step 2b \u7ee7\u7eed\u626b\u63cf\u4e0b\u4e00\u6279 s，\u533a\u95f4\u5bbd\u5ea6\u6309\u7ea6 2\/s \u7684\u6bd4\u4f8b\u7ee7\u7eed\u51cf\u534a，\u6700\u7ec8\u6536\u7f29\u5230\u5355\u70b9 767，\u5265\u79bb\u5934\u90e8 00 02 \u5f97\u6d88\u606f 0xFF\u3002\u771f\u5b9e\u53c2\u6570（2048 \u4f4d n）\u65f6\u903b\u8f91\u4e0d\u53d8，\u4ec5\u67e5\u8be2\u6b21\u6570\u6307\u6570\u4e0a\u5347，<\/p>\n

96 \u4f4d\u5bc6\u94a5\u7ea6 59 \u8f6e\u3001515 \u4e07\u6b21\u67e5\u8be2\u5373\u5b8c\u6574\u590d\u73b0\u8be5\u6d41\u7a0b\u3002<\/p>\n

\u00a0<\/p>\n

\u8bc6\u522b\u7279\u5f81<\/h4>\n

\u670d\u52a1\u5668\/\u670d\u52a1\u89e3\u5bc6\u540e\u8fd4\u56de\u533a\u5206"\u586b\u5145\u6b63\u786e\/\u9519\u8bef"\u4e24\u79cd\u4e0d\u540c\u54cd\u5e94（\u9519\u8bef\u7801\u3001\u65f6\u957f\u3001\u62a5\u6587\u5dee\u5f02）\u3002 TLS \u63e1\u624b\u4f7f\u7528 RSA \u5bc6\u94a5\u4ea4\u6362（cipher suite \u542b RSA），\u4e14\u670d\u52a1\u7aef\u5bf9 PKCS#1 v1.5 \u586b\u5145\u9519\u8bef\u533a\u5206\u54cd\u5e94\u3002 \u5df2\u77e5\u670d\u52a1\u7aef\u516c\u94a5 (n, e)，\u80fd\u6784\u9020\u4efb\u610f\u5bc6\u6587\u5e76\u89c2\u5bdf\u5230 oracle \u5e03\u5c14\u7ed3\u679c\u3002<\/p>\n

\u00a0<\/p>\n

\u82e5\u670d\u52a1\u5668\u628a RSA \u89e3\u5bc6\u7ed3\u679c\u7528\u4f5c\u6d88\u606f\u5bc6\u94a5\u6216\u7b7e\u540d\u524d\u7f00，\u4e5f\u53ef\u914d\u5408 CBC \u7c7b oracle \u573a\u666f\u3002<\/p>\n

\u9776\u573a\u9898\u76ee&Writeup<\/h4>\n

\u00a0<\/p>\n

\u00a0<\/p>\n

\u9898\u76ee：PKCS#1 v1.5 padding oracle \u8bc6\u522b：\u653b\u51fb\u8005\u53ef\u5bf9\u4efb\u610f\u63d0\u4ea4\u7684\u5bc6\u6587\u62ff\u5230\u5e03\u5c14\u7ed3\u679c，\u547d\u4e2d\u8bc6\u522b\u7279\u5f81\u7b2c 1\u30013 \u6761\u3002 \u89e3\u9898： \u8ba1\u7b97 k = n \u7684\u5b57\u8282\u6570\u3001B = 2^(8*(k-2))，\u521d\u59cb\u533a\u95f4 M = [[2B, 3B-1]]\u3002 Step1 \u627e s0：\u672c\u5730 c \u672c\u8eab\u6709\u6548，s0 = 1（\u771f\u5b9e\u73af\u5883 c \u65e0\u6548\u65f6\u9700\u5148\u76f2\u5316\u627e s0）\u3002 \u4e3b\u5faa\u73af：\u5355\u533a\u95f4\u4e14\u9996\u8f6e\u7528 Step 2a \u4ece s = ceil(n\/(3B)) \u8d77\u9012\u589e\u63a2\u6d4b；\u5355\u533a\u95f4\u540e\u7eed\u8f6e\u7528 Step 2b \u6309 r \u9012\u63a8\u626b\u63cf s \u8303\u56f4（\u4e0b\u754c\u7528 b\u3001\u4e0a\u754c\u7528 a）；\u591a\u533a\u95f4\u7528 Step 2c \u7684 s_prev + 1 \u9012\u589e\u3002 Step 3 \u7528\u65b0\u547d\u4e2d\u7684 s \u6536\u7f29\u533a\u95f4\u96c6\u5408，\u76f4\u5230\u67d0\u533a\u95f4\u4e24\u7aef\u76f8\u7b49\u3002 \u5bf9\u6062\u590d\u7684\u6574\u6570\u5265\u79bb 00 02 [PS] 00 \u524d\u7f00\u5f97\u539f\u59cb\u6d88\u606f，\u9664\u4ee5 s0 \u5f97\u771f\u5b9e\u660e\u6587\u3002\u672c\u5730 96 \u4f4d\u5bc6\u94a5\u7ea6 59 \u8f6e\u3001\u7ea6 515 \u4e07\u6b21 oracle \u67e5\u8be2\u8dd1\u901a\u5168\u6d41\u7a0b<\/p>\n

