crypto-gu 0.1.0__py3-none-any.whl

crypto_gu/__init__.py

@@ -0,0 +1,12 @@
+"""crypto_gu: a pure standard-library cryptography toolkit.
+
+Research- and teaching-oriented primitives (hashes, KDFs, ciphers, AEAD,
+RSA padding schemes) alongside deterministic attack implementations
+(padding oracles, small-exponent and factorisation helpers). No third
+party dependencies; every primitive is validated against RFC/NIST test
+vectors.
+"""
+
+__version__ = "0.1.0"
+
+__all__ = ["__version__"]

crypto_gu/asymmetric/pkcs1.py

@@ -0,0 +1,212 @@
+"""RSA encryption and signature schemes from PKCS #1 v2.2 (RFC 8017).
+
+Provides MGF1, RSAES-OAEP (section 7.1) and RSASSA-PSS (section 8.1). The
+underlying trapdoor is the textbook :class:`~crypto_gu.asymmetric.rsa.RSAKey`
+already in this package; these helpers add the randomised, provably related
+padding that turns it into a real-world scheme.
+
+Pure Python, standard library only (``os.urandom`` supplies the randomness).
+"""
+
+from __future__ import annotations
+
+import os
+
+from crypto_gu.errors import DecryptionError, InvalidSignatureError
+from crypto_gu.hashes import HASH_TABLE
+
+
+def _hash_length(hash_name: str) -> int:
+    key = hash_name.lower()
+    if key not in HASH_TABLE:
+        raise ValueError("unknown hash algorithm: %r" % hash_name)
+    return len(HASH_TABLE[key](b""))
+
+
+def _digest(hash_name: str, data: bytes) -> bytes:
+    return HASH_TABLE[hash_name.lower()](data)
+
+
+def _i2osp(value: int, length: int) -> bytes:
+    if value < 0 or value >> (8 * length):
+        raise ValueError("integer too large")
+    return value.to_bytes(length, "big")
+
+
+def _os2ip(data: bytes) -> int:
+    return int.from_bytes(data, "big")
+
+
+def mgf1(seed: bytes, length: int, hash_name: str = "sha256") -> bytes:
+    """Mask generation function MGF1 (RFC 8017 appendix B.2.1)."""
+    if length < 0:
+        raise ValueError("mask length must be non-negative")
+    hlen = _hash_length(hash_name)
+    if length > (1 << 32) * hlen:
+        raise ValueError("mask too long")
+    output = b""
+    counter = 0
+    while len(output) < length:
+        output += _digest(hash_name, seed + counter.to_bytes(4, "big"))
+        counter += 1
+    return output[:length]
+
+
+def _xor(left: bytes, right: bytes) -> bytes:
+    return bytes(a ^ b for a, b in zip(left, right))
+
+
+def _modulus_size(n: int) -> int:
+    return (n.bit_length() + 7) // 8
+
+
+# --------------------------------------------------------------------------- #
+# RSAES-OAEP
+# --------------------------------------------------------------------------- #
+
+
+def oaep_encode(message: bytes, k: int, hash_name: str = "sha256", label: bytes = b"") -> bytes:
+    """EME-OAEP encoding (RFC 8017 section 7.1.1)."""
+    hlen = _hash_length(hash_name)
+    if len(message) > k - 2 * hlen - 2:
+        raise ValueError("message too long for OAEP")
+    lhash = _digest(hash_name, label)
+    ps = b"\x00" * (k - len(message) - 2 * hlen - 2)
+    db = lhash + ps + b"\x01" + message
+    seed = os.urandom(hlen)
+    db_mask = mgf1(seed, k - hlen - 1, hash_name)
+    masked_db = _xor(db, db_mask)
+    seed_mask = mgf1(masked_db, hlen, hash_name)
+    masked_seed = _xor(seed, seed_mask)
+    return b"\x00" + masked_seed + masked_db
+
+
+def oaep_decode(encoded: bytes, k: int, hash_name: str = "sha256", label: bytes = b"") -> bytes:
+    """EME-OAEP decoding; raises :class:`DecryptionError` on malformed input."""
