A multi-participant elliptic curve attack method and device and a storage medium

Abstract

The application relates to a multi-participant elliptic curve attack method and device and a storage medium, and relates to the technical field of cryptographic security verification. The application collects public keys of all participants, and obtains an elliptic curve base point of an elliptic curve digital signature algorithm; the public key of a first participant in the public keys of all participants is iteratively randomly selected with a coefficient, and a current coefficient public key Q1 and the base point G are used to calculate a point; after each random walk calculation of the point, collision detection is performed in a point sequence range calculated by the first participant; if collision occurs, a private key is obtained according to a collision result; starting from the public key of a second participant, collision detection is performed in a point sequence range calculated by the current participant and all previous participants; when collision occurs, a private key is obtained according to a collision result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of encryption security verification, and particularly relates to an elliptic curve attack method for multiple participants. BACKGROUND

[0002] The birth of the blockchain technology is driving a new round of technological revolution in the computer field. The technology has the characteristics of openness and transparency, tamper resistance, decentralization and traceability, and is expected to be widely applied in the fields of digital currency, database storage, financial technology and Internet of Things. As the security cornerstone of the blockchain technology, the cryptographic primitives represented by the digital signature algorithm play a crucial role in the blockchain. In Bitcoin and Ethereum, the Elliptic Curve Digital Signature Algorithm (ECDSA) based on the elliptic curve secp256k1 is mainly used. When a transfer transaction occurs in the Bitcoin and Ethereum network, the transaction initiator needs to use the private key of the Bitcoin wallet to sign the transaction, thereby proving the identity of the Bitcoin owner and preventing the transaction from being denied. Any size of Bitcoin transaction depends on the ECDSA algorithm of the secp256k1 standard. The security of Bitcoin is equivalent to the security of the Bitcoin private key. Once the private key is leaked, the corresponding Bitcoin will be stolen. Even if the stolen currency is known, the illegal transaction cannot be reversed. Therefore, the key management research of Bitcoin has attracted high attention from the academic and industrial circles and has become a hot research topic.

[0003] The security of the elliptic curve digital signature algorithm is based on the difficulty of solving the elliptic curve discrete logarithm problem (ECDLP). The elliptic curve digital signature algorithm is a digital signature system based on the discrete logarithm problem. At the same time, the short signature length makes it widely used in many practical applications. The public key cryptography based on elliptic curves was first proposed by Koblitz and Miller independently in 1985. Given an elliptic curve defined over a finite field with order , , a rational point , the elliptic curve discrete logarithm problem is to solve the smallest integer such that . For the general elliptic curve discrete logarithm problem, it can be solved by the big-step-small-step algorithm, Pollard’s lambda algorithm and Pollard’s Rho algorithm. Among them, the time complexity of Pollard’s Rho algorithm is When solving the u-square elliptic curve discrete logarithm problem, the time complexity of u calls to Pollard's Rho algorithm becomes u. . Summary of the Invention

[0004] To solve the above-mentioned technical problems, or at least partially solve them, the present invention provides a method, apparatus, and storage medium for multi-party elliptic curve attacks.

[0005] In a first aspect, the present invention provides a multi-party elliptic curve attack method, comprising:

[0006] Multiple parties generate public keys for all participants using a target elliptic curve digital signature algorithm based on independently generated random private keys. , Number of participants;

[0007] Collect the public keys of all participants , Obtain the elliptic curve base point of the elliptic curve digital signature algorithm. ;

[0008] The goal of the attack is to solve for the signature private keys of all participants, given the public keys of all participants and the base points of the elliptic curve digital signature algorithm. Collision detection using random walks combined with point sharing among participants is employed to achieve multi-participant private key computation, including:

[0009] Public key for all participants , The public key of the first participant in the process Randomly select coefficients Using the current coefficients Public key and base point To calculate points ,in, Continue selecting coefficients through random walk. Using the current coefficients Public key and base point To calculate points After each random walk to calculate points, collision detection is performed within the point sequence calculated by the first participant. If a collision is found, the discrete logarithm is obtained based on the collision result. From the public key of the second participant Initially, during collision detection, collisions are performed within the point sequence calculated by the current participant and all preceding participants. Upon collision, the discrete logarithm is calculated based on the collision result. .

[0010] Further, the elliptic curve of the elliptic curve digital signature algorithm adopted by all participants has the same base point and the same order.

