Method, device, equipment and storage medium for attacking elliptic curve signature algorithm

Abstract

The present application provides a method, device, terminal device and storage medium for attacking an elliptic curve signature algorithm, and relates to the field of information security technology. The method includes: obtaining a first coordinate point on an elliptic curve; performing multiple signature operations on a message to be signed, and injecting errors into the random number generated during each signature operation to obtain multiple erroneous random numbers; calculating multiple second coordinate points on the elliptic curve according to the multiple erroneous random numbers and a first preset formula; determining the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point and the multiple second coordinate points. The random number generated during the signature operation is attacked, so that the coordinate point calculated after the attack is still on the original elliptic curve, which is not easy to be detected and thus not easy to be defended. The entire attack process is simple, which reduces the difficulty of cracking the private key, and realizes the rapid and accurate acquisition of the private key of the elliptic curve signature algorithm.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, apparatus, terminal device and storage medium for attacking an elliptic curve signature algorithm. Background Art

[0002] Compared with traditional signature algorithms, the elliptic curve signature algorithm requires a shorter key length at the same security strength and is more suitable for application in resource-constrained chips. For example, the elliptic curve signature algorithm is very suitable for Internet of Vehicles application environments with limited processing power, storage space, bandwidth and power consumption.

[0003] Attack methods against the elliptic curve signature algorithm are constantly emerging. However, the existing attack methods are difficult and easy to defend, making it impossible to quickly and accurately obtain the private key of the elliptic curve signature algorithm. Summary of the invention

[0004] In view of this, the present application provides a method, apparatus, terminal device and storage medium for attacking an elliptic curve signature algorithm to solve the problem that existing attack methods are difficult and easily defended, resulting in the inability to quickly and accurately obtain the private key of the elliptic curve signature algorithm.

[0005] In a first aspect, the present application provides a method for attacking an elliptic curve signature algorithm, comprising: obtaining a first coordinate point on an elliptic curve, the first coordinate point being calculated based on a correct signature value corresponding to a message to be signed, the correct signature value being obtained by performing a normal signature operation on the message to be signed based on the elliptic curve signature algorithm;

[0006] Perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple erroneous random numbers;

[0007] Calculate and obtain multiple second coordinate points on the elliptic curve according to the multiple error random numbers and the first preset formula;

[0008] A private key of an elliptic curve signature algorithm is determined according to the correct signature value, the first coordinate point, and the plurality of second coordinate points.

[0009] In the above scheme, the random number generated during the signature operation is attacked, so that the coordinate points calculated after the attack are still on the original elliptic curve, which is not easy to detect and thus not easy to defend. Then, based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and the multiple second coordinate points calculated under the attack, the private key of the elliptic curve signature algorithm is determined. The entire attack process is simple, which reduces the difficulty of cracking the private key and realizes the rapid and accurate acquisition of the private key of the elliptic curve signature algorithm.

[0010] In one possible implementation, the random number includes multiple bit values, multiple signature operations are performed on the signed message, and errors are injected into the random number generated during each signature operation to obtain multiple erroneous random numbers, including: for each signature operation, the value of one bit in the random number generated during the signature operation is changed to obtain an erroneous random number.

[0011] In a possible implementation, multiple second coordinate points on the elliptic curve are calculated based on multiple error random numbers and a first preset formula, including:

[0012] Multiple erroneous signature values ​​are calculated based on multiple erroneous random numbers;

[0013] A plurality of second coordinate points are calculated based on the plurality of erroneous signature values ​​and the first preset formula.

[0014] In a possible implementation, determining a private key of an elliptic curve signature algorithm according to a correct signature value, a first coordinate point, and a plurality of second coordinate points includes:

[0015] Performing a differential operation on the first coordinate point and the plurality of second coordinate points to obtain a plurality of logic values;

[0016] Generate target random numbers based on multiple logical values;

[0017] The private key is calculated based on the second preset formula, the target random number and the correct signature value.

[0018] In a possible implementation, the number of times the signature operation is performed on the message to be signed is determined according to the number of bits of the random number and a preset value range.

[0019] In a possible implementation, after determining the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point, and the plurality of second coordinate points, the method further includes: determining a defense strategy of the elliptic curve signature algorithm.

[0020] In a second aspect, the present application provides a device for attacking an elliptic curve signature algorithm, comprising:

[0021] an acquiring unit, configured to acquire a first coordinate point on the elliptic curve, wherein the first coordinate point is calculated according to a correct signature value corresponding to the message to be signed, and the correct signature value is obtained by performing a normal signature operation on the message to be signed according to the elliptic curve signature algorithm;

[0022] A calculation unit, used to perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple erroneous random numbers;

[0023] A calculation unit, configured to calculate a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and a first preset formula;

[0024] A determination unit is used to determine the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point and the multiple second coordinate points.