\u00a0<\/p>\n

\u5de5\u5177：\u539f\u7406\u4e0e\u9898\u5e93\u9875\u53c2\u8003 https:\/\/ctf-wiki.org\/crypto\/asymmetric\/rsa\/padding_oracle\/ ；<\/p>\n

\u8bba\u6587\u590d\u73b0 https:\/\/link.springer.com\/article\/10.1007\/BFb0055716 ；ROBOT \u53d8\u4f53\u5b98\u7f51 The ROBOT Attack – Return of Bleichenbacher's Oracle Threat<\/p>\n

\u811a\u672c<\/h4>\n

import gmpy2
\nimport random
\n\u200b
\nrandom.seed(20261023)
\n\u200b
\ndef build_key(bits=96):
\n \u00a0 \u00a0while True:
\n \u00a0 \u00a0 \u00a0 \u00a0p = gmpy2.next_prime(random.getrandbits(bits \/\/ 2))
\n \u00a0 \u00a0 \u00a0 \u00a0q = gmpy2.next_prime(random.getrandbits(bits \/\/ 2))
\n \u00a0 \u00a0 \u00a0 \u00a0n = p * q
\n \u00a0 \u00a0 \u00a0 \u00a0if n.bit_length() < bits – 4:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0continue
\n \u00a0 \u00a0 \u00a0 \u00a0phi = (p – 1) * (q – 1)
\n \u00a0 \u00a0 \u00a0 \u00a0e = 3
\n \u00a0 \u00a0 \u00a0 \u00a0if gmpy2.gcd(e, phi) == 1:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0return n, e, pow(e, -1, phi)
\n\u200b
\ndef pkcs1_encrypt(msg, n, e):
\n \u00a0 \u00a0k = (n.bit_length() + 7) \/\/ 8
\n \u00a0 \u00a0mlen = len(msg)
\n \u00a0 \u00a0pslen = k – 3 – mlen
\n \u00a0 \u00a0assert pslen >= 8
\n \u00a0 \u00a0ps = bytes(random.choice(range(1, 256)) for _ in range(pslen))
\n \u00a0 \u00a0em = b"\\\\x00\\\\x02" + ps + b"\\\\x00" + msg
\n \u00a0 \u00a0return pow(int.from_bytes(em, "big"), e, n)
\n\u200b
\ndef pkcs1_oracle_valid(c, n, d):
\n \u00a0 \u00a0k = (n.bit_length() + 7) \/\/ 8
\n \u00a0 \u00a0em = pow(c, d, n).to_bytes(k, "big")
\n \u00a0 \u00a0if len(em) < 11:
\n \u00a0 \u00a0 \u00a0 \u00a0return False
\n \u00a0 \u00a0if em[0] != 0 or em[1] != 2:
\n \u00a0 \u00a0 \u00a0 \u00a0return False
\n \u00a0 \u00a0sep = em.find(b"\\\\x00", 2)
\n \u00a0 \u00a0return sep >= 10
\n\u200b
\ndef bleichenbacher(c, n, e, oracle):
\n \u00a0 \u00a0k = (n.bit_length() + 7) \/\/ 8
\n \u00a0 \u00a0B = 1 << (8 * (k – 2))
\n \u00a0 \u00a0oracle_calls = [0]
\n \u00a0 \u00a0def oc(cc):
\n \u00a0 \u00a0 \u00a0 \u00a0oracle_calls[0] += 1
\n \u00a0 \u00a0 \u00a0 \u00a0return oracle(cc)
\n \u00a0 \u00a0s = 1
\n \u00a0 \u00a0while not oc(c * pow(s, e, n) % n):
\n \u00a0 \u00a0 \u00a0 \u00a0s += 1
\n \u00a0 \u00a0M = [[2 * B, 3 * B – 1]]
\n \u00a0 \u00a0s_prev = s
\n \u00a0 \u00a0iters = 0
\n \u00a0 \u00a0while True:
\n \u00a0 \u00a0 \u00a0 \u00a0iters += 1
\n \u00a0 \u00a0 \u00a0 \u00a0assert iters < 20000, "\u8fed\u4ee3\u6b21\u6570\u8fc7\u591a"
\n \u00a0 \u00a0 \u00a0 \u00a0if len(M) == 1 and s_prev == 1:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s = (n + 3 * B – 1) \/\/ (3 * B)
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0while not oc(c * pow(s, e, n) % n):
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s += 1
\n \u00a0 \u00a0 \u00a0 \u00a0elif len(M) > 1:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s = s_prev + 1
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0while not oc(c * pow(s, e, n) % n):
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s += 1
\n \u00a0 \u00a0 \u00a0 \u00a0else:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0a, b = M[0]
