RSA decryption and attack runner
Paste n, e, and c and let ctfpal choose the attack: trial division, Fermat, Pollard’s rho, Wiener, common modulus, or Hastad broadcast. Arbitrary-precision, in-browser.
Open in ctfpalEvery CTF RSA challenge is a question about which parameter was chosen badly. Textbook RSA is not breakable; the challenges are breakable because p and q are close, or e is 3, or d is small, or the same message went out under two moduli. Reading the parameters tells you which attack applies before you run anything.
The decision tree
| What you see | Attack |
|---|---|
n under ~256 bits | Just factor it - trial division or Pollard’s rho |
p and q visibly close in size | Fermat factorization |
e very large, near n | Wiener’s attack - d is small |
e = 3 and a small message | Integer cube root of c, no factoring needed |
e = 3 with 3+ ciphertexts, different n | Hastad broadcast |
Same n, two different e | Common modulus |
| Two moduli sharing a factor | GCD of the two moduli - instant |
The free win: shared factors
If a challenge hands you two moduli, compute gcd(n1, n2) before anything else. If two keys were generated with a broken random number generator they may share a prime, and the GCD hands you that prime in microseconds regardless of key size. This is not a toy - it has been found repeatedly in real internet-wide TLS surveys.
phi = (p - 1) * (q - 1)
d = pow(e, -1, phi) # Python 3.8+ modular inverse
m = pow(c, d, n)
print(m.to_bytes((m.bit_length() + 7) // 8, 'big'))Common questions
- How large an n can be factored in a browser?
- Pollard’s rho comfortably handles moduli with a small factor regardless of total size, and general factoring is practical to roughly 60-70 digits. Beyond that, a CTF challenge intends a structural weakness rather than raw factoring - find the weakness.