[0025] In a third aspect, the present application provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the above-mentioned first aspects when executing the computer program.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, it implements the method described in any of the above-mentioned first aspect.

[0027] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method described in any one of the above-mentioned first aspects.

[0028] In a sixth aspect, an embodiment of the present application provides a chip, including a processor, for calling and running a computer program from a memory, so that a terminal device equipped with the chip executes the method described in any of the above-mentioned first aspects.

[0029] For the beneficial effects of other aspects of the present application, please refer to the description of the beneficial effects of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 is a schematic flow chart of a method for attacking an elliptic curve signature algorithm provided by an exemplary embodiment of the present application;

[0031] Figure 2 is a specific flow chart of step S103 of a method for attacking an elliptic curve signature algorithm shown in another exemplary embodiment of the present application;

[0032] Figure 3 It is a specific flow chart of step S104 of a method for attacking an elliptic curve signature algorithm shown in another exemplary embodiment of the present application;

[0033] Figure 4 A schematic diagram of a device for attacking an elliptic curve signature algorithm provided in an embodiment of the present application;

[0034] Figure 5 It is a schematic diagram of a terminal device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] Compared with traditional signature algorithms, the elliptic curve signature algorithm requires a shorter key length at the same security strength, and is more suitable for application in resource-constrained chips. For example, the elliptic curve signature algorithm is very suitable for Internet of Vehicles application environments with limited processing power, storage space, bandwidth and power consumption, and is a domestic public key cryptography solution in my country's Internet of Vehicles security technology.

[0037] Security chips are the core and cornerstone of effectively protecting the security of my country's Internet of Vehicles. Among them, security chips refer to trusted platform modules, which are devices that can independently generate keys and perform encryption and decryption. They have independent processors and storage units inside, which can store keys and feature data, and provide encryption and security authentication services for computers. When encryption is performed with security chips, the keys are stored in hardware, and stolen data cannot be decrypted, thereby protecting business privacy and data security.

[0038] Although security chips have complex encryption and decryption algorithms and key protection mechanisms, they are still vulnerable to error injection attacks in recent years, which leads to transient logic errors in the execution of encryption algorithms. Attackers analyze correct and incorrect encryption results, eventually causing key leakage.

[0039] Error injection attacks on security chips have been listed as an important type of attack in the US Federal Information Processing Standard "FIPS140-3". Therefore, studying new error attack methods can help designers discover potential risks in algorithms and hardware as early as possible, so that corresponding defense measures can be taken during the design stage to avoid possible risks.

[0040] For example, based on the existing attack methods of elliptic curve signature algorithm, new attack methods of elliptic curve signature algorithm are studied, and according to the new attack methods of elliptic curve signature algorithm, potential risks in attacking elliptic curve signature algorithm and hardware are found, and corresponding defense strategies are formulated to avoid possible risks. The security of elliptic curve algorithm can be evaluated before elliptic curve cryptographic products leave the factory, reducing the situation of security vulnerabilities in elliptic curve cryptographic products after leaving the factory.

[0041] It can be seen that the research on attack methods of elliptic curve signature algorithm is very necessary. According to the different attack positions, that is, the different positions of fault injection into the elliptic curve, the existing attack methods can be divided into base point attack and elliptic curve parameter attack. The former injects faults into the point multiplication operation link and then obtains the private key, while the latter cracks the private key by combining the discrete logarithm problem on the elliptic curve (ECDLP).

[0042] First of all, the above two attack methods are very complicated, and there is a certain degree of randomness in the cracking. When the largest prime factor of the base point order of the ECDLP method is large enough to reach a certain number of digits, it is impossible to crack it within a limited computable time with the current computer level.

[0043] Secondly, the common point of the above two attack methods is that the intermediate points and output points are not on the original secure elliptic curve, that is, they are moved to a new weak elliptic curve. This attack method is very easy to detect, that is, by checking whether the base point of the asymmetric cryptographic algorithm based on the elliptic curve (SM2) approved by the national cryptography administration, all the intermediate points used for calculation, and the final output point are on the secure elliptic curve, it can be determined whether the current algorithm is secure. If any point is not on the secure elliptic curve, the output is blocked.

