Rsa

A homemade RSA-CRT signer leaks a correct and a faulted signature of the same message; gcd(s − spz, n) factors n (the Bellcore attack), while the trivial shortcut just recovers the message via s^e mod n — and the XOR ‘protection’ undoes itself.

An RSA modulus that looks 2054-bit-strong is actually 67 × q — a tiny prime factor makes it trivially factorable (FactorDB / trial division), reconstructing the private key and decrypting the flag.