Digital Signature

In this challenge, you will perform an RSA digital signature generation using a pre-defined secret key in private_key.pem. The message to be signed can be found in message.txt.

Please use Python's hazmat modules. The private key is serialized in the PKCS8 format and protected using a password b'skpassword' via BestAvailableEncryption. The encrypted message is padded according to PKCS1v15.

You can verify your result by /challenge/solve.

Forging an RSA signature for arbitrary message is easy as long as a signature oracle is given, even when the oracle is set not to sign certain harmful messages.

This challenge provides you a RSA public key (N,e) and a message m in context.txt, and your goal is to get the signature for m. However, the oracle is programmed only to sign messages of which the last 20-bits are zero (assuming the integer representation). Also, you are limited to query only once.

To query for the signature for message m', use /challenge/oracle m', where m' is an integer.

To verify the signature for message m, use /challenge/verify signature, where signature is an integer.