WO2024036833A1 - 攻击椭圆曲线签名算法的方法、装置、设备及存储介质 - Google Patents

攻击椭圆曲线签名算法的方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2024036833A1
WO2024036833A1 PCT/CN2022/137696 CN2022137696W WO2024036833A1 WO 2024036833 A1 WO2024036833 A1 WO 2024036833A1 CN 2022137696 W CN2022137696 W CN 2022137696W WO 2024036833 A1 WO2024036833 A1 WO 2024036833A1
Authority
WO
WIPO (PCT)
Prior art keywords
signature
elliptic curve
random number
value
coordinate point
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/137696
Other languages
English (en)
French (fr)
Inventor
邵翠萍
杨梅
李慧云
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Institute of Advanced Technology of CAS
Original Assignee
Shenzhen Institute of Advanced Technology of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Institute of Advanced Technology of CAS filed Critical Shenzhen Institute of Advanced Technology of CAS
Publication of WO2024036833A1 publication Critical patent/WO2024036833A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3252—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/002—Countermeasures against attacks on cryptographic mechanisms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds

Definitions

  • the present application relates to the field of information security technology, and in particular to a method, device, terminal equipment and storage medium for attacking the elliptic curve signature algorithm.
  • the elliptic curve signature algorithm Compared with traditional signature algorithms, the elliptic curve signature algorithm only requires a shorter key length under the same security strength, and is more suitable for application in resource-constrained chips. For example, the elliptic curve signature algorithm is very suitable for Internet of Vehicles application environments where processing power, storage space, bandwidth and power consumption are limited.
  • this application provides a method, device, terminal equipment and storage medium for attacking the elliptic curve signature algorithm to solve the problem that the existing attack methods are difficult and easy to be defended, resulting in the inability to quickly and accurately obtain the elliptic curve Issues with the private key of the signature algorithm.
  • this application provides a method of attacking the elliptic curve signature algorithm, including: obtaining the first coordinate point on the elliptic curve.
  • the first coordinate point is calculated based on the correct signature value corresponding to the message to be signed.
  • the correct The signature value is obtained by performing normal signature operations on the message to be signed based on the elliptic curve signature algorithm;
  • the random numbers generated during the signature operation are attacked, so that the coordinate points calculated after the attack are still on the original elliptic curve, making it difficult to detect and therefore difficult to defend.
  • the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and multiple second coordinate points calculated under the attack.
  • the entire attack process is simple, reducing the difficulty of cracking the private key, and achieving the rapid and accurate acquisition of the private key of the elliptic curve signature algorithm.
  • the random number includes multiple bit values
  • multiple signature operations are performed on the message to be signed
  • errors are injected into the random numbers generated during each signature operation to obtain multiple error random numbers, including : For each signature operation, change the value of one bit in the random number generated during the signature operation to obtain an incorrect random number.
  • multiple second coordinate points on the elliptic curve are calculated based on multiple error random numbers and the first preset formula, including:
  • Multiple second coordinate points are calculated based on multiple erroneous signature values and the first preset formula.
  • the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point, and multiple second coordinate points, including:
  • the private key is calculated based on the second preset formula, the target random number and the correct signature value.
  • the number of signature operations on the message to be signed is determined based on the number of bits of the random number and the preset value range.
  • the method further includes: determining a defense strategy for the elliptic curve signature algorithm.
  • this application provides a device for attacking the elliptic curve signature algorithm, including:
  • the acquisition unit is used to acquire the first coordinate point on the elliptic curve.
  • the first coordinate point is calculated based on the correct signature value corresponding to the message to be signed.
  • the correct signature value is calculated based on the elliptic curve signature algorithm.
  • the message to be signed is obtained by performing normal signature operations;
  • An operation unit configured to perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers;
  • a calculation unit configured to calculate a plurality of second coordinate points on the elliptic curve based on the plurality of erroneous random numbers and the first preset formula
  • a determining unit configured to determine the private key of the elliptic curve signature algorithm based on the correct signature value, the first coordinate point, and the plurality of second coordinate points.
  • the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • a terminal device including a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor executes the computer program, any one of the above aspects in the first aspect is implemented. A method described in one way.
  • the present application provides a computer-readable storage medium that stores a computer program.
  • the computer program is executed by a processor, the method described in any of the above-mentioned first aspects is implemented.
  • embodiments of the present application provide a computer program product, which when the computer program product is run on a processor, causes the processor to execute the method described in any of the above-mentioned first aspects.
  • embodiments of the present application provide a chip, including a processor, for calling and running a computer program from a memory, so that a terminal device installed with the chip executes the method described in any of the first aspects. .
