from Crypto.Util.number import getStrongPrime, getRandomNBitInteger, GCD, inverse, long_to_bytes, bytes_to_long, sieve_base from flag import flag
defgen_parameters(gamma=0.33, beta=0.33): p = getStrongPrime(1024) q = getStrongPrime(1024) N = p*q phi = (p-1)*(q-1) whileTrue: d = getRandomNBitInteger(int(2048*beta)) if GCD(d, phi) == 1: break e = inverse(d, phi) hints = [] M = 1 for i inrange(1, len(sieve_base)): li = sieve_base[i] hints.append(d%li) M *= li if M.bit_length() >= 1024*gamma: break return e, N, hints
ifisinstance(f, Polynomial): x, = polygens(f.base_ring(), f.variable_name(), 1) f = f(x)
R = f.base_ring() N = R.cardinality() f /= f.coefficients().pop(0) f = f.change_ring(ZZ)
G = Sequence([], f.parent()) for i inrange(m+1): base = N**(m-i) * f**i for shifts in itertools.product(range(d), repeat=f.nvariables()): g = base * prod(map(power, f.variables(), shifts)) G.append(g)
factors = [monomial(*bounds) for monomial in monomials] for i, factor inenumerate(factors): B.rescale_col(i, factor) st1 = time.time() B = (B.dense_matrix()).LLL(epsilon=0.99) # B = flatter(B) end = time.time() print(f'time of lattice reduction: {end-st1}s') print(f'{B.dimensions() = }') B = B.change_ring(QQ) for i, factor inenumerate(factors): B.rescale_col(i, 1/factor)
H = Sequence([], f.parent().change_ring(QQ)) for h infilter(None, B*monomials): H.append(h) I = H.ideal() if I.dimension() == -1: H.pop() elif I.dimension() == 0: roots = [] for root in I.variety(ring=ZZ): root = tuple(R(root[var]) for var in f.variables()) roots.append(root) return roots
]]><p>这段时间研究CSIDH，时间跨度接近一年了。<strong>这次分享尽可能降低了门槛，让大家听懂。</strong></p>
<p>个人认为CSIDH方案是数学、计算优化与工科思维的集大成者。同源密码用到的数学比较深，而同源计算也很灵活，可以将群论与工科式的想法结合。<strong>这次分享对数学原理和优化都有所覆盖。</strong></p>
<p>CM Torsor的性质没有深入，想了解建议看复环面/复椭圆曲线的复乘理论。</p>Solution to S0DH in D3CTF 2024https://su1yu4n.github.io/2024/04/30/Solution-to-S0DH/2024-04-30T03:19:45.000Z2024-11-23T11:00:48.286ZHere’s the official writeup for S0DH, including the challenge and solutions (intended and unintended).
""" NOTE: Follow SIKE's spec in the generation of E[2^a] torsion basis. It will allow you to compute the isogeny faster. """
sqrtof2 = Fp2(2).sqrt() f = x**3 + A0 * x**2 + x
Pa = E0(0) Qa = E0(0) Pa_done = False Qa_done = False d = 0 for c inrange(0, p): Rx = ii + c Ry_square = f(ii + c) ifnot Ry_square.is_square(): continue Ra = E0.lift_x(Rx) Pa = 3**b * Ra
Ta = 2 ** (a - 1) * Pa if Ta.is_zero(): continue Tax_plus_3 = Ta.xy()[0] + 3 if Tax_plus_3 == 2 * sqrtof2 or Tax_plus_3 == -2 * sqrtof2: Pa_done = True elif Tax_plus_3 == 3andnot Qa_done: Qa = Pa Qa_done = True else: raise ValueError('Unexcepted order 2 point.')
