## [zer0pts CTF 2020] dirty laundry

Do you wanna air my dirty laundry? How to solve Recovering PRNG The challenge uses 256-bit LFSR PRNG, of which seed is the lower 256-bit of 1024-bit prime number. Let’s see pailler_enc unction. def paillier_enc(m, p, noise): p = next_prime(p + noise) q = getStrongPrime(512) n = p * q g = (1 + prng.rand() * n) % n**2 c = pow(g, m, n**2) * pow(prng.rand(), n, n**2) % n**2 return n, g, c The value p is 1024-bit, so n should be 1536-bit....