# ROR Writeup

### zer0pts CTF 2020 - crypto 260

> LOL

#### Observations

Plain RSA cryptosystem given. I was given only set of ciphertexts, which were generated by RORing flag. `2` is factor of public modulus `N`, so applying modular operation does not change the parity of rotated plaintext. Every bit of plaintext can be recovered by just observing least significant bits of ciphertexts.

#### Get flag

Concat every LSBs of ciphertext and get flag:

```
zer0pts{0h_1t_l34ks_th3_l34st_s1gn1f1c4nt_b1t}
```

Exploit code: [solve.py](solve.py)

Original writeup (https://github.com/pcw109550/write-up/tree/master/2020/zer0pts/ROR).