if Pa_done and Qa_done: break
assert Pa.order() == 2**a and Qa.order() == 2**a assert Pa.weil_pairing(Qa, 2**a) ** (2 ** (a - 1)) != 1
assert jab == jba h = bytes_to_long(hashlib.sha256(str(jab).encode()).digest()) enc = h ^ bytes_to_long(flag) print(f'enc = {enc}')
""" Pa = (199176096138773310217268*ii + 230014803812894614137371, 21529721453350773259901*ii + 106703903226801547853572) Qa = (8838268627404727894538*ii + 42671830598079803454272, 232086518469911650058383*ii + 166016721414371687782077) Pb = (200990566762780078867585*ii + 156748548599313956052974, 124844788269234253758677*ii + 161705339892396558058330) Qb = (39182754631675399496884*ii + 97444897625640048145787, 80099047967631528928295*ii + 178693902138964187125027) phib_Pa = (149703758091223422379828*ii + 52711226604051274601866, 112079580687990456923625*ii + 147229726400811363889895) phib_Qa = (181275595028116997198711*ii + 186563896197914896999639, 181395845909382894304538*ii + 69293294106635311075792) Ea: Elliptic Curve defined by y^2 = x^3 + (11731710804095179287932*ii+170364860453198752624563)*x^2 + x over Finite Field in ii of size 232900919541184113672191^2 Eb: Elliptic Curve defined by y^2 = x^3 + (191884939246592021710422*ii+96782382528277357218650)*x^2 + x over Finite Field in ii of size 232900919541184113672191^2 enc = 48739425383997297710665612312049549178322149326453305960348697253918290539788 """
The Flag
d3ctf{is0geny_gr4ph_m33t_1n_7he_m1ddl3}
Intended Solution
The main idea
Meet in the middle attack has time and space complexity $O(2^{a/2}) = O(p^{1/4})$. Using the given isogeny computing function, it takes about 1h to solve Alice’s secret isogeny $\phi_a$.
MITM
Let $K_a = 2^{a/2}P_a + s_a \cdot 2^{a/2}Q_a$, where $\left \langle P_a + s_a \cdot Q_a\right\rangle$ is the kernel of $\phi_a$. As a path in the 2-isogeny graph, $\phi_a$ passes through the node $E_{mid1} := E_0/ \left\langle{K_a}\right\rangle$.
Therefore we can compute all possible $2^{a/2}$-isogenies and construct a hash table. The keys are the j-invariant of codomains and the values are ${s_a}\pmod{2^{a/2}}$.
Remark: In my script, I compute $2^{a/2+1}$-isogenies and construct the hash table. Because I planned to set a=43 at first.
Use the j-invariant as the key of hash table
Note that each node of isogeny graph is an isomorphism class (over $\mathbb{F_{p^2}}$) of elliptic curve, so we need to compute the j-invariant (an isomorphic invariant) and use it as the key of our hash table.
The j-invariant of a untwisted Montgomery curve $E_A$ is
To avoid unnecessary computation of inversion, write $A = A_x/A_z$ and we get
See [1] for the j-invariant.
So we can use 1 inversion to compute the $j_A$ from the fractional representation of $A$.
Working with the given isogeny formula
Note that computing $2^a$-isogeny requires us to compute a chain a 2-isogeny and 4-isogeny. As SIKE’s spec pointed out in page 6~7, the input kernel point of isog2 cannot be $(0,0)$, and the input kernel point of isog4 cannot be $(1, \cdot)$ or $(-1, \cdot)$.
So how can we make use of this formula to compute isogenies starting from $E_a$? The generation process of $P_a$ and $Q_a$ in challenge.py suggests that we can choose $Q_a’$ such that $2^{a-1} \cdot Q_a’ = (0,0)$, and choose a $P_a’$ such that $e_{2^{a}}(P_a’, Q_a’)$ is a primitive $2^a$-th root.
Searching from $E_a$
According to the structure of 2-isogeny graph, there are $3 \cdot 2^{a/2-1} $ isogenies to try. But taking $2^{a/2}P_a’ + s_a’ \cdot 2^{a/2}Q_a’$ as the kernel only makes $2^{a/2}$ isogenies.
In fact, the other isogenies correspond to $\left\langle{t_a’P_a’ + Q_a’}\right\rangle$, where $t_a’=0,2, …, 2^{a/2}$.
After MITM
The collision gives us ${s_a}\pmod{2^a}$ and $t_a’, s_a’$ , where $E_{mid2} := E_a/\left\langle K_a’\right\rangle \cong E_{mid1}$ and $K_a’ = 2^{a/2}(t_a’P_a’ + s_a’Q_a’)$
Denote $\phi_1: E_0 \to E_{mid1}$, $\phi_2: E_a \to E_{mid2}$, $\sigma: E_{mid1} \xrightarrow{\sim} E_{mid2}$ . We can reconstruct the isogeny $\phi_a = \hat{\phi_2} \circ \sigma \circ \phi_1$ with the help of sagemath.
