tl;dr:
- use homomorphic property to get `ct_mod` such that `decrypt(ct_mod) == pt + x`- recover low bits by observing overflows in bit 512 when adding `1` to lower bits- use homomorphic property to get `ct_mod` such that `decrypt(ct_mod) == pt/2` for even `pt`- subtract all low bits from `pt` (add `n-low`) to get even number- recover high bits by dividing `pt` by 2
Full writeup: https://github.com/p4-team/ctf/tree/master/2017-09-02-tokyo/crypto_pinhole