  • Figure 1 is a schematic flow chart of a method for attacking the elliptic curve signature algorithm provided by an exemplary embodiment of the present application
  • Figure 2 is a specific flow chart of step S103 of a method of attacking an elliptic curve signature algorithm according to another exemplary embodiment of the present application;
  • Figure 3 is a specific flow chart of step S104 of a method of attacking an elliptic curve signature algorithm according to another exemplary embodiment of the present application;
  • Figure 4 is a schematic diagram of a device for attacking the elliptic curve signature algorithm provided by an embodiment of the present application
  • Figure 5 is a schematic diagram of a terminal device provided by another embodiment of the present application.
  • the elliptic curve signature algorithm Compared with traditional signature algorithms, the elliptic curve signature algorithm only requires a shorter key length under the same security strength, and is more suitable for application in resource-constrained chips.
  • the elliptic curve signature algorithm is very suitable for Internet of Vehicles application environments with limited processing power, storage space, bandwidth and power consumption. It is a domestic public key cryptography scheme in my country's Internet of Vehicles security technology.
  • Security chips are the core and cornerstone of effectively ensuring the security of my country’s Internet of Vehicles.
  • the security chip refers to the trusted platform module. It is a device that can independently generate keys, encrypt and decrypt. It has an independent processor and storage unit inside, which can store keys and characteristic data, and provide encryption and security authentication services for computers. . Encrypted with a security chip, the key is stored in the hardware, and the stolen data cannot be decrypted, thereby protecting business privacy and data security.
  • the security of the elliptic curve algorithm can be evaluated before the elliptic curve cryptographic product leaves the factory, thereby reducing the possibility of security vulnerabilities in the elliptic curve cryptographic product after it leaves the factory.
  • this application provides a method, device, terminal device and storage medium for attacking the elliptic curve signature algorithm.
  • the coordinate points calculated after the attack are still on the original elliptic curve, making it difficult to detect and therefore difficult to defend.
  • the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and multiple second coordinate points calculated under the attack.
  • the entire attack process is simple. There is no need to gradually narrow down the scope to guess the private key as in the existing technology, which reduces the difficulty of cracking the private key and enables the private key of the elliptic curve signature algorithm to be obtained quickly and accurately.
  • studying this attack method can help designers discover potential risks in algorithms and hardware as early as possible, so that corresponding defensive measures can be taken during the design stage to avoid possible risks.
  • Figure 1 is a schematic flow chart of a method for attacking an elliptic curve signature algorithm provided by an exemplary embodiment of the present application.
  • the execution subject of the method of attacking the elliptic curve signature algorithm provided by this application is a terminal device, where the terminal device includes but is not limited to a vehicle-mounted computer, a tablet computer, a computer, a smart phone, a wearable device, a Personal Digital Assistant (Personal Digital Assistant, PDA) and other equipment.
  • PDA Personal Digital Assistant
  • the execution subject of the method of attacking the elliptic curve signature algorithm provided by this application can also be various types of servers.
  • the server can be an independent server, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery network (Content Delivery) Network, CDN), as well as cloud services for basic cloud computing services such as big data and artificial intelligence platforms.
  • cloud services for basic cloud computing services such as big data and artificial intelligence platforms.
  • Figure 1 is a schematic flow chart of a method for attacking an elliptic curve signature algorithm provided by an exemplary embodiment of the present application.
  • the method shown in Figure 1 may include: S101 to S104, specifically as follows:
  • An elliptic curve can be understood as a formula that describes a set of specific points. It is essentially a mathematical equation.
  • the first coordinate point is a coordinate point on the elliptic curve.
  • the first coordinate point is calculated based on the correct signature value corresponding to the message to be signed.
  • the correct signature value is obtained by performing normal signature operation on the message to be signed based on the elliptic curve signature algorithm.
  • the message to be signed indicates plain text, that is, unencrypted text or strings.
  • M is used to represent plain text.
  • (r,s) is used to represent the correct signature value (signature pair).
  • normal signature operation refers to the signature operation performed without any attack.
  • the signature value obtained at this time is also called the correct signature value.
  • the elliptic curve signature algorithm may include asymmetric algorithms such as SM2 signature algorithm and SM9 signature algorithm.
  • This example uses the SM2 signature algorithm as an example.
  • the user's own message may include the user's identity information
  • the parameters of the elliptic curve may include the base point of the elliptic curve, which can be understood as the first point in the elliptic curve.
  • P is used to represent the base point.
  • Hash operation also known as hash function, is a function that changes an input message string of any length into an output string of fixed length.
  • the hash value is also called the hash value.
  • Z A is used to represent the hash value of user A.
  • plaintext M is input. Calculate using hash value Z A value, if set Immediately
  • the first coordinate point is calculated according to the correct signature value (r, s) corresponding to the message to be signed and the first preset formula.