+    hlen = _hash_length(hash_name)
+    if len(encoded) != k or k < 2 * hlen + 2:
+        raise DecryptionError("decryption error")
+    if encoded[0] != 0:
+        raise DecryptionError("decryption error")
+    masked_seed = encoded[1 : 1 + hlen]
+    masked_db = encoded[1 + hlen :]
+    seed = _xor(masked_seed, mgf1(masked_db, hlen, hash_name))
+    db = _xor(masked_db, mgf1(seed, k - hlen - 1, hash_name))
+    if db[:hlen] != _digest(hash_name, label):
+        raise DecryptionError("decryption error")
+    index = hlen
+    while index < len(db) and db[index] == 0:
+        index += 1
+    if index >= len(db) or db[index] != 1:
+        raise DecryptionError("decryption error")
+    return db[index + 1 :]
+
+
+def oaep_encrypt(key, message: bytes, hash_name: str = "sha256", label: bytes = b"") -> bytes:
+    """RSAES-OAEP encrypt with a public (or full) :class:`RSAKey`."""
+    k = _modulus_size(key.n)
+    encoded = oaep_encode(message, k, hash_name, label)
+    m = _os2ip(encoded)
+    if m >= key.n:
+        raise ValueError("encoded message representative out of range")
+    return _i2osp(pow(m, key.e, key.n), k)
+
+
+def oaep_decrypt(key, ciphertext: bytes, hash_name: str = "sha256", label: bytes = b"") -> bytes:
+    """RSAES-OAEP decrypt; requires the private exponent."""
+    if key.d is None:
+        raise DecryptionError("decryption error")
+    k = _modulus_size(key.n)
+    if len(ciphertext) != k:
+        raise DecryptionError("decryption error")
+    c = _os2ip(ciphertext)
+    if c >= key.n:
+        raise DecryptionError("decryption error")
+    m = pow(c, key.d, key.n)
+    return oaep_decode(_i2osp(m, k), k, hash_name, label)
+
+
+# --------------------------------------------------------------------------- #
+# RSASSA-PSS
+# --------------------------------------------------------------------------- #
+
+
+def pss_encode(message: bytes, em_bits: int, hash_name: str = "sha256", salt_length: int = 32) -> bytes:
+    """EMSA-PSS encoding (RFC 8017 section 9.1.1)."""
+    hlen = _hash_length(hash_name)
+    em_len = (em_bits + 7) // 8
+    if em_len < hlen + salt_length + 2:
+        raise ValueError("encoding error")
+    m_hash = _digest(hash_name, message)
+    salt = os.urandom(salt_length)
+    h = _digest(hash_name, b"\x00" * 8 + m_hash + salt)
+    ps = b"\x00" * (em_len - salt_length - hlen - 2)
+    db = ps + b"\x01" + salt
+    db_mask = mgf1(h, em_len - hlen - 1, hash_name)
+    masked_db = bytearray(_xor(db, db_mask))
+    masked_db[0] &= 0xFF >> (8 * em_len - em_bits)
+    return bytes(masked_db) + h + b"\xbc"
+
+
+def pss_verify(message: bytes, encoded: bytes, em_bits: int, hash_name: str = "sha256",
+               salt_length: int = 32) -> bool:
+    """EMSA-PSS verification (RFC 8017 section 9.1.2). Returns a bool."""
