Tags: factoring crypto
Rating: 5.0
tldr
1. A given RSA modulus is generated by multiplying two primes with very low Hamming weight
2. Factor it by iteratively finding solutions for `p*q=n mod 2^k` for an increasing `k`
3. For each `k`, keep a fixed number of possible solutions - the ones with lower Hamming weight
full solution: <https://sectt.github.io/writeups/GoogleCTF20/crypto_yafm/README>