[0011] Further, the key generation of the multi-participant based on independent random signature private key using the same elliptic curve digital signature algorithm includes:

[0012] Setting participants for key generation, for participant , the following steps are taken to achieve key generation:

[0013] Randomly select an integer as the signature private key of the i-th participant, wherein ;

[0014] Then , the signature public key of the i-th participant.

[0015] Further, in the case of the same participant, the security is judged according to the time required to solve all private keys, the shorter the required time, the lower the security.

[0016] Further, the random walk includes: performing random walk collision by Floyd algorithm:

[0017] Define a first pointer and a second pointer pointing to a point, the first pointer updates the point and the coefficient once per iteration according to the update formula, the second pointer updates the point and the coefficient twice per iteration according to the update formula, starting from the initial coefficient and the initial point, the first pointer and the second pointer update the point and the coefficient respectively until the first pointer and the second pointer point to the same point.

[0018] Further, the update formula is as follows:

[0019] In the elliptic curve group of the target elliptic curve digital signature algorithm , the point of any participant is defined as , wherein ; wherein is the public key of any participant, is the private key of any participant; is the i-th random coefficient of any participant;

[0020] Divide into three non-intersecting subgroups of similar size according to the coordinate modulo 3

[0021] Randomly select a coefficient initial value Calculate the initial point ;

[0022] For the current point The definition is updated according to the subgroup it belongs to as follows:

[0023] like ,but Coefficient update: , ;

[0024] like ,but Coefficient update: , ;

[0025] like ,but Coefficient update: , .

[0026] Furthermore, when a collision occurs, let the collision result be... ;

[0027] again Substituting the collision results, we get:

[0028] ;

[0029] Because the order of the elliptic curve group is ,Right now , Let the point be at infinity, and the scalar coefficients on both sides be in the modulus. If the following equations are equal, then the following equation holds true:

[0030] ,

[0031] rearrangement yielded Linear congruence equations:

[0032] ,

[0033] use Solving linear congruence equations .

[0034] Going a step further, utilizing Solving linear congruence equations The process includes:

[0035] like and Coprime, that is ,but In the model The following is an inverse element, which can be solved directly:

[0036] ,

[0037] like and Not coprime, ,examine Is it divisible? If not, there is no solution, and the coefficients need to be randomly assigned again. If they can be randomly assigned, the equation simplifies to: , then ask The inverse of the inverse, solve for .

[0038] Secondly, the present invention provides a multi-party elliptic curve attack apparatus, comprising: at least one processing unit, the processing unit being connected to a storage unit via a bus unit, the storage unit storing a computer program, and the computer program being executed by the processing unit to implement the multi-party elliptic curve attack method.

[0039] Thirdly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the multi-party elliptic curve attack method.

[0040] The technical solutions provided in the embodiments of the present invention have the following advantages compared with the prior art:

[0041] This invention utilizes a random walk combined with point sharing among participants for collision detection to achieve multi-participant private key computation. Specifically, it calculates the public keys of all participants. , The public key of the first participant in the process Randomly select coefficients Using the current coefficients Public key and base point To calculate points ,in, Continue selecting coefficients through random walk. Using the current coefficients Public key and base point To calculate points After each random walk to calculate points, collision detection is performed within the point sequence calculated by the first participant. If a collision is found, the discrete logarithm is obtained based on the collision result. From the public key of the second participant At the beginning, when the collision detection is performed, the collision detection is performed in the point sequence range calculated by the current participant and all the previous participants; when the collision occurs, the discrete logarithm is solved according to the collision result . By processing the elliptic curve discrete logarithm problem of multiple participants (such as u participants), the complexity of solving u times repeatedly is , and the complexity of using the multiple participant solving technology is Therefore, the solving complexity is improved by times compared with multiple Pollard's Rho algorithm invocations, so as to improve the efficiency of the elliptic curve attack for multiple participants and more efficiently verify the security of the multiple participant elliptic curve digital signature algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0042] The accompanying drawings, which are incorporated into and form part of the description, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0044] Figure 1 A flowchart of a multiple participant elliptic curve attack method provided by the embodiment of the present application;

[0045] Figure 2 A schematic diagram of a network relationship diagram provided by the embodiment of the present application;

[0046] Figure 3 A schematic diagram of a multiple participant elliptic curve attack device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0048] It is to be noted that, in the present document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, such that processes, methods, articles, or apparatuses that comprise a list of elements are not limited to those elements, but can include other elements not expressly listed, or even further include elements inherent in such processes, methods, articles, or apparatuses. Without further limitation, an element preceded by "comprising" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0049] For the sake of clarity, the mathematical principles of the elliptic curve discrete logarithm problem are first described:

[0050] An elliptic curve on a prime field , is denoted as:

[0051] ;

[0052] wherein , and satisfies the discriminant , ensuring that the elliptic curve has no singular point; on a prime field , one solution of the elliptic curve is a point , wherein x and y satisfy the equation , and the elliptic curve group represents the elliptic curve on a prime field , the set of all solutions and the infinite point , the elliptic curve group constitutes an Abelian group.