+    hlen = _hash_length(hash_name)
+    em_len = (em_bits + 7) // 8
+    if len(encoded) != em_len or em_len < hlen + salt_length + 2:
+        return False
+    if encoded[-1] != 0xBC:
+        return False
+    masked_db = bytearray(encoded[: em_len - hlen - 1])
+    h = encoded[em_len - hlen - 1 : em_len - 1]
+    if masked_db[0] & ~(0xFF >> (8 * em_len - em_bits)):
+        return False
+    masked_db[0] &= 0xFF >> (8 * em_len - em_bits)
+    db = bytearray(_xor(bytes(masked_db), mgf1(h, em_len - hlen - 1, hash_name)))
+    db[0] &= 0xFF >> (8 * em_len - em_bits)
+    ps_len = em_len - hlen - salt_length - 2
+    if db[:ps_len] != b"\x00" * ps_len or db[ps_len] != 0x01:
+        return False
+    salt = bytes(db[-salt_length:]) if salt_length else b""
+    m_hash = _digest(hash_name, message)
+    return h == _digest(hash_name, b"\x00" * 8 + m_hash + salt)
+
+
+def pss_sign(key, message: bytes, hash_name: str = "sha256", salt_length: int = 32) -> bytes:
+    """RSASSA-PSS sign; requires the private exponent."""
+    if key.d is None:
+        raise InvalidSignatureError("signing requires a private key")
+    k = _modulus_size(key.n)
+    em_bits = key.n.bit_length() - 1
+    encoded = pss_encode(message, em_bits, hash_name, salt_length)
+    m = _os2ip(encoded)
+    if m >= key.n:
+        raise ValueError("encoded message representative out of range")
+    return _i2osp(pow(m, key.d, key.n), k)
+
+
+def pss_verify_signature(key, message: bytes, signature: bytes, hash_name: str = "sha256",
+                         salt_length: int = 32) -> bool:
+    """RSASSA-PSS verify with a public (or full) :class:`RSAKey`."""
+    k = _modulus_size(key.n)
+    if len(signature) != k:
+        return False
+    s = _os2ip(signature)
+    if s >= key.n:
+        return False
+    m = pow(s, key.e, key.n)
+    em_bits = key.n.bit_length() - 1
+    return pss_verify(message, _i2osp(m, k), em_bits, hash_name, salt_length)
+
+
+__all__ = [
+    "mgf1",
+    "oaep_encode",
+    "oaep_decode",
+    "oaep_encrypt",
+    "oaep_decrypt",
+    "pss_encode",
+    "pss_verify",
+    "pss_sign",
+    "pss_verify_signature",
+]

crypto_gu/asymmetric/rsa.py

@@ -0,0 +1,108 @@
+"""RSA public-key primitives.
+
+Pure Python, standard library only. Key generation uses the Miller-Rabin
+based :mod:`crypto_gu.number_theory` primes. Textbook RSA helpers are
+provided, plus :func:`construct_private` to build a private key from an
+explicit factorisation (the output of the attacks in
+:mod:`crypto_gu.attacks.rsa`).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from crypto_gu import number_theory as nt
+
+
+def _i2b(value: int, size: int) -> bytes:
+    return value.to_bytes(size, "big")
+
+
+def _b2i(data: bytes) -> int:
+    return int.from_bytes(data, "big")
+
+
+@dataclass
+class RSAKey:
+    """A minimal RSA public/private key pair. ``d`` may be ``None``."""