  • Q (x 1 , y 1 ) is used to represent the first coordinate point.
  • S102 Perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers.
  • step S102 The difference between the signature operation in step S102 and the signature operation in step S101 is that the signature operation in step S101 is a signature operation performed without any attack, while the signature operation in step S102 affects the randomness generated during the signature operation.
  • the signature operation in step S101 is a signature operation performed without any attack
  • the signature operation in step S102 affects the randomness generated during the signature operation.
  • multiple signature operations are performed on the message to be signed.
  • a random number generator is used to generate a random number, and an error is injected into the generated random number, that is, a fault is injected.
  • the random number after the error is injected is Wrong random number.
  • k′ is used to represent the error random number.
  • the random number generated during the signature operation may include multiple bit values, multiple signature operations are performed on the message to be signed, and the random number generated during each signature operation is Number injection errors result in multiple erroneous random numbers, including: for each signature operation, changing the value of one bit in the random number generated during the signature operation to obtain erroneous random numbers.
  • the number of bits included in the random number can be set according to the actual situation.
  • the random number may include a value of 233 bits. This is only an exemplary description and is not limited to this.
  • the value of one bit in the random number generated during the signature operation is changed, that is, the random number in the step of multiplying the scalar during the signature operation is injected into the fault one bit at a time, and the random number of the fault is injected.
  • the number is the error random number k′.
  • injecting errors into random numbers actually changes the value of one bit in the random numbers. For example, if the value of a certain bit is 1, injecting an error can change 1 into 0; for example, if the value of a certain bit is 0, injecting an error can change 0 into 1.
  • errors can be injected sequentially according to the order of the values of each bit in the random number. For example, if multiple signature operations are performed on a message to be signed, during the first signature operation, the value of the first bit in the random number generated during the signature operation is changed, resulting in an erroneous random number. During the second signature operation, the value of the second bit in the random number generated during the signature operation is changed, and an erroneous random number is obtained. By analogy, until the value of each bit in the random number is injected with an error, multiple erroneous random numbers are obtained.
  • errors can be randomly injected into the values of each bit in the random number. After each error is injected, the location of the injected error is recorded, such as recording the Nth bit. When an error is injected later, Avoid bit values that have had errors injected into them. Repeatedly until the value of each bit in the random number is injected with an error, multiple error random numbers are obtained.
  • the value of one bit in the random number generated during the signature operation is changed, thereby realizing an attack on the random number generated during the signature operation.
  • changing the value of one bit at a time facilitates the subsequent rapid calculation of the error random number and the second coordinate point, thereby indirectly increasing the speed of cracking the private key.
  • step S101 a signature operation is performed on the message to be signed. It is worth mentioning that in this process, the random number k in the signature operation process in step S101 needs to be replaced by the wrong random number k′. The rest of the process is similar.
  • the wrong signature value (signature pair) is calculated. In this example, (r ′, s′) represents an incorrect signature value (signature pair).
  • Q′(x′ 1 ,y′ 1 ) is used to represent the second coordinate point.
  • S104 Determine the private key of the elliptic curve signature algorithm based on the correct signature value, the first coordinate point and the plurality of second coordinate points.
  • a target random number is generated using multiple logical values.
  • the target random number includes multiple bits, and the logical value represents the value of any bit in the target random number. It is worth noting that the number of bits in the target random number is the same as the number of logical values. According to the second preset formula, the target random number and the correct signature value, the private key of the elliptic curve signature algorithm is calculated.
  • the coordinate points calculated after the attack are still on the original elliptic curve, making it difficult to detect and therefore difficult to defend.
  • the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point calculated under the correct signature algorithm, and multiple second coordinate points calculated under the attack.
  • the entire attack process is simple. There is no need to gradually narrow down the scope to guess the private key as in the existing technology, which reduces the difficulty of cracking the private key and enables the private key of the elliptic curve signature algorithm to be obtained quickly and accurately.
  • Figure 2 is a specific flow chart of step S103 of a method for attacking an elliptic curve signature algorithm according to another exemplary embodiment of the present application.
  • the above S103 It can include S1031 ⁇ S1032, as follows:
  • the user's own messages and parameters of the elliptic curve may be retrieved.
  • the hash value Z A used in step S101 can also be directly used, whichever is the actual situation, and is not limited here.
  • plaintext M is input. Calculate using hash value Z A value, if set Immediately
  • S1032 Calculate multiple second coordinate points based on multiple erroneous signature values and the first preset formula.
  • a second coordinate point Q'(x' 1 , y' 1 ) is calculated based on an erroneous signature value (r', s') corresponding to the message to be signed and the first preset formula.
  • the first default formula is:
  • the wrong random number is used to calculate the wrong signature value, and then the wrong signature value and the first preset formula are used to calculate the second coordinate point.