[0053] Abelian group operation rules:

[0054] Identity element of the Abelian group : satisfying ;

[0055] Inverse element: the inverse element of a point is , satisfying ;

[0056] Point addition:

[0057] Point addition of the same point, i.e., doubling point: , wherein:

[0058] ;

[0059] Point addition of different points: , wherein:

[0060] .

[0061] The elliptic curve discrete logarithm problem (ECDLP) problem is defined as follows:

[0062] A solution of the inverse is , which is also a solution of the equation, and the addition result of the two solution points is also a solution of the equation. Let be the order of , and let be a base point that generates a cyclic subgroup . Given another point on the elliptic curve, find an integer such that .

[0063] The difficulty of the elliptic curve discrete logarithm problem arises from the following properties of the elliptic curve group:

[0064] No sub-exponential time algorithm: Unlike the discrete logarithm problem over finite fields, the most efficient attack algorithm (such as Pollard's Rho) for the elliptic curve discrete logarithm problem has a time complexity of , which requires exponential computational resources.

[0065] Complexity of group structure: The point operation of the elliptic curve group lacks linear structure, making it difficult to speed up the solution through algebraic simplification.

[0066] According to the definition of the elliptic curve discrete logarithm problem, the security is affected by the order : If the order is a prime number or contains large prime factors, the difficulty of the elliptic curve discrete logarithm problem is high. Generally, the order is chosen to be a prime number or , where is a large prime number, is a residual factor, is as small as possible (such as 1, 2, 4).

[0067] Embodiment 1

[0068] The present technology realizes a multi-participant elliptic curve attack method, supports security analysis of blockchain multi-user elliptic curve digital signature algorithm, and optimizes the multi-participant elliptic curve discrete logarithm problem, so that the solution complexity is improved by times compared to multiple calls to the Pollard's Rho algorithm, is the number of participants, therefore, the multi-participant elliptic curve attack method has higher attack performance, and the security evaluation of the elliptic curve discrete logarithm problem is more efficient. For example, Figure 1As shown, the process of this application includes:

[0069] S100: Multiple participants generate public keys for all participants using the same elliptic curve digital signature algorithm based on independent, random private keys. , The number of participants.

[0070] set up Each participant generates a key, and all participants use the same elliptic curve digital signature algorithm. The elliptic curve is defined in a finite field. Elliptic curves on the same surface have the same base point. and the same order .

[0071] In the Bitcoin blockchain, the elliptic curve for key generation is defined over a finite field. Elliptic curve secp256k1 on: ,in For a 256-bit prime number, the base point of the elliptic curve secp256k1 is... The order is n. secp256k1 refers to the elliptic curve used in Bitcoin public-key cryptography, defined in the Standards for Efficient Cryptography (SEC).

[0072] For the participating parties To generate the key, follow these steps:

[0073] Randomly select integers As the signing private key of the i-th participant, where, ;

[0074] but , This represents the public key used for signing by the i-th participant.

[0075] The purpose of this application's security verification attack is: to know all participating parties. and In the case of solving for all participants Find the total number of participants. The shorter the time, the lower the security of the elliptic curve digital signature algorithm, and the stronger its attack capability.

[0076] S200 collects the public keys of all participants. , Obtain the elliptic curve base point of the elliptic curve digital signature algorithm. Because, the public keys of users on the blockchain are publicly available, After the generation of the participant keys, the public keys of the participants can be collected from the blockchain , .

[0077] S300, the random walk is used to combine the point sharing between participants to detect collisions and realize multi-participant private key calculation, as shown in Figure 2 The calculation process includes:

[0078] S301, the public keys of all participants , The public key of the first participant , a random coefficient is selected, and the current coefficient , the public key and the base point are used to calculate the point , wherein ;

[0079] After each calculation, if the horizontal coordinates of the result are all 0, record the corresponding coefficient and points , and .