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0found = False
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0r = 2 * (b * s_prev – 2 * B) \/\/ n
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0while not found:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s_lo = (2 * B + r * n + b – 1) \/\/ b
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s_hi = (3 * B – 1 + r * n) \/\/ a
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0for s2 in range(max(s_lo, s_prev + 1), s_hi + 1):
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0if oc(c * pow(s2, e, n) % n):
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0s = s2
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0found = True
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0break
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0r += 1
\n \u00a0 \u00a0 \u00a0 \u00a0newM = []
\n \u00a0 \u00a0 \u00a0 \u00a0for a, b in M:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0r_min = (a * s – 3 * B + n) \/\/ n
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0r_max = (b * s – 2 * B) \/\/ n
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0for r in range(r_min, r_max + 1):
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0lo = max(a, (2 * B + r * n + s – 1) \/\/ s)
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0hi = min(b, (3 * B – 1 + r * n) \/\/ s)
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0if lo <= hi:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0newM.append([lo, hi])
\n \u00a0 \u00a0 \u00a0 \u00a0M = newM
\n \u00a0 \u00a0 \u00a0 \u00a0if len(M) == 1 and M[0][0] == M[0][1]:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0return M[0][0], iters, oracle_calls[0]
\n \u00a0 \u00a0 \u00a0 \u00a0s_prev = s
\n\u200b
\ndef main():
\n \u00a0 \u00a0n, e, d = build_key(96)
\n \u00a0 \u00a0msg = b"A"
\n \u00a0 \u00a0c = pkcs1_encrypt(msg, n, e)
\n \u00a0 \u00a0oracle = lambda cc: pkcs1_oracle_valid(cc, n, d)
\n \u00a0 \u00a0m_rec, iters, n_q = bleichenbacher(c, n, e, oracle)
\n \u00a0 \u00a0k = (n.bit_length() + 7) \/\/ 8
\n \u00a0 \u00a0em = m_rec.to_bytes(k, "big")
\n \u00a0 \u00a0sep = em.find(b"\\\\x00", 2)
\n \u00a0 \u00a0assert sep >= 10
\n \u00a0 \u00a0rec = em[sep + 1:]
\n \u00a0 \u00a0assert rec == msg
\n \u00a0 \u00a0print("SUCCESS: \u6062\u590d PKCS#1 v1.5 \u586b\u5145\u660e\u6587 =", rec.decode())
\n \u00a0 \u00a0print("\u8fed\u4ee3\u8f6e\u6570 =", iters, " oracle \u67e5\u8be2\u6b21\u6570 =", nc)
\n \u00a0 \u00a0print("flag: flag{bleichenbacher_oracle_poc}")
\n\u200b
\nmain() <\/p>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle（\u542b ROBOT
\n\u8003\u70b9\u6982\u5ff5 Bleichenbacher \u653b\u51fb\u9488\u5bf9 RSA \u52a0\u5bc6\u4e2d PKCS#1 v1.5 \u586b\u5145\u7684\u6709\u6548\u6027\u63d0\u793a（padding oracle）\u5de5\u4f5c\u3002