[0044] In addition, both of these attack methods are based on the point multiplication operation. However, in actual operations, the point multiplication is only an intermediate link in the signature or encryption process. The point multiplication result data used for attack and cracking is an intermediate quantity in the operation process and cannot be obtained, especially in security chips. Therefore, the existing attack methods are difficult and easy to defend, resulting in the inability to quickly and accurately obtain the private key of the elliptic curve signature algorithm.

[0045] In view of this, the present application provides a method, apparatus, terminal device and storage medium for attacking an elliptic curve signature algorithm. By attacking the random number generated during the signature operation, the coordinate points calculated after the attack are still on the original elliptic curve, which is not easy to detect and thus not easy to defend. Then, based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and the multiple second coordinate points calculated under the attack, the private key of the elliptic curve signature algorithm is determined. The entire attack process is simple, and there is no need to gradually narrow the scope to infer the private key as in the prior art, which reduces the difficulty of cracking the private key and achieves fast and accurate acquisition of the private key of the elliptic curve signature algorithm. Moreover, studying this attack method can help designers discover potential risks in algorithms and hardware as early as possible, so that corresponding defense measures can be taken in the design stage to avoid possible risks.

[0046] The technical solution of the present application is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0047] See also Figure 1 , Figure 1 This is a schematic flow chart of a method for attacking an elliptic curve signature algorithm provided by an exemplary embodiment of the present application. The execution subject of the method for attacking an elliptic curve signature algorithm provided by the present application is a terminal device, wherein the terminal device includes but is not limited to a vehicle-mounted computer, a tablet computer, a computer, a smart phone, a wearable device, a personal digital assistant (PDA), and other devices. Alternatively, an application or a small program may be installed on the terminal device in advance, and the method for attacking the elliptic curve signature algorithm may be executed using the installed application or small program.

[0048] The execution subject of the method for attacking the elliptic curve signature algorithm provided in the present application can also be various types of servers. For example, the server can be an independent server, or it can be a cloud service that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0049] See also Figure 1 , Figure 1 FIG. 1 is a schematic flow chart of a method for attacking an elliptic curve signature algorithm provided by an exemplary embodiment of the present application. Figure 1 The method shown may include: S101 to S104, which are specifically as follows:

[0050] S101: Obtain the first coordinate point on the elliptic curve.

[0051] The elliptic curve can be understood as a formula that describes a set of specific points, which is essentially a mathematical equation. The first coordinate point is a coordinate point on the elliptic curve. The first coordinate point is calculated based on the correct signature value corresponding to the message to be signed. The correct signature value is obtained by performing a normal signature operation on the message to be signed according to the elliptic curve signature algorithm.

[0052] The message to be signed refers to the text, that is, the text or string that is not encrypted. In this example, M is used to represent the plain text. Based on the elliptic curve signature algorithm, a normal signature operation is performed on the message to be signed to obtain the correct signature value (signature pair) corresponding to the message to be signed. In this example, (r, s) is used to represent the correct signature value (signature pair). Among them, the normal signature operation refers to the signature operation performed without any attack. The signature value obtained at this time is also called the correct signature value.

[0053] Exemplarily, the elliptic curve signature algorithm may include an asymmetric algorithm such as an SM2 signature algorithm, an SM9 signature algorithm, etc. In this example, the SM2 signature algorithm is used as an example for description.

[0054] For example, the user's own message and the parameters of the elliptic curve are obtained in advance. The user's own message may include the user's identity information, and the parameters of the elliptic curve may include the base point of the elliptic curve, which can be understood as the first point in the elliptic curve. In this example, P is used to represent the base point.

[0055] The user's own message and the parameters of the elliptic curve are hashed to obtain a hash value. A hash operation is also called a hash function, which is a function that changes an input message string of any length into an output string of fixed length. The hash value is also called a hash value. In this example, Z is used. A Indicates the hash value of user A.

[0056] Specifically, input plain text M. Use hash value Z A calculate The value of That is

[0057] According to the hash function H and The value of e is calculated by

[0058] Generate a random number k using a random number generator, k∈[1,n-1];

[0059] Calculate k*P=(x1,y1), where (x1,y1) represents the coordinate point on the elliptic curve;

[0060] Calculate r = (e + x1) mod n, where n represents the order of the elliptic curve. If r = 0 or r + k = n, return to the step of using the random number generator to generate a random number k;

[0061] If r≠0 or r+k≠n, then calculate s=((1+d A ) -1 ·(k-rd A ))mod n, where d ADenote the private key. If s = 0, then return to the step of generating a random number k using a random number generator;

[0062] If s ≠ 0, then output the correct signature value (r, s) and the plaintext M.