Since $\phi_a(P_a+s_aQ_a) = O$, we have $\phi_a(P_a) = -s_a\phi_a(Q_a)$. So we can solve the discrete logarithm to recover $s_a$
Now it is sufficient to follow SIDH protocol to find $j_{AB}$.
Some Further Optimization
In fact, there are some further optimization for the attack [3] and the computation of isogeny chain (optimal strategy) [2, 4].
# Get j-invariant from coeff (coeff in the form of fraction) defget_j_invariant(A: tuple): Ax, Az = A Ax_square = Ax**2 Az_square = Az**2 Jx = 256 * (Ax_square - 3 * Az_square) ** 3# Jx = 256(Ax^2 - 3Az^2)^3 Jz = Ax_square * Az_square**2 - 4 * Az_square**3# Jz = Ax^2*Az^4 - 4Az^6 if Jz == 0: print(f"A = {A}") return Jx * Jz ** (-1)
# phi: E -> E/<P> =: E2 # All points of input and output are projective x-coordinate, # i.e. if P = (XP: YP: ZP) ∈ E, then P is (XP, ZP) in the code # Input: E's A24, kernel point K of order 2, T the point to push # Output: E2's A24, phi(T) defisog2(K, T): if K[0] == 0: print("Meet the case we cannot use isog2.") returnNone
defxmul_2k(A24: tuple, k: int, T: tuple): assert k >= 0
defxdbl(P: tuple, A24: tuple) -> tuple: XP, ZP = P # assert XP != 0 and ZP != 0 if XP == 0or ZP == 0: print(f"k={k}") # print(f'XP={XP}') # print(f'ZP={ZP}') V1 = XP + ZP # line 1 of my pseudo code V1 **= 2 V2 = XP - ZP V2 **= 2 Z2P = A24[1] * V2 X2P = Z2P * V1 # line 6 of my pseudo code V1 -= V2 Z2P += A24[0] * V1 Z2P *= V1 return X2P, Z2P
for _ inrange(k): T = xdbl(T, A24) return T
# A: Estart affine coeff, T: kernel point (sagemath EC point object), k: T has order 2**k (same as the degree of this isogeny) defisog_2k(A, T, k): T = T[0], T[2] A24 = xA24(A) if k % 2 == 1: # T has order 2^a P = T P = xmul_2k(A24, k - 1, P) # now P has order 2 result_isog2 = isog2(P, T) if result_isog2 isNone: returnNone A24, T = result_isog2 k -= 1 assert k % 2 == 0 for i inrange(2, k + 2, 2): # T has order 2^(a-i+1) P = T P = xmul_2k(A24, k - i, P) # now P has order 4 result_isog4 = isog4(P, T) if result_isog4 isNone: returnNone A24, T = result_isog4
Pa_new = 2 ** (a - steps) * Pa Qa_new = 2 ** (a - steps) * Qa sa = sa_start
Ra = Pa_new + sa * Qa_new while sa < sa_stop: # Using the basis in SIKE spec, our formula never fail. Jnew, Anew = isog_2k(A0, Ra, steps) # table[Jnew] = (Anew, sa) table[Jnew] = sa # table[str(Jnew)] Ra += Qa_new sa += 1 return table
time1 = time.time()
steps = a // 2 + 1
print("Start computing table.")
# NOTE: The following code for parallel will raise segmentation fault on my PC... # Maybe the problem has something to do with thread lock of finite field element?
## multiproc # num_proc = 12 # # assert num_proc % 2 == 0 # size_per_proc = 2**steps // num_proc # parameters = [[i*size_per_proc, (i+1)*size_per_proc, steps] for i in range(0, num_proc)] # parameters[-1][1] = 2**steps # print(f'parameters = {parameters}') # with mp.Pool(num_proc) as p: # tables = p.starmap(compute_hash_table, parameters)
# NOTE: You need to convert finite field type to str, Integer type to int before json.dump # with open('hash_table.json', 'w') as f: # json.dump(table2)
### from another side (start from Ea)
Pa_E0 = deepcopy(Pa) Qa_E0 = deepcopy(Qa)
# First choose a nice basis for Ea[2^b] Pa = Ea(0) Qa = Ea(0) whileTrue: Qa = Ea.random_point() Qa = 3**b * Qa Ra = 2 ** (a - 1) * Qa if Ra.is_zero(): continue assert Ra.order() == 2 if Ra.xy()[0] == 0: break else: print(f"Ra = {Ra}") print("Qa found.") whileTrue: Pa = Ea.random_point() Pa = 3**b * Pa if Pa.weil_pairing(Qa, 2**a) ** (a - 1) != 1: break print("Pa found.")