  • the second coordinate point obtained in this way is still on the original elliptic curve. Difficult to detect and therefore difficult to defend against.
  • Figure 3 is a specific flow chart of step S104 of a method of attacking an elliptic curve signature algorithm according to another exemplary embodiment of the present application.
  • the above S104 It can include S1041 ⁇ S1043, as follows:
  • S1041 Perform differential operation on the first coordinate point and multiple second coordinate points to obtain multiple logical values.
  • the values of I and k I can be deduced, that is, the logical value of one bit (binary bit) in which the random number k is injected into the error is obtained.
  • the number of logical values is the same as the number of bits in the random number k.
  • S1042 Generate target random numbers based on multiple logical values.
  • the bit position at which error is injected to obtain the logic value is the bit position corresponding to the logic value.
  • Each bit has a corresponding position in the random number k.
  • S1043 Calculate the private key based on the second preset formula, the target random number and the correct signature value.
  • the k in the formula represents the target random number.
  • the correct signature value (r, s) and the target random number are substituted into the second preset formula, and the value of d A is calculated, that is, the private key of the elliptic curve signature algorithm is obtained.
  • the private key of the elliptic curve signature algorithm is determined based on the correct signature value, the first coordinate point calculated in the case of a correct signature algorithm, and a plurality of second coordinate points calculated in the case of being attacked.
  • the calculation process is simple, which reduces the difficulty of cracking the private key and enables the private key of the elliptic curve signature algorithm to be obtained quickly and accurately.
  • the number of signature operations performed on the message to be signed is determined based on the number of bits of the random number and the preset value range.
  • the preset value range is Among them, k represents a random number, I represents the I-th bit in the random number, and when I takes the maximum value, it is the same as the number of bits in the random number. Since it is necessary to ensure that all k I are traversed, the maximum value of I is the number of signature operations.
  • the number of signature operations is determined based on the number of bits of the random number and the preset value range, thereby ensuring that all k I can be traversed, thereby facilitating the subsequent generation of target random numbers based on all k I , as Cracking the private key provides assurance.
  • the method may further include: determining a defense strategy for the elliptic curve signature algorithm.
  • S101 to S104 describe the attack method of the elliptic curve signature algorithm, that is, how to attack the elliptic curve signature algorithm to quickly and accurately obtain the private key of the elliptic curve signature algorithm.
  • the defense strategy of the elliptic curve signature algorithm is determined based on the attack method of the elliptic curve signature algorithm, that is, based on the attack method of the elliptic curve signature algorithm in S101 to S104, a strategy to defend against this attack method is formulated.
  • the defense strategy can be to monitor the number of signature verifications of the elliptic curve signature algorithm. When it is detected that the number of signature verifications of the elliptic curve signature algorithm is more than the normal number, predict that the elliptic curve signature algorithm is under attack, so as to defend as early as possible.
  • the attack method used in this application is the result quantity during the calculation process, which can be obtained directly. Therefore, the defense strategy can be to monitor the result volume and monitor whether the result volume is abnormal in real time. This is only an illustrative description without limitation.
  • studying attack methods on elliptic curve signature algorithms can help designers discover potential risks in algorithms and hardware as early as possible, so that corresponding defensive measures can be taken during the design stage to avoid possible risks.
  • the formulated defense strategy can avoid risks, evaluate the security of elliptic curve algorithms before elliptic curve cryptography products leave the factory, and reduce the possibility of security vulnerabilities in elliptic curve cryptography products after they leave the factory.
  • this application provides a verification method, which proves through experiments, simulations, and usage that the method of attacking the elliptic curve signature algorithm provided in the above embodiment is feasible.
  • Simulation technology (such as verilog simulation) can be used for verification.
  • the first default formula is:
  • x 1 0xebee644b9230fe06f800580adc5c276234c2861e947ce115f087c7a7ae;
  • y 1 0xd487a7fbd71127ae9bc23a64422b9fbff5eeb9a5c4ec85e2a45ee16928;
  • r′ 0x2d0941109d2dc453ed6b455bd6b5cb4b1f7b4c617f324115668c7a681c;
  • s′ 0xa247adba046a18f5854422e93d1b413ce12972abb42acfb90da51e844;
  • x′ 1 01b1019b59295958118dd0b8d90eba6544819feb790522abdb941284f179;
  • y′ 1 001372f062204ba1fe4cca80c2b074e5578350e712fb121652614d80156b;
  • d A (ks) (s+r) -1 mod n, calculate the value of d A , that is, obtain the private key of the elliptic curve signature algorithm.
  • Figure 4 is a schematic diagram of a device for attacking the elliptic curve signature algorithm provided by an embodiment of the present application. As shown in Figure 4, the device includes:
  • the acquisition unit 210 is used to acquire the first coordinate point on the elliptic curve.
