ECDSA lattice security attack method based on gradient dichotomy strategy

Abstract

ECDSA is a digital signature algorithm based on an elliptic curve mathematical problem and is commonly used for digital signature and identity verification. At present, lattice attacks aiming at the ECDSA are mostly based on a side channel mode, but the attack mode is very easy to bypass by some physical shielding measures. Therefore, a new lattice attack mode is applied, a linear congruence equation set is obtained after the ECDSA equation set is subjected to identical transformation in the mode, the hidden digital problem is successfully converted into the nearest vector problem in the lattice, then the nearest vector in the lattice is solved through the Babai algorithm, and then the signature private key is derived. On the basis, a gradient jump algorithm and a dichotomy thought are combined, and a lattice attack scheme based on gradient dichotomy is constructed. However, the scheme cannot accurately solve the signature private key, so that the scheme is transited to the improved dichotomy algorithm. The improved algorithm uses accurate data to construct a training circle, and no gradient is involved, so that a better lattice attack scheme is obtained.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information security, and in particular to an ECDSA lattice attack method based on gradient bisection. Background Art

[0002] The elliptic curve digital signature algorithm uses the mathematical properties of elliptic curves to ensure the security of digital signatures. During the signing process, the introduction of random numbers makes each signature value unique, and also makes the signature more difficult to forge. During the verification process, the authenticity and integrity of the signature can be verified by performing corresponding mathematical operations on the data and public key in the signature. As an efficient and secure digital signature algorithm, the ECDSA algorithm plays a very important role in today's information security field, providing reliable security for a variety of application scenarios.

[0003] So far, most lattice attacks against ECDSA are based on side-channel methods, but this attack method can be easily bypassed by some physical shielding measures. In addition, since the ECDSA algorithm is based on the elliptic curve discrete logarithm problem, and it is almost impossible to successfully crack the elliptic curve discrete logarithm problem in polynomial time, its signature private key is difficult to crack. Therefore, a new ECDSA lattice attack method is needed to avoid solving the complex elliptic discrete logarithm problem and bypassing some physical shielding measures, and effectively crack the ECDSA private key.

[0004] The new lattice attack method can generally be divided into these steps. First, the attacker collects a large amount of ECDSA signature data, including the signed message, signature value and other information. Then, the attacker uses the collected signature data to construct a linear congruential equation system. Specifically, the attacker combines the formula satisfied by ECDSA with mathematical changes and successfully converts the signature data into a linear congruential equation system, where the coefficient matrix of the equation system can be regarded as a special type of mathematical structure, namely the lattice. Then, the attacker converts the constructed linear congruential equation system into a matrix operation expression, and then into a lattice operation, which corresponds to the nearest vector problem in the lattice. Finally, the attacker uses a lattice-related algorithm to solve the nearest vector in this lattice problem. Summary of the invention

[0005] In view of the above problems existing in the prior art, the main research contents of the present invention include the following points:

[0006] First, we introduce the principle of ECDSA algorithm, hidden number problem, definition and properties of lattice, nearest vector problem and Babai nearest plane algorithm. Then, we convert the set of equations satisfied by ECDSA algorithm into a set of congruence equations, and build the lattice basis based on it. Then, we convert the hidden number problem into the nearest vector problem in the lattice and solve it. Finally, we use Babai algorithm to output the correct lattice vector.

[0007] Secondly, the principles of adversarial attack and gradient jumping algorithm are introduced, and then the gradient jumping algorithm is combined with the binary division idea to realize the lattice attack algorithm based on gradient binary division. The focus is on explaining how to calculate the gradient and how to perform binary division, and finally analyzes and evaluates the advantages and disadvantages of this lattice attack method. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0009] Figure 1 A flow chart of an ECDSA lattice attack method based on gradient bisection provided in an embodiment of the present invention;

[0010] Figure 2 A schematic diagram of the structure of an ECDSA lattice attack method based on gradient bisection provided in an embodiment of the present invention;

[0011] Figure 3 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention;

[0012] Figure 4 The decision gradient is estimated by using formula (2) in the two-dimensional case provided by the embodiment of the present invention;