+
+    n: int
+    e: int = 65537
+    d: int | None = None
+    p: int | None = None
+    q: int | None = None
+
+    @classmethod
+    def generate(cls, bits: int = 1024, e: int = 65537) -> "RSAKey":
+        half = bits // 2
+        p = nt.rand_prime(half)
+        q = nt.rand_prime(bits - half)
+        while q == p:
+            q = nt.rand_prime(bits - half)
+        return cls._from_pq(p, q, e)
+
+    @classmethod
+    def _from_pq(cls, p: int, q: int, e: int) -> "RSAKey":
+        n = p * q
+        phi = (p - 1) * (q - 1)
+        d = nt.modinv(e, phi)
+        return cls(n=n, e=e, d=d, p=p, q=q)
+
+    @classmethod
+    def from_pq(cls, p: int, q: int, e: int = 65537) -> "RSAKey":
+        return cls._from_pq(p, q, e)
+
+    @classmethod
+    def from_ned(cls, n: int, e: int, d: int) -> "RSAKey":
+        return cls(n=n, e=e, d=d)
+
+    def public(self) -> "RSAKey":
+        return RSAKey(n=self.n, e=self.e)
+
+    def _size(self) -> int:
+        return (self.n.bit_length() + 7) // 8
+
+    def encrypt(self, message: bytes) -> bytes:
+        m = _b2i(message)
+        if m >= self.n:
+            raise ValueError("message too long for this RSA modulus")
+        return _i2b(pow(m, self.e, self.n), self._size())
+
+    def decrypt(self, ciphertext: bytes) -> bytes:
+        if self.d is None:
+            raise ValueError("cannot decrypt with a public-only key")
+        c = _b2i(ciphertext)
+        m = _i2b(pow(c, self.d, self.n), self._size()).lstrip(b"\x00")
+        return m or b"\x00"
+
+    def sign(self, message: bytes) -> bytes:
+        return self.decrypt(message)
+
+    def verify(self, message: bytes, signature: bytes) -> bool:
+        return _b2i(self.encrypt(signature)) == _b2i(message)
+
+    def max_bytes(self) -> int:
+        return (self.n.bit_length() - 1) // 8
+
+
+def generate_keypair(bits: int = 1024, e: int = 65537) -> RSAKey:
+    return RSAKey.generate(bits, e)
+
+
+def public_encrypt(n: int, e: int, message: bytes) -> bytes:
+    return RSAKey(n=n, e=e).encrypt(message)
+
+
+def private_decrypt(n: int, e: int, d: int, ciphertext: bytes) -> bytes:
+    return RSAKey(n=n, e=e, d=d).decrypt(ciphertext)
+
+
+def construct_private(n: int, p: int, q: int, e: int = 65537) -> RSAKey:
+    """Build the private key from a recovered factorisation."""
+    if p * q != n:
+        raise ValueError("p * q does not equal n")
+    return RSAKey._from_pq(p, q, e)
+
+
+__all__ = ["RSAKey", "generate_keypair", "public_encrypt", "private_decrypt",
+           "construct_private"]

crypto_gu/attacks/aes.py

@@ -0,0 +1,214 @@
+"""Deterministic AES attack recipes.
+
+Two classic oracle attacks on misconfigured AES, both deterministic and
+non-brute-force over the key space: they call an oracle once per secret
+byte and reconstruct plaintext byte by byte.
+
+- :func:`ecb_byte_at_a_time` — recovers the unknown suffix of an ECB
+  encryption when the attacker controls data placed between a fixed
+  (unknown) ``prefix`` and the ``secret``::
+
+      oracle(data) == ECB(prefix + data + secret)
+
+  Handles an arbitrary prefix length automatically.
+
+- :func:`cbc_padding_oracle` — recovers plaintext block by block using a
+  padding-validity oracle on CBC ciphertexts::
+
+      oracle(previous || block) -> True if decrypting ``block`` against
+      ``previous`` yields valid PKCS#7 padding
+"""
+
+from __future__ import annotations
+
+BLOCK = 16
+
+
+def _chunks(data: bytes, bs: int):
+    return [data[i * bs:(i + 1) * bs] for i in range(len(data) // bs)]
+
+
+def _detect_blocksize(oracle) -> int:
+    base = len(oracle(b""))
+    prev = base
+    jumps = []
+    for n in range(1, 256):
+        cur = len(oracle(b"A" * n))
+        if cur != prev:
+            jumps.append(n)
+            prev = cur
+        if len(jumps) >= 2:
+            return jumps[1] - jumps[0]
+    raise ValueError("oracle output length never changes (no block size found)")
+
+
+def _is_ecb(oracle, bs: int) -> bool:
+    out = oracle(b"A" * (bs * 3))
+    blocks = _chunks(out, bs)
+    return len(set(blocks)) != len(blocks)
+
+
+def _find_prefix_align(oracle, bs: int):
+    """Return a list of candidate ``(q, j0)`` alignments.