  • the first coordinate point is calculated based on the correct signature value corresponding to the message to be signed.
  • the correct signature value is calculated based on the elliptic curve signature algorithm.
  • the message to be signed is obtained by performing normal signature operations;
  • the computing unit 220 is configured to perform multiple signature operations on the message to be signed, and inject errors into the random numbers generated during each signature operation to obtain multiple error random numbers;
  • the calculation unit 230 is configured to calculate a plurality of second coordinate points on the elliptic curve according to the plurality of erroneous random numbers and the first preset formula;
  • the determining unit 240 is configured to determine the private key of the elliptic curve signature algorithm based on the correct signature value, the first coordinate point, and the plurality of second coordinate points.
  • the random number includes multiple bit values
  • the operation unit 220 is specifically configured to: for each signature operation, change the value of one bit in the random number generated during the signature operation, Get the error random number.
  • the computing unit 230 is specifically used to:
  • the plurality of second coordinate points are calculated according to the plurality of erroneous signature values and the first preset formula.
  • the determining unit 240 is specifically used to:
  • the private key is calculated according to the second preset formula, the target random number and the correct signature value.
  • the number of signature operations performed on the message to be signed is determined based on the number of bits of the random number and a preset value range.
  • the device also includes:
  • a strategy determination unit configured to determine a defense strategy for the elliptic curve signature algorithm.
  • Figure 5 is a schematic diagram of a terminal device provided by another embodiment of the present application.
  • the terminal device 3 of this embodiment includes: a processor 30 , a memory 31 , and a computer program 33 stored in the memory 31 and executable on the processor 30 .
  • the processor 30 executes the computer program 33 , the steps in each of the above method embodiments are implemented, such as S101 to S104 shown in FIG. 1 .
  • the processor 30 executes the computer program 33, it implements the functions of each unit in the above embodiments, such as the functions of units 210 to 240 shown in Figure 4.
  • the computer program 33 may be divided into one or more units, and the one or more units are stored in the memory 31 and executed by the processor 30 to complete the present application.
  • the one or more units may be a series of computer instruction segments capable of completing specific functions.
  • the instruction segments are used to describe the execution process of the computer program 33 in the terminal device 3 .
  • the computer program 33 can be divided into an acquisition unit, an operation unit, a calculation unit and a determination unit, and the specific functions of each unit are as described above.
  • the terminal device may include, but is not limited to, a processor 30 and a memory 31 .
  • Figure 5 is only an example of the terminal device 3 and does not constitute a limitation of the device. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as
  • the terminal device may also include input and output devices, network access devices, buses, etc.
  • the so-called processor 30 can be a central processing unit (Central Processing Unit, CPU), or other general-purpose processor, digital signal processor (Digital Signal Processor, DSP), application specific integrated circuit (Application Specific Integrated Circuit, ASIC), Ready-made field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the memory 31 may be an internal storage unit of the terminal device, such as a hard disk or memory of the device.
  • the memory 31 may also be an external storage terminal of the terminal device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), or a secure digital (Secure Digital, SD) card equipped on the terminal device. Flash Card, etc.
  • the memory 31 may also include both an internal storage unit of the device and an external storage terminal.
  • the memory 31 is used to store the computer instructions and other programs and data required by the terminal.
  • the memory 31 can also be used to temporarily store data that has been output or is to be output.
  • Embodiments of the present application also provide a computer storage medium.
  • the computer storage medium may be non-volatile or volatile.
  • the computer storage medium stores a computer program. When the computer program is executed by a processor, the above methods are implemented. Steps in Examples.
  • This application also provides a computer program product.
  • the computer program product When the computer program product is run on a terminal device, it causes the terminal device to execute the steps in each of the above method embodiments.
  • Embodiments of the present application also provide a chip or integrated circuit.
  • the chip or integrated circuit includes: a processor, configured to call and run a computer program from the memory, so that the terminal device installed with the chip or integrated circuit executes each of the above methods. Steps in Examples.
  • Module completion means dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above.
  • Each functional unit and module in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above-mentioned integrated unit can be hardware-based. It can also be implemented in the form of software functional units.