[0063] Exemplarily, calculate the first coordinate point according to the correct signature value (r, s) corresponding to the message to be signed and the first preset formula. In this example, the first coordinate point is denoted as Q(x1, y1).

[0064] Since r = (e + x1) mod n, use i to represent the bit of x1, i = 0, 1, 2, 3....; i takes the value that makes 0 < x1 < n, and further Q satisfies the elliptic curve y 2 + xy = x 3 + 1, and the first preset formula is deduced as:

[0065]

[0066] Substitute the values of r, i, n, and e into the first preset formula to calculate the value of the first coordinate point Q(x1, y1).

[0067] S102: Perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers.

[0068] The difference between the signature operation in step S102 and the signature operation in step S101 is that the signature operation in step S101 is a signature operation performed without any attacks, while the signature operation in step S102 injects attacks into the random numbers generated during the signature operation.

[0069] Exemplarily, perform multiple signature operations on the message to be signed. During each signature operation, a random number is generated using a random number generator, and an error is injected into the generated random number, that is, a fault is injected. The random number after injecting the error is the error random number. In this example, the error random number is denoted as k'.

[0070] Optionally, in a possible implementation, the random numbers generated during the signature operation may include values of multiple bits. Perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers, including: for each signature operation, change the value of one bit in the random number generated during the signature operation to obtain the error random number.

[0071] Exemplarily, the number of bits included in the random number can be set according to the actual situation. For example, in this instance, the random number may include values of 233 bits. This is only for illustrative purposes and is not limited thereto.

[0072] For each signature operation, the value of one bit in the random number generated during the signature operation is changed, that is, the random number in the scalar multiplication step during the signature operation is injected with a one-bit fault each time, and the random number injected with the fault is the wrong random number k′.

[0073] That is to say, injecting an error (injecting a fault) into a random number actually means changing the value of a bit in the random number. For example, if the value of a bit is 1, the injected error can be to change 1 to 0; for another example, if the value of a bit is 0, the injected error can be to change 0 to 1.

[0074] In a possible implementation, errors can be injected in sequence according to the order of the values ​​of each bit in the random number. For example, multiple signature operations are performed on the message to be signed. During the first signature operation, the value of the first bit in the random number generated during the signature operation is changed to obtain an erroneous random number. During the second signature operation, the value of the second bit in the random number generated during the signature operation is changed to obtain an erroneous random number. This process is repeated until errors are injected into the value of each bit in the random number, resulting in multiple erroneous random numbers.

[0075] In another possible implementation, errors can be randomly injected into the values ​​of each bit in the random number. After each error is injected, the position of the error injected this time is recorded, such as the Nth bit. When injecting errors later, avoid the value of the bit where the error has been injected. Repeatedly execute until the value of each bit in the random number is injected with an error, and obtain multiple erroneous random numbers.

[0076] In this implementation, during each signature operation, the value of one bit in the random number generated during the signature operation is changed, thereby realizing an attack on the random number generated during the signature operation. And each time the value of one bit is changed, it is convenient to quickly calculate the wrong random number and the second coordinate point in the subsequent process, thereby indirectly improving the speed of cracking the private key.

[0077] S103: Calculate and obtain a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and the first preset formula.

[0078] Exemplarily, according to the signature operation process described in step S101, the signature operation is performed on the signature message. It is worth noting that in this process, the random number k in the signature operation process in step S101 needs to be replaced with an incorrect random number k', and the rest of the process is similar, and an incorrect signature value (signature pair) is calculated. In this example, (r', s') is used to represent the incorrect signature value (signature pair).

[0079] According to the method described in step S101, the first coordinate point is calculated according to the correct signature value (r, s) corresponding to the message to be signed and the first preset formula, and the second coordinate point is calculated according to the wrong signature value (r′, s′) corresponding to the message to be signed and the first preset formula. In this example, Q′(x′1, y′1) is used to represent the second coordinate point. This process is performed for each signature operation process, and multiple second coordinate points on the elliptic curve can be calculated.

[0080] S104: Determine a private key of an elliptic curve signature algorithm according to the correct signature value, the first coordinate point, and the plurality of second coordinate points.

[0081] Exemplarily, a differential operation is performed with the first coordinate point and each second coordinate point to obtain multiple logical values. A target random number is generated using multiple logical values, and the target random number includes multiple bits, and the logical value represents the value of any bit in the target random number. It is worth noting that the number of bits in the target random number is the same as the number of logical values. According to the second preset formula, the target random number and the correct signature value, the private key of the elliptic curve signature algorithm is calculated.