+
+    Feeding ``A^q + X^(2*bs)`` (for two independent byte values X = B, C)
+    produces two consecutive identical ciphertext blocks iff
+    ``(prefix_len + q) % bs == 0``.  The union of duplicate-pair indices
+    across the two characters makes the detector robust against a prefix
+    or secret that itself repeats bytes; the caller validates each
+    candidate by attempting a full recovery.
+    """
+    pair_sets = []
+    for byte_val in (0x42, 0x43):
+        pairs = set()
+        for q in range(bs):
+            out = oracle(b"A" * q + bytes([byte_val]) * (bs * 2))
+            blocks = _chunks(out, bs)
+            for i in range(len(blocks) - 1):
+                if blocks[i] == blocks[i + 1]:
+                    pairs.add((q, i))
+        pair_sets.append(pairs)
+    cands = sorted(pair_sets[0] & pair_sets[1])
+    if not cands:
+        raise ValueError("could not align unknown prefix (no aligned run)")
+    return cands
+
+
+def _plaintext_len(oracle, bs: int) -> int:
+    """Measure the oracle's total unpadded plaintext length.
+
+    Let M be the plaintext length for an empty attacker input.  The oracle
+    output for x attacker bytes is ``bs * ceil((M + x) / bs)`` (a full
+    padding block when M + x is block-aligned, as PKCS#7 always pads), so
+    the smallest x at which the length grows reveals ``M % bs``.
+    """
+    w = len(oracle(b"")) // bs
+    prev = len(oracle(b""))
+    jump = None
+    for x in range(1, bs + 1):
+        cur = len(oracle(b"A" * x))
+        if cur > prev:
+            jump = x
+            break
+        prev = cur
+    if jump is None:
+        raise ValueError("oracle length never changes; cannot detect plaintext len")
+    return (w - 1) * bs + (bs - jump) % bs
+
+
+def ecb_byte_at_a_time(oracle, secret_len=None, block_size=None):
+    """Recover ``secret`` from ``oracle(data) == ECB(prefix+data+secret)``.
+
+    Detects block size and ECB mode, measures an arbitrary unknown
+    ``prefix`` (alignment + length), and reconstructs ``secret`` byte by
+    byte with up to 256 oracle calls per byte plus a constant budget.
+    """
+    bs = _detect_blocksize(oracle) if block_size is None else block_size
+    if not _is_ecb(oracle, bs):
+        raise ValueError("oracle does not look like ECB (no duplicated block)")
+
+    total_len = _plaintext_len(oracle, bs)
+    candidates = _find_prefix_align(oracle, bs)
+    failures = []
+    best = None
+    for q, j0 in candidates:
+        try:
+            prefix_len = j0 * bs - q
+            if prefix_len < 0:
+                raise ValueError("negative prefix length")
+            slen = secret_len
+            if slen is None:
+                slen = total_len - prefix_len
+            if slen < 0:
+                raise ValueError("negative secret length")
+            recovered = _recover_with_alignment(oracle, bs, q, j0, slen)
+        except ValueError as exc:
+            failures.append((q, j0, str(exc)))
+            continue
+        if best is None or len(recovered) > len(best):
+            best = recovered
+    if best is None:
+        raise ValueError(
+            "could not recover secret with any alignment (%s)" % failures[0][2])
+    return best
+
+
+def _recover_with_alignment(oracle, bs, q, j0, secret_len):
+    """Run the byte-at-a-time recovery assuming aligned offset (q, j0).
+
+    Reconstructs exactly ``secret_len`` bytes.  A candidate alignment is
+    rejected when the probe byte never lands inside the compared block,
+    which would silently recover zero bytes instead of the secret.