  • the specific names of each functional unit and module are only for the convenience of distinguishing each other and are not used to limit the scope of protection of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Collating Specific Patterns (AREA)

Abstract

本申请提供一种攻击椭圆曲线签名算法的方法、装置、终端设备及存储介质，涉及信息安全技术领域。该方法包括：获取椭圆曲线上的第一坐标点；对待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；根据多个错误随机数和第一预设公式，计算得到椭圆曲线上的多个第二坐标点；根据正确的签名值、第一坐标点以及多个第二坐标点，确定椭圆曲线签名算法的私钥。对签名运算过程中产生的随机数进行攻击，使得攻击后计算得到的坐标点还在原来的椭圆曲线上，不容易被检测到，从而不容易被防御，整个攻击过程简单，降低了破解私钥的困难程度，实现了快速、准确地获取到椭圆曲线签名算法的私钥。

Description

攻击椭圆曲线签名算法的方法、装置、设备及存储介质 技术领域
本申请涉及信息安全技术领域，尤其涉及一种攻击椭圆曲线签名算法的方法、装置、终端设备及存储介质。
背景技术
椭圆曲线签名算法相比于传统的签名算法，在同样的安全强度下只需更短的密钥长度，更适合于应用到资源受限的芯片中。例如，该椭圆曲线签名算法就非常适用于处理能力、存储空间、带宽及功耗受限的车联网应用环境。
针对椭圆曲线签名算法的攻击方法也在不断地出现。然而，现有的攻击方法难度大，还容易被防御，导致无法快速、准确地获取到椭圆曲线签名算法的私钥。
发明内容
有鉴于此，本申请提供一种攻击椭圆曲线签名算法的方法、装置、终端设备及存储介质，以解决现有的攻击方法难度大，还容易被防御，导致无法快速、准确地获取到椭圆曲线签名算法的私钥的问题。
第一方面，本申请提供一种攻击椭圆曲线签名算法的方法，包括：获取椭圆曲线上的第一坐标点，第一坐标点是根据待签名消息对应的正确的签名值计算得到的，正确的签名值是根据椭圆曲线签名算法对待签名消息进行正常的签名运算得到的；
对待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；
根据多个错误随机数和第一预设公式，计算得到椭圆曲线上的多个第二坐标点；
根据正确的签名值、第一坐标点以及多个第二坐标点，确定椭圆曲线签名算法的私钥。
上述方案中，对签名运算过程中产生的随机数进行攻击，使得攻击后计算得到的坐标点还在原来的椭圆曲线上，不容易被检测到，从而不容易被防御。再基于正确的签名值、正确签名算法情况下计算得到的第一坐标点以及被攻击情况下计算得到的多个第二坐标点，确定椭圆曲线签名算法的私钥。整个攻击过程简单，降低了破解私钥的困难程度，实现了快速、准确地获取到椭圆曲线签名算法的私钥。
在一个可能的实现方式中，随机数包括多个比特位的值，对待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数，包括：针对每次签名运算，改变签名运算过程中产生的随机数中的一个比特位的值，得到错误随机数。
在一个可能的实现方式中，根据多个错误随机数和第一预设公式，计算得到椭圆曲线上的多个第二坐标点，包括：
根据多个错误随机数计算得到多个错误的签名值；
根据多个错误的签名值和第一预设公式，计算得到多个第二坐标点。
在一个可能的实现方式中，根据正确的签名值、第一坐标点以及多个第二坐标点，确定椭圆曲线签名算法的私钥，包括：
对第一坐标点和多个第二坐标点进行差分运算，得到多个逻辑值；
根据多个逻辑值生成目标随机数；
根据第二预设公式、目标随机数以及正确的签名值，计算得到私钥。
在一个可能的实现方式中，对待签名消息进行签名运算的次数，根据 随机数的比特位的个数和预设取值范围确定。
在一个可能的实现方式中，根据正确的签名值、第一坐标点以及多个第二坐标点，确定椭圆曲线签名算法的私钥之后，该方法还包括：确定椭圆曲线签名算法的防御策略。
第二方面，本申请提供一种攻击椭圆曲线签名算法的装置，包括：
获取单元，用于获取椭圆曲线上的第一坐标点，所述第一坐标点是根据待签名消息对应的正确的签名值计算得到的，所述正确的签名值是根据椭圆曲线签名算法对所述待签名消息进行正常的签名运算得到的；
运算单元，用于对所述待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；
计算单元，用于根据所述多个错误随机数和第一预设公式，计算得到所述椭圆曲线上的多个第二坐标点；
确定单元，用于根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名算法的私钥。
