CTF-CRYPTO-ECC(1)

CTF—CRYPTO-ECC(1)

椭圆加密

1.简介

椭圆曲线密码学（Elliptic curve cryptography），简称 ECC，和RSA、ElGamel 算法等类似，是一种公开秘钥加密的算法，也就是非对称加密。ECC 被公认为在给定秘钥长度下最安全的加密算法。ECC 依赖于解决大椭圆曲线离散对数问题的困难性。它的优势主要在于相对于其它方法，它可以在使用较短密钥长度的同时保持相同的密码强度。

2.ECC加解密

2.1密钥生成

用户A先选择一条椭圆曲线

\[E_q(a, b)
\]

选择其上的一个生成元G，假设其阶为n,之后再选择一个正整数

\[n_a
\]

将其作为密钥，计算：

\[P_a=n_aG
\]

所以，公钥为

\[P_a
\]

私钥为：

\[n_a
\]

2.2加密

用户 B 在向用户 A 发送消息 m，这里假设消息 m 已经被编码为椭圆曲线上的点，其加密步骤如下

1.查询用户A的公钥：

\[E_q(a,b),q,P_a,G
\]

2.在(1,q-1)的区间内选择随机数k

根据A的公钥计算

\[(x_1,y_1)=kG
\]

计算

\[(x_2,y_2)=kP_a
\]

如果为0，则从第二步重新开始

计算

\[C=m+(x_2,y_2)
\]

于是，发送给A的消息是

\[((x_1,y_1),C)
\]

2.3解密

利用私钥计算

\[n_a(x_1,y_1)=n_akG=kP_a=(x_2,y_2)
\]

计算消息

\[m=C-(x_2,y_2)
\]

3.Pohlig-Hellman与ECC

设求解的式子为：

\[Q=l*P
\]

其中，P为我们选取的一个基点，l是我们选定的随机数，就是要求解的私钥

首先取P的阶n。可使得n*P不存在最小的正整数

设

\[n=(p_1)^{e_1}*(p_2)^{e_2}....(p_r)^{e_r}
\]

对于i属于[1,r]

\[l_i=l\ mod\ p_i^{e_i}
\]

如果得到了这些 li 的值我们就能使用中国剩余定理进行求解得到 l 了，现在的问题就是求解这些

\[P_0=\frac{n}{p_i}P
\]

\[Q_0=\frac{n}{p_i}Q
\]

所以

\[Q_0=lP_0
\]

\[l_i*P=Q
\]

\[(z_0+z_1P_i+...+z_{e-1}P_i^{e-1})=Q_0
\]

即

\[z_0*P_0=Q_0
\]

所以

\[z_0P_0+(z_1p_i+...+z_{e-1}p_i^{e-1}P_0=Q_0)
\]

\[z_1p_i=Q_0-z_0P_0
\]

依次将zi全部算出来，然后用crt算出l

例题

[第五空间 2021]

task.py

print 'Try to solve the 3 ECC'

from secret import flag
from Crypto.Util.number import *
assert(flag[:5]=='flag{')
flag = flag[5:-1]
num1 = bytes_to_long(flag[:7])
num2 = bytes_to_long(flag[7:14])
num3 = bytes_to_long(flag[14:])

def ECC1(num):
	p = 146808027458411567
	A = 46056180
	B = 2316783294673
	E = EllipticCurve(GF(p),[A,B])
	P = E.random_point()
	Q = num*P
	print E
	print 'P:',P
	print 'Q:',Q

def ECC2(num):
	p = 1256438680873352167711863680253958927079458741172412327087203
	#import random
	#A = random.randrange(389718923781273978681723687163812)
	#B = random.randrange(816378675675716537126387613131232121431231)
	A = 377999945830334462584412960368612
	B = 604811648267717218711247799143415167229480
	E = EllipticCurve(GF(p),[A,B])
	P = E.random_point()
	Q = num*P
	print E
	print 'P:',P
	print 'Q:',Q
	factors, exponents = zip(*factor(E.order()))
	primes = [factors[i] ^ exponents[i] for i in range(len(factors))][:-1]
	print primes
	dlogs = []
	for fac in primes:
		t = int(int(P.order()) / int(fac))
		dlog = discrete_log(t*Q,t*P,operation="+")
		dlogs += [dlog]
		print("factor: "+str(fac)+", Discrete Log: "+str(dlog)) #calculates discrete logarithm for each prime order
	print num
	print crt(dlogs,primes)

def ECC3(num):
	p = 0xd3ceec4c84af8fa5f3e9af91e00cabacaaaecec3da619400e29a25abececfdc9bd678e2708a58acb1bd15370acc39c596807dab6229dca11fd3a217510258d1b
	A = 0x95fc77eb3119991a0022168c83eee7178e6c3eeaf75e0fdf1853b8ef4cb97a9058c271ee193b8b27938a07052f918c35eccb027b0b168b4e2566b247b91dc07
	B = 0x926b0e42376d112ca971569a8d3b3eda12172dfb4929aea13da7f10fb81f3b96bf1e28b4a396a1fcf38d80b463582e45d06a548e0dc0d567fc668bd119c346b2
	E = EllipticCurve(GF(p),[A,B])
	P = E.random_point()
	Q = num*P
	print E
	print 'P:',P
	print 'Q:',Q