[0082] In this embodiment, by attacking the random number generated during the signature calculation process, the coordinate point calculated after the attack is still on the original elliptic curve, which is not easy to be detected and thus not easy to be defended. Then, based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and the multiple second coordinate points calculated under the attack, the private key of the elliptic curve signature algorithm is determined. The entire attack process is simple, and there is no need to gradually narrow the scope to infer the private key as in the prior art, which reduces the difficulty of cracking the private key and achieves the rapid and accurate acquisition of the private key of the elliptic curve signature algorithm.

[0083] See also Figure 2 , Figure 2 It is a specific flow chart of step S103 of a method for attacking an elliptic curve signature algorithm shown in another exemplary embodiment of the present application. Optionally, in a possible implementation, the above S103 may include S1031 to S1032, which are as follows:

[0084] S1031: Calculate multiple erroneous signature values ​​based on multiple erroneous random numbers.

[0085] For example, the user's own message and the parameters of the elliptic curve can be retrieved. A hash operation is performed on the user's own message and the parameters of the elliptic curve to obtain a hash value. The hash value Z used in step S101 can also be directly used. A , subject to actual situation, no limitation is made here.

[0086] Specifically, input plain text M. Use hash value ZA calculate The value of That is

[0087] According to the hash function H and The value of e is calculated by

[0088] Generate a random number k using a random number generator, k∈[1,n-1];

[0089] Change the value of one bit of the random number k to obtain an incorrect random number k′;

[0090] Calculate k′*P=(x1,y1), where P represents the base point of the elliptic curve and (x1,y1) represents the coordinate point on the elliptic curve;

[0091] Calculate r'=(e+x1)mod n, where n represents the order of the elliptic curve. If r'=0 or r'+k'=n, return to the step of using the random number generator to generate a random number k;

[0092] If r′≠0 or r′+k′≠n, then calculate s′=((1+d A ) -1 ·(k′-rd A ))mod n, where d A represents the private key. If s′=0, then return to the step of using the random number generator to generate a random number k;

[0093] If s′≠0, the wrong signature value (r′, s′) is output.

[0094] Repeat the above process to obtain multiple incorrect signature values.

[0095] It can be understood that in step S101, k*P=(x1, y1), and in this embodiment, k′*P=(x1, y1). Although both (x1, y1) represent coordinate points on the elliptic curve, the former is determined based on the random number k, and the latter is determined based on the erroneous random number k′, so the two (x1, y1) do not represent the same coordinate point on the elliptic curve.

[0096] S1032: Calculate and obtain multiple second coordinate points according to multiple erroneous signature values ​​and a first preset formula.

[0097] Exemplarily, a second coordinate point Q′(x′1, y′1) is calculated based on an erroneous signature value (r′, s′) corresponding to the message to be signed and a first preset formula.

[0098] The first preset formula is:

[0099] Substitute the values ​​of r', i, n, and e into the first preset formula to calculate the value of the second coordinate point Q'(x1', y1'). Repeat the above process to obtain multiple second coordinate points.

[0100] In this implementation, an erroneous random number is used to calculate an erroneous signature value, and then the erroneous signature value and the first preset formula are used to calculate the second coordinate point. The second coordinate point obtained in this way is still on the original elliptic curve, is not easy to be detected, and is therefore not easy to be defended.

[0101] See also Figure 3 , Figure 3 It is a specific flow chart of step S104 of a method for attacking an elliptic curve signature algorithm shown in another exemplary embodiment of the present application. Optionally, in a possible implementation, the above S104 may include S1041 to S1043, which are as follows:

[0102] S1041: Perform a differential operation on the first coordinate point and multiple second coordinate points to obtain multiple logic values.

[0103] Exemplarily, a differential operation is performed on the first coordinate point and each second coordinate point to obtain multiple logic values. For example, assuming that a fault is injected into the first bit of the random number k, then

[0104] in, And the first coordinate point and the second coordinate point satisfy the following relationship:

[0105]

[0106] From this we can deduce that I and k I The value of is the logical value of the random number k into which an error is injected. In the same way, multiple logical values ​​can be obtained, and the number of logical values ​​is the same as the number of bits in the random number k.

[0107] For example, during the signature calculation process, change the location of the injected error and traverse all Until all k are obtained I The value of .

[0108] S1042: Generate a target random number according to multiple logical values.

[0109] The bit position at which the error is injected to obtain the logic value is the position of the bit corresponding to the logic value. Each bit has a corresponding position in the random number k. Each logic value is arranged according to its corresponding bit position to obtain the target random number. Since the target random number is generated by multiple logic values, the number of bits in the target random number is the same as the number of logic values.