[0080] S302, the iteration continues to select the coefficient , the current coefficient , the public key and the base point to calculate the point , if the horizontal coordinates of the result are all 0, record the corresponding , and .

[0081] S303, after each random walk calculation, collision detection is performed in the point sequence range calculated by the first participant to try to find different coefficients pointing to the same point ;

[0082] S304, detect whether there is a collision, if not, execute S302.

[0083] S305, if there is a collision, set , to indicate that the determined after the jth random walk is the same as the determined after the previous lth random walk, then the corresponding points are: , ​; stop random walk, solve discrete logarithm according to collision result .

[0084] An example random walk includes:

[0085] In an elliptic curve group of target elliptic curve digital signature algorithm , define the point of any participant , wherein ; wherein is the public key of any participant, is the private key of any participant; is the coefficient of the i-th random of any participant.

[0086] Divide into three non-interacting subgroups of similar size according to the coordinate module 3 ,

[0087] Randomly select the initial value of the coefficient , calculate the initial point ;

[0088] For the current point , define the following update according to the subgroup to which it belongs:

[0089] If , then , the coefficient update: , ;

[0090] If , then , the coefficient update: , ;

[0091] If , then , the coefficient update: , .

[0092] Random walk collision by Floyd algorithm:

[0093] Define the first pointer and the second pointer, the first pointer updates the point once per iteration, and the second pointer updates the point twice per iteration, starting from the initial coefficient and the initial point, the first pointer and the second pointer update the point respectively until the first pointer and the second pointer point to the same point, and set the i-th iteration when different coefficients correspond to the same point: , .

[0094] Solve discrete logarithm according to collision result:​

[0095] Collision result ;

[0096] Again , substitute the collision result to get:

[0097] ;

[0098] Because the order of the elliptic curve group is , that is , is the point at infinity, the scalar coefficients on both sides are equal under modulo , the following equation is established:

[0099] ,

[0100] Move the term to get the linear congruence equation of :

[0101] ,

[0102] If and are coprime, that is , then has an inverse under modulo , which can be directly solved as:

[0103] ,

[0104] If and are not coprime, , it needs to be checked whether is divisible by , if not, there is no solution, and the algorithm needs to be run again, if yes, the equation is simplified as: , and then the inverse of is found to solve .

[0105] Steps S301 to S303 are for the first participant, and within the point sequence range calculated by the first participant, a collision point is found through random walk to establish an equation to solve .

[0106] S306, share the point sequence of all current participants to subsequent participants. For example, the point sequence of the first participant needs to be contributed to the second participant to the last participant, the point sequence of the second participant needs to be contributed to the third participant to the last participant, and so on.

[0107] S307, from the public key First, compared with the calculation process of the first participant, the collision detection is performed in the point sequence range calculated by the current participant and all the previous participants when performing the collision detection.

[0108] For example, the public key of the second participant :

[0109] Randomly selected coefficient Calculate point ,

[0110] Detect whether there is the same result as in the point sequence range calculated by the first participant;

[0111] If not, on one hand, record the point calculated by the second participant, if the last set of the horizontal coordinates of the result is 0, record the corresponding , and ; on the other hand, continue to select the coefficient by random walk to calculate the point ;

[0112] If yes, stop the random walk, and solve the discrete logarithm to obtain according to the collision result.

[0113] From the second calculation point of the second participant, the point calculated by the second participant forms a sequence; after each random walk calculation point, detect whether there is the same result as the current calculation point in the point sequence range calculated by the second participant and the first participant of the previous sequence.

[0114] If or , the discrete logarithm of can be solved to obtain . It is assumed that in the calculation process, collisions may occur between different participants, and collisions may also occur in the point sequence range of the same participant, that is, is the same as in the point sequence calculated by the first participant or in the point sequence calculated by the second participant. If , there is a collision equation across participants, so that the private key of the second participant public key is solved. For example, it is assumed that , then , is the coefficient corresponding to the point in the point sequence calculated by the first participant, is the coefficient corresponding to the point The coefficient. Substitute and ,get ,Right now Therefore, we can obtain the equation: At this point, since it is already known... Then the above equation is about The equation can be used to solve .

[0115] This process continues until the discrete logarithms of all participants are solved, thus obtaining the private keys of all participants. .

[0116] When assessing security, with the same participants, the security is determined by the time required to solve for all private keys; the shorter the time required, the lower the security.