assert Pa.order() == 2**a and Qa.order() == 2**a assert Pa.weil_pairing(Qa, 2**a) ** (2 ** (a - 1)) != 1
steps = a - steps
defsearch_from_Ea(steps=steps): # Save the collision with hashtable where the kernel is taPa + saQa collision_isogenies = [] # Save failed isogeny(ta, sa) where the kernel is taPa + saQa Pa_new = 2 ** (a - steps) * Pa Qa_new = 2 ** (a - steps) * Qa failed_isogenies = []
defsearch_one_isogeny(ta, sa, Ra): result_isog2k = isog_2k(ka, Ra, steps) if result_isog2k isNone: print(f"Isogeny failed for ta={ta}, sa={sa}") failed_isogenies.append((ta, sa)) return Jnew, Anew = result_isog2k if Jnew in table2: collision_isogenies.append((ta, sa, table2[Jnew])) print("Found one collision.") print(f"Start from Ea, sa={sa}, ta={ta}") print(f"Start from E0, sa={table2[Jnew]}") print(f"Meet at A={Anew}") return
# First try these 2**steps SIDH-like isogeny sa = 0 Ra = Pa_new while sa < 2**steps: search_one_isogeny(ta=1, sa=sa, Ra=Ra) Ra += Qa_new sa += 1 # Note that we also need to try these isogenies correspond to <(0, 1)>, <(2, 1)>, ..., <(2**steps, 1)> ta = 0 Ra = Qa_new two_Pa_new = 2 * Pa_new iflen(collision_isogenies) == 0: print("Collision not found in SIDH like isogenies") print("Start searching the second part!") while ta < 2**steps: search_one_isogeny(ta=ta, sa=1, Ra=Ra) Ra += two_Pa_new ta += 2 return collision_isogenies, failed_isogenies
## decryption h = bytes_to_long(hashlib.sha256(str(jab).encode()).digest()) flag = long_to_bytes(h ^ enc) print(f'flag = {flag}')
Unintended Solution
Actually, there are some alternative ways to find a collision.
In [5] there’s an attack leverages modular polynomial, and it compute the j-invariant only when computing 2-isogeny, instead of computing coefficient of the codomain. That’s really cool!
Another way is to get order-two points with sagemath’s division_points when going one step in DFS. (I thank hash_hash for telling me that) It seems that division_points make use of division polynomial to get these order-two points with low cost. Usually, when the degree of isogeny $l$ is a larger prime, we need to sample a random point $R$ and compute $(p+1)/l * R$. This is one of the main reasons why isogeny is slow! Another way is to push some points through the isogeny, but I think this is complicated in the scenario of MITM attack, perhaps not doable.
Here’s a MITM snippet using division_points and DFS from hash_hash.
from Crypto.Util.number import * defdp(way, E): iflen(way) > deepth: return0 ker = E(0).division_points(2)[1:] j_next = [E.isogeny_codomain(k).j_invariant() for k in ker] for j in j_next: if j notin forward.keys(): forward[j] = way+[j] dp(way+[j], EllipticCurve(j=Fp2(j)))
defdp_find(way, E): iflen(way) > deepth: return0 ker = E(0).division_points(2)[1:] j_next = [E.isogeny_codomain(k).j_invariant() for k in ker] for j in j_next: if j in forward.keys(): col = forward[j]+way[::-1] print("FIND!", len(col)) elif j notin back.keys(): back[j] = way+[j] dp_find(way+[j], EllipticCurve(j=Fp2(j)))
a = 38 b = 25 p = 2**a * 3**b - 1
assert is_prime(p) Fp = GF(p)
Fpx = PolynomialRing(Fp, "x") x = Fpx.gen() Fp2 = Fp.extension(x**2 + 1, "ii") ii = Fp2.gen()
By the way, a similar challenge had already appeared in the race SEETF 2023. Only after the race did I recognize that… See maple’s writeup for IsogenyMaze [6].