[0110] S1043: Calculate the private key according to the second preset formula, the target random number and the correct signature value.

[0111] Since s=((1+d A ) -1 ·(k-rd A ))mod n, the second preset formula can be derived:

[0112] d A =(ks)(s+r) -1 mod n, it is worth noting that d A =(ks)(s+r) -1 The k in the mod n formula represents the target random number.

[0113] Exemplarily, the correct signature value (r, s) and the target random number are substituted into the second preset formula to calculate d A The value of is the private key of the elliptic curve signature algorithm.

[0114] In this implementation, the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and multiple second coordinate points calculated under the attack. The calculation process is simple, which reduces the difficulty of cracking the private key and achieves the rapid and accurate acquisition of the private key of the elliptic curve signature algorithm.

[0115] Optionally, in a possible implementation, the number of times the signature operation is performed on the message to be signed is determined according to the number of bits of the random number and a preset value range.

[0116] For example, the preset value range is Where k represents a random number, I represents the Ith bit in the random number, and when I takes the maximum value, it is the same as the number of bits in the random number. I Therefore, the maximum value of I is the number of times the signature operation is performed.

[0117] In this implementation, the number of signature operations is determined according to the number of bits of the random number and the preset value range, so as to ensure that all k I , which is convenient for subsequent IGenerate a target random number to provide protection against cracking the private key.

[0118] Optionally, in a possible implementation, after step S104, the method may further include: determining a defense strategy for the elliptic curve signature algorithm.

[0119] Exemplarily, S101 to S104 describe the attack method of the elliptic curve signature algorithm, that is, how to attack the elliptic curve signature algorithm, so as to quickly and accurately obtain the private key of the elliptic curve signature algorithm. In this embodiment, according to the attack method of the elliptic curve signature algorithm, the defense strategy of the elliptic curve signature algorithm is determined, that is, according to the method of attacking the elliptic curve signature algorithm in S101 to S104, a strategy for defending against this attack method is formulated.

[0120] For example, the defense strategy may be to monitor the number of signature verifications of the elliptic curve signature algorithm. When it is detected that the number of signature verifications of the elliptic curve signature algorithm is greater than the normal number, it is predicted that the elliptic curve signature algorithm is under attack, so that defense can be taken as early as possible.

[0121] For another example, the attack method used in this application is the result amount during the operation, which can be directly obtained. Therefore, the defense strategy can be to monitor the result amount and monitor in real time whether the result amount is abnormal. This is only an exemplary description and is not limited to this.

[0122] In this embodiment, the attack method on the elliptic curve signature algorithm is studied, which can help designers discover potential risks in the algorithm and hardware as early as possible, so that corresponding defense measures can be taken in the design stage to avoid possible risks. The formulated defense strategy can avoid risks and evaluate the security of the elliptic curve algorithm before the elliptic curve cryptographic product leaves the factory, thereby reducing the situation where the elliptic curve cryptographic product has security vulnerabilities after leaving the factory.

[0123] Optionally, in a possible implementation, the present application provides a verification method, which proves through experiments, simulations, and usage that the method of attacking the elliptic curve signature algorithm provided in the above embodiment is feasible. The verification can be performed using simulation technology (such as Verilog simulation).

[0124] For example, the value of m recommended by the National Institute of Standards and Technology (NIST) is 233, and the corresponding trinomial is: f(z)=z 233 +z 74 +1 as the reduction polynomial. Elliptic curve GF(2 m ) is defined as: 2+xy=x 3 +ax 2 +b, where a,b∈GF(2 m ), and Δ=b≠0, when b=1, a=0, it is the Kuznets curve, also known as the inverted U curve, which is the fastest curve in the implementation of the elliptic curve cryptography system. This paper abbreviates it to K-233 curve. The curve parameter information is shown in Table 1.

[0125] Table 1

[0126]

[0127] For example, user A's identity is: ALICE123@YAHOO.COM, which is encoded in ASCII as: ID A :414C494345313233405941484F4F2E434F4D,ENTL A =0090.