[0117] The process of multi-party private key calculation in this invention includes: calculating the public keys of all participating parties. , The public key of the first participant in the process Randomly select coefficients Using the current coefficients Public key and base point To calculate points ,in, Continue selecting coefficients through random walk. Using the current coefficients Public key and base point To calculate points After each random walk to calculate points, collision detection is performed within the point sequence calculated by the first participant. If a collision is found, the discrete logarithm is obtained based on the collision result. From the public key of the second participant Initially, during collision detection, collisions are performed within the point sequence calculated by the current participant and all preceding participants. Upon collision, the discrete logarithm is calculated based on the collision result. By handling the elliptic curve discrete logarithm problem with multiple participants (e.g., u participants), the complexity of solving the problem u times is O(n log n). The complexity of using multi-participant solution techniques is Therefore, the solution complexity is improved compared to multiple calls to Pollard's Rho algorithm. This increases the efficiency of elliptic curve attacks against multiple participants, thus improving the security of multi-participant elliptic curve digital signature algorithms. By reusing cross-participant point sequences during collision detection, the complexity is significantly reduced.

[0118] Example 2

[0119] See Figure 3 As shown, this embodiment of the invention provides a multi-party elliptic curve attack apparatus, comprising: at least one processing unit, the processing unit being connected to a storage unit via a bus unit, the storage unit serving as a computer-readable storage medium, and capable of storing software programs, computer-executable programs, and modules, such as the software program, computer-executable program, and module corresponding to a multi-party elliptic curve attack method in this embodiment of the invention. The processing unit implements the aforementioned multi-party elliptic curve attack method by running the software program, computer-executable program, and module stored in the storage unit, including:

[0120] Multiple parties generate public keys for all participants using a target elliptic curve digital signature algorithm based on independently generated random private keys. , Number of participants;

[0121] Collect the public keys of all participants , Obtain the elliptic curve base point of the elliptic curve digital signature algorithm. ;

[0122] The goal of the attack is to solve for the signature private keys of all participants, given the public keys of all participants and the base points of the elliptic curve digital signature algorithm. The process of multi-party private key computation includes:

[0123] Public key for all participants , The public key of the first participant in the process Randomly select coefficients Using the current coefficients Public key and base point To calculate points ,in, Continue selecting coefficients through random walk. Using the current coefficients Public key and base point To calculate points After each random walk to calculate points, collision detection is performed within the point sequence calculated by the first participant. If a collision is found, the discrete logarithm is obtained based on the collision result. From the public key of the second participant At the beginning, when collision detection is performed, collision detection is performed in the point sequence range calculated by the current participant and all previous participants; when collision occurs, discrete logarithm is solved according to the collision result to obtain .

[0124] Of course, the storage unit in the device for implementing the multi-participant elliptic curve attack method provided by the embodiment of the present application stores a computer program, which is not limited to the method operations described above, and can also perform related operations in the multi-participant elliptic curve attack method provided by any embodiment of the present application.

[0125] Embodiment 3

[0126] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is executed, the multi-participant elliptic curve attack method is implemented, including:

[0127] The multi-participant uses a target elliptic curve digital signature algorithm based on independent random signature private keys to generate keys to obtain public keys of all participants , The number of participants is obtained;

[0128] The public keys of all participants are collected ,The elliptic curve base point of the elliptic curve digital signature algorithm is obtained ;

[0129] The purpose of the attack is to solve the signature private keys of all participants in the case that the public keys of all participants and the base point of the elliptic curve digital signature algorithm are known The process of the multi-participant private key calculation includes:

[0130] The public keys of all participants ,The public key of the first participant in the public keys of all participants is obtained A random coefficient is selected The point is calculated by using the current coefficient , the public key , and the base point , wherein ; the coefficient is continuously selected by random walk The point is calculated by using the current coefficient , the public key , and the base point After the point is calculated each time in the random walk, collision detection is performed in the point sequence range calculated by the first participant, and if collision occurs, discrete logarithm is solved according to the collision result to obtain ​​; from the second participant's public key At the beginning, when collision detection is performed, collision detection is performed in the point sequence range calculated by the current participant and all previous participants; when collision occurs, the discrete logarithm is solved according to the collision result .

[0131] The computer program stored in the computer readable storage medium provided by the embodiment of the present application is not limited to the method operation described above, and can also perform the related operation in the multi-participant elliptic curve attack method provided by any embodiment of the present application.

