ch42.py 文件源码

def ForgeSignature(message, pubKey):
    e, n = pubKey

    H = sha256(message)
    D = BytesToInteger(ASN1_GOOP + H)
    Dbits = (len(H) + len(ASN1_GOOP) + 1) * 8

    # Strangely enough, Finney assumes N to be a power of 3, but here it's not
    # and it still works.
    N = (2 ** Dbits) - D
    # The -4 is to eliminate the bytes that need to be there, 00 01 at the
    # start of the signature, and FF 00 just before ASN1_GOOP.
    X = (KEY_BYTESIZE - len(H) - len(ASN1_GOOP) - 4) * 8

    # We can fit anything into the  X bits leftover for garbage, so we pick the
    # largest number we can fit.
    garbage = 2 ** X - 1
    # In the writeup, the key bit size gets 15 bits removed; here I do the same.
    maxBlock = 2 ** (KEY_BITSIZE - 15) - N * (2 ** X) + garbage

    sigNum = cube_root(maxBlock)
    signature = IntegerToBytes(sigNum, KEY_BYTESIZE)
    return signature