[0128] The following takes the message to be signed (plaintext) M = 6D65737361676520646967657374 as an example to illustrate the process of attacking the elliptic curve signature algorithm, as follows:

[0129] (1) Input plaintext M, perform the signature operation in S101 above on plaintext M, and obtain the correct signature value (r, s);

[0130] r=0x67f60a0306056a49579ae48da4579aa38a101280b76a6c856ee4a4760f;

[0131] s=0x3d2089d9de3b9669af40a52182e50d6d0c3e619025c3936cc13588b6f2;

[0132] (2) Calculate the first coordinate point Q (x1, y1) using the correct signature value (r, s) and the first preset formula;

[0133] The first preset formula is:

[0134]

[0135] Substitute the values ​​of r, i, n, and e into the first preset formula to calculate the value of the first coordinate point Q(x1, y1):

[0136] x1=0xebee644b9230fe06f800580adc5c276234c2861e947ce115f087c7a7ae;

[0137] y1=0xd487a7fbd71127ae9bc23a64422b9fbff5eeb9a5c4ec85e2a45ee16928;

[0138] (3) Continue to input the same plaintext M and perform a signature operation on the plaintext. During the signature operation, a one-bit fault is injected into the random number k in the scalar multiplication step each time. The random number injected with the fault is the wrong random number k′. For example, a one-bit fault is injected into the 233rd bit of the random number k in the scalar multiplication step (I=233). The random number injected with the fault is the wrong random number k′. Finally, the signature value under the condition of the injected fault is obtained, that is, the wrong signature value (r′, s′).

[0139] r′=0x2d0941109d2dc453ed6b455bd6b5cb4b1f7b4c617f324115668c7a681c;

[0140] s′=0xa247adba046a18f5854422e93d1b413ce12972abb42acfb90da51e844;

[0141] (4) Calculate Q′(x′1,y′1) under the condition of injected fault based on the wrong signature value (r′,s′) obtained in the previous step;

[0142] x′1=01b1019b59295958118dd0b8d90eba6544819feb790522abdb941284f179;

[0143] y′1=001372f062204ba1fe4cca80c2b074e5578350e712fb121652614d80156b;

[0144] (5) For example, suppose the Ith bit of the random number k is injected with a fault, then

[0145] in, And the first coordinate point and the second coordinate point satisfy the following relationship:

[0146]

[0147] Change the location of the injected error and traverse all Until all k are obtained I The value of the target random number k is obtained.

[0148] k=10001010000000000000000010111011000000000000110111101111 00000000000000001010101111000000000000000000000000000000000 00110100111011000110111011001000101011011110011010100011011 0011101011000110101101010111110001011100111010101110111101;

[0149] (6) According to the second preset formula: d A =(ks)(s+r) -1 mod n, calculate d A The value of is the private key of the elliptic curve signature algorithm.

[0150] d A =011101110001111011110011110110111111111101011111000111001100110011000011001010111001001001100000100011101100010001100110010101111110111110010111001100000011101011111110101100100100000010;

[0151] At this point, the private key d A was cracked.

[0152] Figure 4 A schematic diagram of a device for attacking an elliptic curve signature algorithm provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the device comprises:

[0153] An acquiring unit 210 is configured to acquire a first coordinate point on an elliptic curve, wherein the first coordinate point is calculated based on a correct signature value corresponding to the message to be signed, and the correct signature value is obtained by performing a normal signature operation on the message to be signed according to an elliptic curve signature algorithm;

[0154] The operation unit 220 is used to perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers;

[0155] A calculation unit 230, configured to calculate a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and a first preset formula;

[0156] The determination unit 240 is used to determine the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point and the multiple second coordinate points.

[0157] Optionally, the random number includes multiple bit values, and the operation unit 220 is specifically used to: for each signature operation, change the value of one bit in the random number generated during the signature operation to obtain the erroneous random number.

[0158] Optionally, the calculation unit 230 is specifically used for:

[0159] Calculate multiple erroneous signature values ​​according to the multiple erroneous random numbers;

[0160] The multiple second coordinate points are calculated based on the multiple erroneous signature values ​​and the first preset formula.

[0161] Optionally, the determining unit 240 is specifically configured to:

[0162] Performing a differential operation on the first coordinate point and the plurality of second coordinate points to obtain a plurality of logic values;

[0163] generating a target random number according to the plurality of logic values;

[0164] The private key is calculated according to a second preset formula, the target random number and the correct signature value.

[0165] Optionally, the number of times the signature operation is performed on the message to be signed is determined according to the number of bits of the random number and a preset value range.

[0166] Optionally, the device further comprises:

[0167] A strategy determination unit is used to determine the defense strategy of the elliptic curve signature algorithm.

[0168] See also Figure 5 , Figure 5 is a schematic diagram of a terminal device provided by another embodiment of the present application. Figure 5As shown, the terminal device 3 of this embodiment includes: a processor 30, a memory 31, and a computer program 33 stored in the memory 31 and executable on the processor 30. When the processor 30 executes the computer program 33, the steps in the above-mentioned various method embodiments are implemented, for example Figure 1 Alternatively, when the processor 30 executes the computer program 33, the functions of each unit in the above embodiments are realized, for example, Figure 4 The functions of units 210 to 240 are shown.