[0132] In the embodiments provided by the present application, it should be understood that the disclosed structure and method can be implemented in other ways. For example, the structure embodiments described above are only schematic. The division of the units is only a logical function division. There can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, structures or units, and can be electrical, mechanical or in other forms.

[0133] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0134] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0135] The above is only a specific implementation of the present application, which enables those skilled in the art to understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-party elliptic curve attack method, characterized in that, include: Multiple parties generate public keys for all participants using a target elliptic curve digital signature algorithm based on independently generated random private keys. , Number of participants; Collect the public keys of all participants , Obtain the elliptic curve base point of the elliptic curve digital signature algorithm. ; The goal of the attack is to solve for the signature private keys of all participants, given the public keys of all participants and the base points of the elliptic curve digital signature algorithm. Collision detection using random walks combined with point sharing among participants is employed to achieve multi-participant private key computation, including: Public key for all participants , The public key of the first participant in the process Randomly select coefficients Using the current coefficients Public key and base point To calculate points ,in, Continue selecting coefficients through random walk. Using the current coefficients Public key and base point To calculate points After each random walk to calculate points, collision detection is performed within the point sequence calculated by the first participant. If a collision is found, the discrete logarithm is obtained based on the collision result. From the public key of the second participant Initially, during collision detection, collisions are performed within the point sequence calculated by the current participant and all preceding participants. Upon collision, the discrete logarithm is calculated based on the collision result. .

2. The multi-party elliptic curve attack method according to claim 1, characterized in that, All participants use elliptic curve digital signature algorithms whose elliptic curves have the same base point and the same order.

3. The multi-party elliptic curve attack method according to claim 1, characterized in that, Multi-participant key generation using the same elliptic curve digital signature algorithm based on independent, random signing private keys includes: set up Each participant generates a key. To generate the key, follow these steps: Randomly select integers As the signing private key of the i-th participant, where, ; but , This represents the public key used for signing by the i-th participant. Let be the order of the elliptic curve group.

4. The multi-party elliptic curve attack method according to claim 1, characterized in that, With the same participants, security is judged by the time required to solve all private keys; the shorter the time required, the lower the security.

5. The multi-party elliptic curve attack method according to claim 1, characterized in that, The random walk includes: random walk collision detection using the Floyd algorithm. Define a first pointer and a second pointer that point to a point. The first pointer updates the point and coefficients once according to the update formula in each iteration, and the second pointer updates the point and coefficients twice according to the update formula in each iteration. Starting from the initial coefficients and the initial point, the first pointer and the second pointer update the point and coefficients respectively until the first pointer and the second pointer point to the same point.

6. The multi-participant elliptic curve attack method according to claim 5, characterized in that, The update formula is as follows: Elliptic curve group in the target elliptic curve digital signature algorithm In the middle, a point is defined for any participating party. ,in, ;in, For any participating party's public key, For any participating party's private key; Let be the coefficient of the i-th randomization by any participant; Will The coordinate system is divided into three non-interactive subgroups of similar size according to the modulus of 3. , Random selection coefficient initial value Calculate the initial point ; For the current point The definition is updated according to the subgroup it belongs to as follows: like ,but Coefficient update: , ; like ,but Coefficient update: , ; like ,but Coefficient update: , ; Let be the order of the elliptic curve group.

7. The multi-participant elliptic curve attack method according to claim 5, characterized in that, When a collision occurs, let the result of the collision be... ; again Substituting the collision results, we get: ； Because the order of the elliptic curve group is ,Right now , Let the point be at infinity, and the scalar coefficients on both sides be in the modulus. If the following equations are equal, then the following equation holds true: ， rearrangement yielded Linear congruence equations: ， use Solving linear congruence equations .

8. The multi-party elliptic curve attack method according to claim 7, characterized in that, use Solving linear congruence equations The process includes: like and Coprime, that is ,but In the model The following is an inverse element, which can be solved directly: ， like and Not coprime, ,examine Is it divisible? If not, there is no solution, and the coefficients need to be randomly assigned again. If they can be randomly assigned, the equation simplifies to: , then ask The inverse of the inverse, solve for .

9. A multi-party elliptic curve attack device, characterized in that, include: At least one processing unit is provided, which is connected to a storage unit via a bus unit. The storage unit stores a computer program, which, when executed by the processing unit, implements the multi-participant elliptic curve attack method as described in any one of claims 1-8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the multi-participant elliptic curve attack method as described in any one of claims 1-8.

Images