第三方面，本申请提供一种终端设备，包括存储器、处理器以及存储在该存储器中并可在该处理器上运行的计算机程序，该处理器执行该计算机程序时实现上述第一方面中任一方式所述的方法。
第四方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述第一方面中任一方式所述的方法。
第五方面，本申请实施例提供一种计算机程序产品，当计算机程序产品在处理器上运行时，使得处理器执行上述第一方面中任一方式所述的方法。
第六方面，本申请实施例提供一种芯片，包括处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的终端设备执行上述第一 方面中任一方式所述的方法。
本申请其他方面的有益效果请参考第一方面的有益效果的描述，此处不再赘述。
附图说明
图1是本申请一示例性实施例提供的一种攻击椭圆曲线签名算法的方法的示意性流程图；
图2是本申请另一示例性实施例示出的一种攻击椭圆曲线签名算法的方法的步骤S103的具体流程图；
图3是本申请又一示例性实施例示出的一种攻击椭圆曲线签名算法的方法的步骤S104的具体流程图；
图4为本申请实施例提供的一种攻击椭圆曲线签名算法的装置的示意图；
图5是本申请另一实施例提供的终端设备的示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
椭圆曲线签名算法相比于传统的签名算法，在同样的安全强度下只需更短的密钥长度，更适合于应用到资源受限的芯片中。例如，该椭圆曲线签名算法就非常适用于处理能力、存储空间、带宽及功耗受限的车联网应用环境，是我国车联网安全技术中的国产公钥密码方案。
安全芯片是有效保障我国车联网安全的核心与基石。其中，安全芯片指可信任平台模块，是一个可独立进行密钥生成、加解密的装置，内部拥 有独立的处理器和存储单元，可存储密钥和特征数据，为电脑提供加密和安全认证服务。用安全芯片进行加密，密钥被存储在硬件中，被窃的数据无法解密，从而保护商业隐私和数据安全。
虽然安全芯片中有复杂的加解密算法和密钥保护机制，但是近年来安全芯片还是很容易受到错误注入攻击，从而导致在加密算法执行的过程中产生瞬态的逻辑错误，攻击者通过分析正确的和错误的加密结果，最终引起密钥的泄露。
安全芯片的错误注入攻击已被列为美国联邦信息处理标准“FIPS 140-3”中重要的一类攻击方式。因此，研究新的错误攻击方法，能够帮助设计者尽早发现算法和硬件中存在的潜在风险，使得在设计阶段就能做出相应的防御措施，规避可能的风险。
例如，在现有的攻击椭圆曲线签名算法的基础上，研究新的攻击椭圆曲线签名算法的方法，并根据该新的攻击椭圆曲线签名算法的方法，查找攻击椭圆曲线签名算法和硬件中存在的潜在风险，制定相应的防御策略，规避可能的风险。能够在椭圆曲线密码产品出厂之前，对椭圆曲线算法的安全性进行评估，减少椭圆曲线密码产品在出厂后存在安全漏洞的情况。
可见，对椭圆曲线签名算法的攻击方法的研究非常有必要。根据攻击位置不同，即故障注入椭圆曲线的位置不同，现有的攻击方法可以分为基点攻击和椭圆曲线参数攻击。前者通过在点乘的运算环节注入故障，然后获取私钥，后者通过结合椭圆曲线上的离散对数问题(ECDLP)来破解私钥。
首先，以上两种攻击方法都很复杂，并且破解时存在一定的随机性。ECDLP方法在基点的阶的最大素因子大到一定位数时，以现在的计算机水平是无法在有限的可计算时间内完成破解的。
其次，以上两种攻击方法的共同点是使得中间点和输出点不在原来安全的椭圆曲线上，即移动到了一条新的弱椭圆曲线上。这种攻击方法恰恰很容易被检测到，即通过检查由国家密码管理部门批准的基于椭圆曲线的 非对称密码算法(SM2)的基点、所有用于计算的中间点以及最终输出点是否在安全的椭圆曲线上，就能判断当前算法是否安全。如果任何一点不在安全椭圆曲线上，则阻止输出。
此外，这两种攻击方法都是围绕点乘操作进行攻击的，然而在实际的运算中，点乘只是签名或者加密过程的中间环节，用于攻击破解的点乘结果数据是运算过程中的中间量，是无法获取的，尤其在安全芯片中。因此，现有的攻击方法难度大，还容易被防御，导致无法快速、准确地获取到椭圆曲线签名算法的私钥。
有鉴于此，本申请提供了一种攻击椭圆曲线签名算法的方法、装置、终端设备及存储介质。通过对签名运算过程中产生的随机数进行攻击，使得攻击后计算得到的坐标点还在原来的椭圆曲线上，不容易被检测到，从而不容易被防御。再基于正确的签名值、正确签名算法情况下计算得到的第一坐标点以及被攻击情况下计算得到的多个第二坐标点，确定椭圆曲线签名算法的私钥。整个攻击过程简单，无需像现有技术中那样逐步缩小范围去推测私钥，降低了破解私钥的困难程度，实现了快速、准确地获取到椭圆曲线签名算法的私钥。且研究这种攻击方法，能够帮助设计者尽早发现算法和硬件中存在的潜在风险，使得在设计阶段就能做出相应的防御措施，规避可能的风险。