[0169] Exemplarily, the computer program 33 may be divided into one or more units, which are stored in the memory 31 and executed by the processor 30 to complete the present application. The one or more units may be a series of computer instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 33 in the terminal device 3. For example, the computer program 33 may be divided into an acquisition unit, an operation unit, a calculation unit, and a determination unit, and the specific functions of each unit are as described above.

[0170] The terminal device may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will appreciate that Figure 5 It is only an example of the terminal device 3 and does not constitute a limitation on the device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access equipment, buses, etc.

[0171] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0172] The memory 31 may be an internal storage unit of the terminal device, such as a hard disk or memory of the device. The memory 31 may also be an external storage terminal of the terminal device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device. Further, the memory 31 may also include both an internal storage unit of the device and an external storage terminal. The memory 31 is used to store the computer instructions and other programs and data required by the terminal. The memory 31 may also be used to temporarily store data that has been output or is to be output.

[0173] The embodiment of the present application further provides a computer storage medium, which may be non-volatile or volatile. The computer storage medium stores a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0174] The present application also provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes the steps in the above-mentioned method embodiments.

[0175] An embodiment of the present application also provides a chip or integrated circuit, which includes: a processor, which is used to call and run a computer program from a memory, so that a terminal device equipped with the chip or integrated circuit executes the steps in the above-mentioned method embodiments.

[0176] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0177] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0178] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0179] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features can be replaced by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for attacking an elliptic curve signature algorithm, characterized in that: include: Obtaining a first coordinate point on the elliptic curve, where the first coordinate point is calculated according to a correct signature value corresponding to the message to be signed, where the correct signature value is obtained by performing a normal signature operation on the message to be signed according to the elliptic curve signature algorithm; Perform multiple signature operations on the message to be signed, and inject errors into the random number generated by the random number generator during each signature operation to obtain multiple erroneous random numbers; The random number includes a plurality of bit values, and the signing operation is performed on the message to be signed for multiple times, and an error is injected into the random number generated by the random number generator during each signing operation to obtain a plurality of error random numbers, including: for each signing operation, changing a bit value of the random number generated by the random number generator during the signing operation to obtain the error random number; Calculate and obtain a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and a first preset formula; A private key of the elliptic curve signature algorithm is determined according to the correct signature value, the first coordinate point, and the plurality of second coordinate points.

2. The method according to claim 1, characterized in that The step of calculating a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and a first preset formula includes: Calculate multiple erroneous signature values ​​according to the multiple erroneous random numbers; The multiple second coordinate points are calculated based on the multiple erroneous signature values ​​and the first preset formula.

3. The method according to claim 1, characterized in that The determining, according to the correct signature value, the first coordinate point, and the plurality of second coordinate points, a private key of the elliptic curve signature algorithm includes: Performing a differential operation on the first coordinate point and the plurality of second coordinate points to obtain a plurality of logic values; generating a target random number according to the plurality of logic values; The private key is calculated according to a second preset formula, the target random number and the correct signature value.

4. The method according to claim 2 or 3, characterized in that: The number of times the signature operation is performed on the message to be signed is determined according to the number of bits of the random number and a preset value range.

5. The method according to claim 1, characterized in that After determining the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point, and the plurality of second coordinate points, the method further includes: A defense strategy for the elliptic curve signature algorithm is determined.

6. A device for attacking an elliptic curve signature algorithm, characterized in that: include: an acquiring unit, configured to acquire a first coordinate point on the elliptic curve, wherein the first coordinate point is calculated according to a correct signature value corresponding to the message to be signed, and the correct signature value is obtained by performing a normal signature operation on the message to be signed according to the elliptic curve signature algorithm; A calculation unit, used to perform multiple signature operations on the message to be signed, and inject errors into the random number generated by the random number generator during each signature operation to obtain multiple erroneous random numbers; The random number includes a plurality of bit values, and the signing operation is performed on the message to be signed for multiple times, and an error is injected into the random number generated by the random number generator during each signing operation to obtain a plurality of error random numbers, including: for each signing operation, changing a bit value of the random number generated by the random number generator during the signing operation to obtain the error random number; A calculation unit, configured to calculate a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and a first preset formula; A determination unit is used to determine the private key of the elliptic curve signature algorithm according to the correct signature value, the first coordinate point and the multiple second coordinate points.

7. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

9. A chip, characterized in that: include: A processor, used to call and run a computer program from a memory, so that a terminal device equipped with the chip executes the method according to any one of claims 1 to 5.

Images