This crypto challenge was part of the HTB University CTF we played in 2024
The problem is basically the following (all values are 128 bitvectors): given h1 and h2, find r1,r2,r3,r4,s1,s2, such that: ROL(s1, r1) ^ ROL(s2, r2) == h1 ROL(s1, r3) ^ ROL(s2, r4) == h2
z3 doesn't seem to be able to solve this directly in a fast manner (challenge expects solution in less than 2 seconds)
The crypto problem was then "reduced" to the following:
Given any value x with parity 0, find y and c, such that (y ^ (ROL(y,c))) == x Whether this even has a (good) solution, would also not seem clear, but sometimes it's worth just asking z3...
Find a solution for this problem with z3 in z3test.py
If you want to get an actual flag, copy paste the compute_yc function in the exploit.py under "TODO" and run
./exploit.py courses.sec.in.tum.de 13371