]]><p>Here’s the official writeup for S0DH, including the challenge and solutions (intended and unintended).<br>LadderLeak论文分享https://su1yu4n.github.io/2023/11/03/LadderLeak%E8%AE%BA%E6%96%87%E5%88%86%E4%BA%AB/2023-11-03T03:42:03.000Z2024-11-23T07:41:59.925Z去年讲了论文：LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage，现在公开幻灯片，请点击阅读更多获取。
]]><p>去年讲了论文：<a href="https://eprint.iacr.org/2020/615">LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage</a>，<strong>现在公开幻灯片，请点击阅读更多获取</strong>。</p>复变函数笔记https://su1yu4n.github.io/2023/09/05/%E5%A4%8D%E5%8F%98%E5%87%BD%E6%95%B0%E7%AC%94%E8%AE%B0/2023-09-05T13:38:40.000Z2024-11-23T07:39:12.058Z（9.21更新， 不过当时部署之后没更新显示…）
# sagemath 9.5 from Crypto.Util.number import long_to_bytes
# Before running, modify your filename and add "DDH_instances = " at the beginning of the file. load('DDH_instances.sage')
# curve p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab K = GF(p) a = K(0x00) b = K(0x04) E = EllipticCurve(K, (a, b)) # G = E(0x17F1D3A73197D7942695638C4FA9AC0FC3688C4F9774B905A14E3A3F171BAC586C55E83FF97A1AEFFB3AF00ADB22C6BB, 0x08B3F481E3AAA0F1A09E30ED741D8AE4FCF5E095D5D00AF600DB18CB2C04B3EDD03CC744A2888AE40CAA232946C5E7E1) E.set_order(0x73EDA753299D7D483339D80809A1D80553BDA402FFFE5BFEFFFFFFFF00000001 * 0x396C8C005555E1568C00AAAB0000AAAB)
G = E(3745324820672390389968901155878445437664963280229755729082200523555105705468830220374025474630687037635107257976475, 2578846078515277795052385204310204126349387494123866919108681393764788346607753607675088305233984015170544920715533) n = G.order()
# Embedding degree of the curve k = 12
defsolve_ECDDHP(DDH_instances, G, Ep, m, n): """ Parameters: DDH_instances - list consists of (aG, bG, cG), where aG, bG, cG are EC_point.xy() m - embedding degree of <G> n - G's order. """ sols = [] Fpm.<x> = GF(p^m) Epm = Ep.base_extend(Fpm) G = Epm(G) for ins in DDH_instances: aG, bG, cG = ins aG = Epm(aG); bG = Epm(bG); cG = Epm(cG) # e_aG_bG = aG.weil_pairing(bG, n) e_aG_bG = aG.tate_pairing(bG, n, m) e_G_cG = G.tate_pairing(cG, n, m) if e_aG_bG == e_G_cG: sols.append(True) else: sols.append(False) return sols
sols = solve_ECDDHP(DDH_instances, G, E, k, n) # print(sols)
pt = 0 for i inrange(len(sols)): pt += sols[i] * (2^i)
flag = long_to_bytes(pt) print(flag) print(b'CatCTF{' + flag + '}')
# sagemath 9.5 from Crypto.Util.number import long_to_bytes # Before running, modify your filename and add "DDH_instances = " at the beginning of the file. load('DDH_instances.sage')
p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab K = GF(p) a = K(0x00) b = K(0x04) E = EllipticCurve(K, (a, b)) E.set_order(0x73EDA753299D7D483339D80809A1D80553BDA402FFFE5BFEFFFFFFFF00000001 * 0x396C8C005555E1568C00AAAB0000AAAB) G = E(3745324820672390389968901155878445437664963280229755729082200523555105705468830220374025474630687037635107257976475, 2578846078515277795052385204310204126349387494123866919108681393764788346607753607675088305233984015170544920715533)
defPohlig_Hellman(G, Y, ord_G, facts): """ Using the idea of Pohlig-Hellman. G: EC group generator G facts: list, some small factors of the group order return x: discrete log of Y modulo prod(facts) """ new_bases = [(ord_G // facts[i])*G for i inrange(len(facts))] assertlen(new_bases) == len(facts) xi = [new_bases[i].discrete_log((ord_G // facts[i])*Y, facts[i]) for i inrange(len(facts))] # print(f"xi = {xi}") x = CRT(xi, facts) return x
order = G.order() # factors of order, pairwise coprime facts = [3, 11, 10177] s = prod(facts) m = ''
import tqdm for i in tqdm.tqdm(range(len(DDH_instances))): aG, bG, cG = DDH_instances[i] aG = E(aG); bG = E(bG); cG = E(cG) a, b, c = [Pohlig_Hellman(G, E(Pt), order, facts) for Pt in (aG, bG, cG)] if (a*b) % s == c: m += '1' else: m += '0' print(m)
This attack is a chosen-ciphertext attack. It depends on the attacker being able to submit arbitrary ciphertexts to the oracle. As such, you can prevent the attack by authenticating your ciphertexts. You might do this by switching from CBC mode to an authenticated encryption mode like GCM or OCB; alternately, keep CBC mode but start MACing your ciphertexts using something like HMAC.
