Tags: small-e crypto rsa 

Rating:

This is what we're given:

```
from Crypto.Util.number import *
msg=b"UDCTF{REDACTED}"
pt=bytes_to_long(msg)
p=getPrime(1024)
q=getPrime(1024)
N=p*q
e=3
ct=pow(pt,e,N)

print(N)
print(e)
print(ct)
```

That textbook ([https://bitsdeep.com/posts/attacking-rsa-for-fun-and-ctf-points-part-1/](http://)) really is useful! Because e is so small and the message doesn't seem to be padded, m ^ e is likely less than n, and so the modulus doesn't matter. Therefore, we can just take the cubic root of the message with gmpy2.iroot() because e is so small :)

UDCTF{0k_m4yb3_d0nt_u5e_e_3qu4l5_3}

```
import gmpy2

n=19071553514906413228005623880868413172589438760530345745552708038769515697875361787053550188848159274987925247955174211167277615747329764460652862539122337714189780686582390326881171096308885109154336023212767779863472386169665627283720649094479648444588259600544834704143105214853522264311830387911281263299214052701109619722665736303738110883886917231219876629681611411323913511707032906816948757362133848480976586951323342448069343747851239877539085111823678094070778241732994351072251605007909682674187665596109353312252881532685577047967768366217935948525094732268620589271065304471832191222326947334404799847563
e=3
c=270903177796878498388304376598565799121492331770875203351555502784804760985678087802688162298096409297508110557051747972509915173895153270896299567072600809265143377905255294763705268648639628042173298874918538565864469546919085252896111245679898930789

m = gmpy2.iroot(c, 3)[0]
m = format(m, 'x')
for i in range(0, len(m), 2):
print(chr(int(m[i:i+2], 16)), end='')
```