[0013] Figure 5 A decision function under the ECDSA lattice attack model provided by an embodiment of the present invention;

[0014] Figure 6 The change of binary division when decision1 provided in the embodiment of the present invention is always established;

[0015] Figure 7 The change of binary division when decision0 is always established according to the embodiment of the present invention;

[0016] Figure 8 The change of binary division when the decision provided by the embodiment of the present invention is not constant;

[0017] Fig. 9 The initial relative positions of the boundary circle and the training circle provided by the embodiment of the present invention;

[0018] Fig.10 The position of the training circle boundary relative to the boundary circle at different magnification factors provided by the embodiment of the present invention;

[0019] Fig.11 The radii of the initial large circle, the middle circle and the small circle provided in the embodiment of the present invention;

[0020] Fig.12 The distance that the center of the training circle provided in the embodiment of the present invention moves;

[0021] Fig.13 The radius of the small circle provided in the embodiment of the present invention remains unchanged, and the radius of the large circle is updated;

[0022] Fig.14 The radius of the large circle provided in the embodiment of the present invention remains unchanged, and the radius of the small circle is updated.

[0023] These figures together constitute a complete and clear description of an embodiment of the ECDSA lattice security attack method based on the gradient bisection strategy.

Claims

1. A gradient bisection-based ECDSA lattice attack method, characterized in that: include: Step 1, construct the original gradient binary algorithm; Step 2, improve the original gradient binary algorithm to obtain an improved gradient binary attack method.

2. The original gradient bisection algorithm according to claim 1, characterized in that: Step 1 includes: understanding gradient decisions and gradient jumps, and analyzing the principle of gradient dichotomy. The Hop Skip Jump Attack (HSJA) algorithm is an algorithm for generating adversarial samples. Compared with other adversarial sample algorithms, the HSJA algorithm can estimate the gradient direction of the decision boundary only based on the model decision, thereby controlling the boundary error and determining the adversarial sample. This algorithm has a higher attack efficiency, achieves a significant improvement on the boundary attack, and the generated adversarial sample is less different from the original adversarial sample.

3. The gradient decision and gradient jump according to claim 2, characterized in that: include: Use the Monte Carlo method to determine the gradient. The Monte Carlo method is a numerical calculation method based on probability and statistics, also known as a statistical experimental method or a statistical simulation method. It generates a large number of random samples to simulate the behavior of complex systems, thereby solving problems that are difficult to solve with analytical methods. In simple terms, the Monte Carlo method is to approximate the solution to the problem through random experiments, obtain the statistical characteristics of the problem through a large amount of experimental data, and then obtain a solution to the problem.

4. The gradient bisection principle according to claim 2, characterized in that: include: Then, the gradient jump algorithm is combined with the binary division idea to realize the gradient binary division attack method under the ECDSA algorithm model. The HSJA algorithm is an algorithm that optimizes the solution by using gradient information and jump operations under the premise that there are known inferior solutions, that is, an algorithm that obtains the optimal solution by transforming the inferior solution. In order to make the algorithm suitable for the lattice attack of ECDSA, we need to make appropriate modifications to it.

5. The improved gradient binary attack method according to claim 1, characterized in that: Step 2 includes: the principle and specific implementation of the new algorithm, focusing on how the center of the circle jumps and the radius changes of three circles of different radii when the training circle is bisected. In the original gradient bisection algorithm, we use the change of gradient to draw the circle, so that the circle is not completely accurate, which leads to the inability of this algorithm to obtain the correct result. Therefore, in this chapter, we abandon the gradient change and directly base on the exact training circle, and then through continuous bisection, make the training circle close to the boundary circle until the condition for the Babai algorithm to output the correct grid vector is met, so that the algorithm can output the correct result.

6. An electronic device, characterized in that: include: at least one processor, at least one memory, and a communication interface; The processor, memory and communication interface communicate with each other; the memory stores program instructions that can be executed by the processor, The processor calls the program instructions to execute the method according to any one of claims 1 to 6.

7. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which cause the computer to execute the method of any one of claims 1 to 5.

Images