Removing the oracle would also prevent the attack. However, hopefully the example oracles above gave you some sense of how nontrivial this actually can be in practice. This is a cryptographic problem and it calls for a cryptographic solution; anything less is likely to be fragile and error-prone.
By adding authentication tags and checking them prior to decryption, we guarantee that we’ll be able to reject any attacker-crafted messages without ever decrypting them, preventing us from leaking any information at all about their decrypted contents, padding-related or otherwise.
# Settings apply across all Linux distros running on WSL 2 [wsl2]
# Limits VM memory to use no more than 14 GB, this can be set as whole numbers using GB or MB memory=14GB
# Sets the VM to use six virtual processors processors=6
# Specify a custom Linux kernel to use with your installed distros. The default kernel used can be found at https://github.com/microsoft/WSL2-Linux-Kernel # kernel=C:\\temp\\myCustomKernel
# Sets additional kernel parameters, in this case enabling older Linux base images such as Centos 6 # kernelCommandLine = vsyscall=emulate
# Sets amount of swap storage space to 14GB, default is 25% of available RAM swap=14GB
# Sets swapfile path location, default is %USERPROFILE%\AppData\Local\Temp\swap.vhdx swapfile=E:\\temp\\wsl-swap.vhdx
# Disable page reporting so WSL retains all allocated memory claimed from Windows and releases none back when free pageReporting=false
# Turn off default connection to bind WSL 2 localhost to Windows localhost localhostforwarding=true
# Turns on output console showing contents of dmesg when opening a WSL 2 distro for debugging debugConsole=true
# Enable experimental features [experimental] sparseVhd=true
# For network purpose. Only useful when windows version is 23H2, and wsl --update --pre-release # Currently only a windows insider of Release Preview Channel can use this.. networkingMode=mirrored dnsTunneling=true firewall=true autoProxy=true
from Crypto.Util.number import getStrongPrime, getPrime, getRandomNBitInteger from gmpy2 import gcd, invert from math import floor, log
# Generate r instances of RSA with the same d. defgen_instance(r=2, bit_len=2048, delta_r=None,delta=0, debug=False): if delta_r isNone: delta_r = 0.5 - 0.5 / (r+1) - log(6, 2^bit_len) + delta # d = getRandomNBitInteger(int(2 * bit_len * delta_r)) d = getPrime(floor(bit_len * delta_r))
if d & 1 == 0: d += 1 print("The d we choose is: {}".format(d)) print("d satisfy the condition: d < Nr^{}".format(delta_r)) print("\n") print("Generating instances ...") instance = [] for i inrange(r): whileTrue: p = getStrongPrime(bit_len//2) q = getStrongPrime(bit_len//2) # p = getPrime(bit_len) # q = getPrime(bit_len) n = p * q phi = (p-1)*(q-1) if gcd(d, phi) == 1: e = invert(d, phi) this = {'n':n, 'e':e, 'd':d} instance.append(this) break print("Done.") if debug: print("The RSA Instances we choose is below:") for i inrange(r): print("instance {}: {}".format(i, instance[i])) return instance
