Skip to main content

30. A Routine for Solving CTF Crypto Puzzles with Z3

Cryptography CTFs often reach a point where "the equations are there, but the answer will not come out." The SMT solver Z3 is the answer at that point. The key is to turn the problem into constraints.

Fast workflow​

  • Define variables: declare keys, nonces, and intermediate values with BitVec/Int
  • Convert conditions: express XOR, modular arithmetic, and shifts directly as constraints
  • Check output: connect ciphertext/hash conditions with ==
  • Find a solution: solver.check() → model()

Practical tips​

  • If the modular arithmetic is complex, verify a small range first to identify the pattern
  • When a "partial key" is given, add it as a fixed constraint to reduce the search space
  • A brute-force + Z3 hybrid in Python is the fastest approach

Z3 is a practical hacking tool that automates the mathematics. It is one of the best investments for reducing time spent during a CTF.