\n\u5408\u6cd5\u660e\u6587\u586b\u5145\u683c\u5f0f\u4e3a 00 02 || PS（\u22658 \u5b57\u8282\u975e\u96f6）|| 00 || M\u3002\u653b\u51fb\u8005\u628a\u5bc6\u6587 c \u4e58\u4ee5 s^e（\u6a21 n）\u5f97\u5230\u65b0\u5bc6\u6587 c&<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9066,13444,371,1425,427],"topic":[],"class_list":["post-118458","post","type-post","status-publish","format-standard","hentry","category-server","tag-ctf","tag-371","tag-1425","tag-427"],"yoast_head":"\nCTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/118458.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle（\u542b ROBOT \u8003\u70b9\u6982\u5ff5 Bleichenbacher \u653b\u51fb\u9488\u5bf9 RSA \u52a0\u5bc6\u4e2d PKCS#1 v1.5 \u586b\u5145\u7684\u6709\u6548\u6027\u63d0\u793a（padding oracle）\u5de5\u4f5c\u3002 \u5408\u6cd5\u660e\u6587\u586b\u5145\u683c\u5f0f\u4e3a 00 02 || PS（\u22658 \u5b57\u8282\u975e\u96f6）|| 00 || M\u3002\u653b\u51fb\u8005\u628a\u5bc6\u6587 c \u4e58\u4ee5 s^e（\u6a21 n）\u5f97\u5230\u65b0\u5bc6\u6587 c&\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/118458.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T06:00:42+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/118458.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/118458.html\",\"name\":\"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-10-27T06:00:42+00:00\",\"dateModified\":\"2026-10-27T06:00:42+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/118458.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/118458.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/118458.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/118458.html","og_locale":"zh_CN","og_type":"article","og_title":"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle（\u542b ROBOT \u8003\u70b9\u6982\u5ff5 Bleichenbacher \u653b\u51fb\u9488\u5bf9 RSA \u52a0\u5bc6\u4e2d PKCS#1 v1.5 \u586b\u5145\u7684\u6709\u6548\u6027\u63d0\u793a（padding oracle）\u5de5\u4f5c\u3002 \u5408\u6cd5\u660e\u6587\u586b\u5145\u683c\u5f0f\u4e3a 00 02 || PS（\u22658 \u5b57\u8282\u975e\u96f6）|| 00 || M\u3002\u653b\u51fb\u8005\u628a\u5bc6\u6587 c \u4e58\u4ee5 s^e（\u6a21 n）\u5f97\u5230\u65b0\u5bc6\u6587 c&","og_url":"https:\/\/www.wsisp.com\/helps\/118458.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-10-27T06:00:42+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"5 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/118458.html","url":"https:\/\/www.wsisp.com\/helps\/118458.html","name":"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-10-27T06:00:42+00:00","dateModified":"2026-10-27T06:00:42+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/118458.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/118458.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/118458.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"CTF\u5b66\u4e60\/crypto\/Bleichenbacher \u4e0e PKCS#1 v1.5 \u586b\u5145 Oracle\uff08\u542b ROBOT"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/118458","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=118458"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/118458\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=118458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=118458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=118458"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=118458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}