参考资料
M. Jason Hinek. On the Security of Some Variants of RSA. 2007.
M. Jason Hinek. Cryptanalysis of RSA and Its Variants. 2009
defLLL_v0(M, delta=0.75): B = deepcopy(M) Q, mu = B.gram_schmidt() n, k = B.nrows(), 1 while k < n: # size reduction step for j inreversed(range(k)): ifabs( mu[k][j] ) > 0.5: B[k] = B[k] - round( mu[k][j] ) * B[j] Q, mu = B.gram_schmidt() # swap step if Q[k].dot_product(Q[k]) >= (delta - mu[k][k-1]^2) * Q[k-1].dot_product(Q[k-1]): k = k + 1 else: B[k], B[k-1] = B[k-1], B[k] Q, mu = B.gram_schmidt() k = max(k-1,1) return B
if delta < 0.25: print("delta should be greater than 0.25. Choose delta = 0.75 now.") alpha = delta if0.25 < delta < 1else0.75 x = M n = M.nrows() defreduce(k, l): do_reduce = False ifabs(mu[k,l]) > 0.5: do_reduce = True y[k] = y[k] - mu[k,l].round() * y[l] for j inrange(l): mu[k,j] -= mu[k,l].round() * mu[l,j] mu[k,l] = mu[k,l] - mu[k,l].round()
return defexchange(k): y[k-1], y[k] = y[k], y[k-1] NU = mu[k,k-1] delta = gamma[k] + NU ^ 2 * gamma[k-1] mu[k,k-1] = NU * gamma[k-1] / delta # all above is right gamma[k] = gamma[k] * gamma[k-1] / delta gamma[k-1] = delta
for j inrange(k-1): mu[k-1,j], mu[k,j] = mu[k,j], mu[k-1,j] for i inrange(k+1, n): xi = mu[i,k] mu[i,k] = mu[i,k-1] - NU * mu[i,k] mu[i,k-1] = mu[k,k-1] * mu[i,k] + xi return # step (1) y = deepcopy(x) # step (2) y_star, mu = y.gram_schmidt() gamma = [y_star[i].norm() ^ 2for i inrange(n)] # step (3) k = 1 # step (4) while k < n: # step (4)(a) reduce(k, k-1)
# step (4)(b) if gamma[k] >= (alpha - mu[k,k-1]^2) * gamma[k-1]: # (i) for l inreversed(range(k-1)): reduce(k, l) # (ii) k = k + 1 else: # (iii) exchange(k) # (iv) if k > 1: k = k-1
H-LLL以$\,\mathrm{L}^2$算法为基础，在计算施密特正交化（QR分解）时使用householder算法替换了 Cholesky算法从而加快了运行速度。（具体做法并没这么简单，为了防止精度损失导致结果与原来不同，整个算法被重组）。论文：H-LLL: Using Householder Inside LLL
2008年，Gama和Nyugen提出了slide reduction。算法结构很漂亮，并且它的理论效能强于使用中止技术的BKZ。不过最初的slide reduction算法，其实际表现远不如BKZ 2.0算法。论文：Finding Short Lattice Vectors within Mordell’s Inequality
Hoffstein J , Pipher J C , Silverman J H . An Introduction to Mathematical Cryptography. 2008.
Galbraith S D . Mathematics of Public Key Cryptography: Lattices. 2012.
Nguyen P Q , D Stehlé. Low-Dimensional Lattice Basis Reduction Revisited. 2009.
Lenstra A . Factoring polynomial with rational coefficients. 1982.
Bremner M R . Lattice Basis Reduction: An Introduction to the LLL Algorithm and Its Applications. 2011.
Schnorr C P, Euchner M. Lattice basis reduction: improved practical algorithms and solving subset sum problems. 1994.
Gama, Nicolas, et al. “Lattice Enumeration Using Extreme Pruning.” EUROCRYPT’10 Proceedings of the 29th Annual International Conference on Theory and Applications of Cryptographic Techniques, 2010, pp. 257–278.
Chen Y, Nguyen P Q. BKZ 2.0: Better lattice security estimates. 2011.
PQ Nguyen, D Stehlé. Floating-Point LLL Revisited. 2005.
郑永辉,刘永杰,栾鸾.格基约化算法及其在密码分析中的应用综述. 2020.
Regev L O , Kaplan S E . Lattices in Computer Science LLL Algorithm. 2013.
Cohen H . A Course in Computational Algebraic Number Theory. 2013.
