View Single Post
  #1  
Old 09-18-2017, 02:15
TempoMat TempoMat is offline
Friend
 
Join Date: Jan 2006
Posts: 89
Rept. Given: 10
Rept. Rcvd 6 Times in 6 Posts
Thanks Given: 4
Thanks Rcvd at 28 Times in 21 Posts
TempoMat Reputation: 6
Strange RSA modulus N value

I have an old Delphi application I’m trying to reverse.
The app uses the FGIntRSA RSADecrypt procedure plus slightly modified FGIntRSA Base64 chars to validate the UserName and RegCode

Code:
The Exponent N=49608307214148501933851667872461788859314634414960570968576805395
And the possible prime divisors are:
PRIME FACTOR: 3
PRIME FACTOR: 5
PRIME FACTOR: 5573
PRIME FACTOR: 1694327
PRIME FACTOR: 1606452225507735500339279
PRIME FACTOR: 218026387802762543011518916577
Looking at the 'standard' definition of the RSA Key generation example from:
https://en.wikipedia.org/wiki/RSA_(cryptosystem)
Quote:
Key generation
The keys for the RSA algorithm are generated the following way:
  1. Choose two distinct prime numbers p and q.
    For security purposes, the integers p and q should be chosen at random, and
    should be similar in magnitude but 'differ in length by a few digits to make
    factoring harder. Prime integers can be efficiently found using a primality test.
  2. Compute n = pq.
    n is used as the modulus for both the public and private keys. Its length,
    usually expressed in bits, is the key length
.
It is clear that this modulus N does fall out of this definition.

Consequently I’m unable to find the correct factors p and q to retrieve the Private Exponent D.

Also the app does not use the most common Public Exponents like 65537 (0x10001) or 7967 (0x1F1F) but rather 57167651080132926337657020661 (0x B8B7F8FED9427AB1E07720F5)

The original keys from the disassembly of the app are

Code:
Exponent E: r=JwZQM2jP7kIt3U
Modulus N:  j9I4D7HqaQTdXNtl3mgWtnkQiz6aN+RKlqoe
Base64 CharSet=  0123456789+=aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
If anyone wants to play with it.
Reply With Quote