ECC1(num1)
print '=============='
ECC2(num2)
print '=============='
ECC3(num3)

这题第一个部分就是简单的离散对数法就可以解决，第二部分需要用到Pohlig-Hellman，顺便提一下，dlog = discrete_log(t * Q, t * P,operation = "+")这句代码中，dlog = discrete_log()可以自动换域，所以可以使用CRT

关于这个离散对数的问题，可以详见

https://xz.aliyun.com/t/13919?time__1311=GqmxnD2D9A0QKGNDQieBK4YvxAKPrw7YLbD

EXP

from Crypto.Util.number import *
from sage.all import *
# Part1
from Crypto.Util.number import *
p = 146808027458411567
a = 46056180
b = 2316783294673
E = EllipticCurve(GF(p),(a,b))
P = E(119851377153561800,50725039619018388)
Q = E(22306318711744209,111808951703508717)
num1 =  discrete_log(Q,P,operation = '+')
# Part2
p = 1256438680873352167711863680253958927079458741172412327087203
a = 377999945830334462584412960368612
b = 604811648267717218711247799143415167229480
E = EllipticCurve(GF(p),[a,b])
P = E(550637390822762334900354060650869238926454800955557622817950,700751312208881169841494663466728684704743091638451132521079)
Q = E(1152079922659509908913443110457333432642379532625238229329830,819973744403969324837069647827669815566569448190043645544592)
# Q = k * P
n = E.order()
def Pohlig_Hellman(n,P,Q):
    factors, exponents = zip(*factor(n))
    primes = [factors[i] ^ exponents[i] for i in range(len(factors))][:-1]
    print(primes)
    dlogs = []
    for fac in primes:
        t = int(int(P.order()) // int(fac))
        dlog = discrete_log(t*Q,t*P,operation="+")
        dlogs += [dlog]
        print("factor: "+str(fac)+", Discrete Log: "+str(dlog)) #calculates discrete logarithm for each prime order
    num2 = crt(dlogs,primes)
    return num2
num2 = Pohlig_Hellman(n,P,Q)
# Part3
p = 0xd3ceec4c84af8fa5f3e9af91e00cabacaaaecec3da619400e29a25abececfdc9bd678e2708a58acb1bd15370acc39c596807dab6229dca11fd3a217510258d1b
A = 0x95fc77eb3119991a0022168c83eee7178e6c3eeaf75e0fdf1853b8ef4cb97a9058c271ee193b8b27938a07052f918c35eccb027b0b168b4e2566b247b91dc07
B = 0x926b0e42376d112ca971569a8d3b3eda12172dfb4929aea13da7f10fb81f3b96bf1e28b4a396a1fcf38d80b463582e45d06a548e0dc0d567fc668bd119c346b2
E = EllipticCurve(GF(p),[A,B])
P = E(10121571443191913072732572831490534620810835306892634555532657696255506898960536955568544782337611042739846570602400973952350443413585203452769205144937861,8425218582467077730409837945083571362745388328043930511865174847436798990397124804357982565055918658197831123970115905304092351218676660067914209199149610)
Q = E(964864009142237137341389653756165935542611153576641370639729304570649749004810980672415306977194223081235401355646820597987366171212332294914445469010927,5162185780511783278449342529269970453734248460302908455520831950343371147566682530583160574217543701164101226640565768860451999819324219344705421407572537)
def SmartAttack(P,Q,p):
    E = P.curve()
    Eqp = EllipticCurve(Qp(p, 2), [ ZZ(t) + randint(0,p)*p for t in E.a_invariants() ])
    P_Qps = Eqp.lift_x(ZZ(P.xy()[0]), all=True)
    for P_Qp in P_Qps:
        if GF(p)(P_Qp.xy()[1]) == P.xy()[1]:
            break
    Q_Qps = Eqp.lift_x(ZZ(Q.xy()[0]), all=True)
    for Q_Qp in Q_Qps:
        if GF(p)(Q_Qp.xy()[1]) == Q.xy()[1]:
            break
    p_times_P = p*P_Qp
    p_times_Q = p*Q_Qp
    x_P,y_P = p_times_P.xy()
    x_Q,y_Q = p_times_Q.xy()
    phi_P = -(x_P/y_P)
    phi_Q = -(x_Q/y_Q)
    k = phi_Q/phi_P
    return ZZ(k)
num3 = SmartAttack(P, Q, p)
print(b'NSSCTF{' + long_to_bytes(num1) + long_to_bytes(num2) + long_to_bytes(num3) + b'}')