+    """
+    known = bytearray()
+    for n in range(secret_len):
+        a, r = divmod(n, bs)
+        pad = bs - 1 - r
+        base = oracle(b"A" * (q + pad))
+        block = (j0 + a) * bs
+        if block + bs > len(base):
+            raise ValueError("target block out of range at byte %d" % n)
+        target_block = base[block:block + bs]
+        if n == 0:
+            # Probe two values first: the probe byte sits at a fixed
+            # position inside the compared block for a given alignment, so
+            # a match for both means the probe never reached that block at
+            # all (the alignment is degenerate) and the recovery would
+            # silently produce zero bytes.
+            zero = oracle(b"A" * (q + pad) + bytes([0]))
+            one = oracle(b"A" * (q + pad) + bytes([1]))
+            if (zero[block:block + bs] == target_block
+                    and one[block:block + bs] == target_block):
+                raise ValueError(
+                    "ambiguous alignment q=%d,j0=%d" % (q, j0))
+        found = None
+        for c in range(256):
+            cand = oracle(b"A" * (q + pad) + bytes(known) + bytes([c]))
+            if cand[block:block + bs] == target_block:
+                found = c
+                break
+        if found is None:
+            raise ValueError(
+                "byte %d not found with alignment q=%d,j0=%d"
+                % (len(known), q, j0))
+        known.append(found)
+    return bytes(known)
+
+
+def cbc_padding_oracle(block_decrypt, iv, ciphertext, block_size=BLOCK):
+    """Recover the plaintext of a CBC ``ciphertext``.
+
+    ``block_decrypt`` is the padding oracle: given ``previous || block`` it
+    returns True iff decrypting ``block`` against ``previous`` yields a
+    block with valid PKCS#7 padding.  No key material is required.
+
+    Runs the classic block-by-block attack: each block is recovered by
+    learning, byte by byte, the crafted previous block that makes the
+    padding valid, then XORing the result with the real IV (or previous
+    cipher block).
+    """
+    bs = block_size
+    if len(ciphertext) % bs:
+        raise ValueError("ciphertext must be a multiple of block size")
+    ct_blocks = _chunks(ciphertext, bs)
+    previous = iv
+    out = bytearray()
+    for block in ct_blocks:
+        recovered = bytearray(bs)
+        probe = bytearray(bs)
+        for pos in range(bs - 1, -1, -1):
+            pad_val = bs - pos
+            for i in range(pos + 1, bs):
+                probe[i] = recovered[i] ^ pad_val
+            found = None
+            for cand in range(256):
+                probe[pos] = cand
+                if block_decrypt(bytes(probe) + block):
+                    found = cand
+                    break
+            if found is None:
+                raise ValueError("padding oracle exhausted at pos %d" % pos)
+            recovered[pos] = found ^ pad_val
+        out += bytes(r ^ p for r, p in zip(recovered, previous))
+        previous = block
+    return bytes(out)

crypto_gu/attacks/rsa.py

@@ -0,0 +1,134 @@
+"""Deterministic RSA attack recipes.
+
+These recover factors or plaintext from a *misconfigured* RSA setup
+without brute-forcing the key space. Every attack here either succeeds on
+its precondition or returns ``None``; nothing here tries random exponents.
+
+Implemented:
+- :func:`wiener`           — recovers ``d`` from a small private exponent.
+- :func:`fermat`           — factorial for close primes ``p``, ``q``.
+- :func:`pollard_p_minus_1`— smooth ``p-1``.
+- :func:`common_modulus`   — two ciphertexts of the same message, public
+                             exponents coprime.
+- :func:`broadcast`        — Håstad, low exponent + many receivers.
+- :func:`plaintext_encrypt` — no-op composition helper.
+"""
+
+from __future__ import annotations
+
+from crypto_gu import number_theory as nt
+
+
+def _cf_frac(num: int, den: int) -> list:
+    """Continued fraction expansion of the rational num/den as ints."""
+    terms = []
+    while den:
+        terms.append(num // den)
+        num, den = den, num % den
+    return terms
+
+
+def _convergents(terms: list) -> list:
+    out = []
+    n0, d0 = 0, 1
+    n1, d1 = 1, 0
+    for a in terms:
+        n0, n1 = n1, a * n1 + n0
+        d0, d1 = d1, a * d1 + d0
+        out.append((n1, d1))
+    return out
+
+
+def wiener(n: int, e: int):
+    """Recover ``d`` (as an int) when it is smaller than ``n^0.25 / 3``.
+
+    Standard Wiener attack: the continued fraction of ``e/n`` contains
+    ``k/d``; test each convergent for a valid factorisation.
+    Returns the private exponent, or ``None``.
+    """
+    for k, d in _convergents(_cf_frac(e, n)):
+        if k == 0 or d == 0:
+            continue
+        if (e * d - 1) % k:
+            continue
+        phi = (e * d - 1) // k
+        s = n - phi + 1
+        disc = s * s - 4 * n
+        if disc < 0:
+            continue
+        r = nt.isqrt(disc)
+        if r * r != disc:
+            continue
+        p = (s + r) // 2
+        q = (s - r) // 2
+        if p * q == n:
+            return d
+    return None
+
+
+def fermat(n: int, limit: int = 1000000):
+    """Recover factors when ``p`` and ``q`` are close (difference of squares)."""
+    return nt.fermat_factor(n, limit)
+
+
+def pollard_p_minus_1(n: int, bound: int = 100000, rng=None):
+    """Recover a factor when ``p-1`` is bound-smooth."""
+    return nt.pollard_p_minus_1(n, bound, rng)
+
+
+def common_modulus(n: int, e1: int, c1: int, e2: int, c2: int):
+    """Recover plaintext ``m`` (int) from two ciphertexts sharing modulus.
+
+    Precondition: ``gcd(e1, e2) == 1``.  Returns the message int, or
+    ``None`` if the ciphertexts are inconsistent.
+    """
+    g, x, y = nt.extended_gcd(e1, e2)
+    if g != 1:
+        return None
+    if x < 0:
+        c1 = nt.modinv(c1, n)
+        x = -x
+    if y < 0:
+        c2 = nt.modinv(c2, n)
+        y = -y
+    return (pow(c1, x, n) * pow(c2, y, n)) % n
+
+
+def broadcast(ciphertexts, exponent: int = 3):
+    """Håstad's broadcast attack.
+
+    ``ciphertexts`` is an iterable of ``(n, c)`` pairs for the same
+    plaintext encrypted to ``len(ciphertexts)`` >= ``exponent`` receivers.
+    Returns the message int, or ``None`` when precondition is unmet.
+    """
+    pairs = list(ciphertexts)
+    if len(pairs) < exponent:
+        return None
+    res = nt.crt([(c % n, n) for n, c in pairs])
+    return _iroot(res, exponent)
+
+
+def _iroot(num: int, root: int) -> int:
+    """Integer ``root``-th root (floor) via Newton iterations."""
+    if root == 1:
+        return num
+    if num < 0:
+        return -_iroot(-num, root)
+    if num == 0:
+        return 0
+    high = 1 << ((num.bit_length() + root - 1) // root)
+    while True:
+        low = ((root - 1) * high + num // pow(high, root - 1)) // root
+        if low >= high:
+            break
+        high = low
+    return high
+
+
+def plaintext_encrypt(key, message: bytes) -> bytes:
+    """Helper to compute a ciphertext from :class:`RSAKey` without padding."""
+    return key.encrypt(message)
+
+
+__all__ = ["wiener", "fermat", "pollard_p_minus_1", "common_modulus",
+           "broadcast"]