下面以具体地实施例对本申请的技术方案进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例不再赘述。
请参见图1，图1是本申请一示例性实施例提供的一种攻击椭圆曲线签名算法的方法的示意性流程图。本申请提供的攻击椭圆曲线签名算法的方法的执行主体为终端设备，其中，该终端设备包括但不限于车载电脑、平板电脑、计算机、智能手机、可穿戴设备、个人数字助理(Personal Digital Assistant，PDA)等设备。或者，也可以是预先在终端设备上安装应用程序或小程序等，利用安装的应用程序或小程序执行攻击椭圆曲线签名算法 的方法。
本申请提供的攻击椭圆曲线签名算法的方法的执行主体还可以为各种类型的服务器。例如，服务器可以是独立的服务器，也可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务。
请参见图1，图1是本申请一示例性实施例提供的一种攻击椭圆曲线签名算法的方法的示意性流程图。如图1所示的方法可包括：S101～S104，具体如下：
S101：获取椭圆曲线上的第一坐标点。
椭圆曲线可以理解为描述了特定点的集合的公式，实质上是一个数学方程，第一坐标点是该椭圆曲线上的一个坐标点。该第一坐标点是根据待签名消息对应的正确的签名值计算得到的，正确的签名值是根据椭圆曲线签名算法对待签名消息进行正常的签名运算得到的。
待签名消息指明文，即没有加密的文字或字符串，本示例中用M表示明文。基于椭圆曲线签名算法对待签名消息进行正常的签名运算，得到该待签名消息对应的正确的签名值(签名对)。本示例中用(r,s)表示正确的签名值(签名对)。其中，正常的签名运算指没有任何攻击情况下进行的签名运算，此时得到的签名值又称为正确的签名值。
示例性地，椭圆曲线签名算法可以包括SM2签名算法、SM9签名算法等非对称算法。本示例中以SM2签名算法为例进行说明。
例如，预先获取用户的自身消息和椭圆曲线的参数。其中，用户的自身消息可以包括用户的身份信息，椭圆曲线的参数可以包括椭圆曲线的基点，可以理解为椭圆曲线中的第一个点，本示例中用P表示基点。
对用户的自身消息和椭圆曲线的参数进行杂凑运算，得到杂凑值。杂 凑运算又称哈希函数，就是把任意长度的输入消息串变化成固定长度的输出串的一种函数。杂凑值又称哈希值，本示例中用Z A表示用户A的杂凑值。
具体地，输入明文M。利用杂凑值Z A计算
Figure PCTCN2022137696-appb-000001
的值，如置
Figure PCTCN2022137696-appb-000002
即令
Figure PCTCN2022137696-appb-000003
根据哈希函数H和
Figure PCTCN2022137696-appb-000004
的值计算e的值，如计算
Figure PCTCN2022137696-appb-000005
利用随机数生成器生成随机数k，k∈[1,n-1]；
计算k*P＝(x 1,y 1)，其中，(x 1,y 1)表示椭圆曲线上的坐标点；
计算r＝(e+x 1)mod n，其中，n表示椭圆曲线的阶。若r＝0或者r+k＝n，则返回执行利用随机数生成器生成随机数k这一步骤；
若r≠0或者r+k≠n，则计算s＝((1+d A) -1·(k-rd A))mod n，其中，d A表示私钥。若s＝0，则返回执行利用随机数生成器生成随机数k这一步骤；
若s≠0，则输出正确的签名值(r,s)和明文M。
示例性地，根据待签名消息对应的正确的签名值(r,s)和第一预设公式计算第一坐标点，本示例中用Q(x 1,y 1)表示第一坐标点。
由于r＝(e+x 1)mod n，用i表示x 1的比特位，i＝0,1,2,3....；i取使0<x 1<n的值，再有Q满足椭圆曲线y 2+xy＝x 3+1，推导出第一预设公式为：
Figure PCTCN2022137696-appb-000006
将r、i、n、e的值代入第一预设公式中，计算出第一坐标点Q(x 1,y 1)的值。
S102：对待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数。
S102步骤中的签名运算与S101步骤中的签名运算的区别是，S101步骤中的签名运算是在没有任何攻击情况下进行的签名运算，而S102步骤中的签名运算对签名运算过程中产生的随机数注入了攻击。
示例性地，对待签名消息进行多次签名运算，在每次签名运算过程中都会利用随机数生成器生成随机数，对产生的随机数注入错误，即注入故障，注入错误后的随机数即为错误随机数。本示例中用k′表示错误随机数。
可选地，在一种可能的实现方式中，签名运算过程中产生的随机数可以包括多个比特位的值，对待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数，包括：针对每次签名运算，改变签名运算过程中产生的随机数中的一个比特位的值，得到错误随机数。
示例性地，随机数包含的比特位的数量可根据实际情况设定。例如，本实例中随机数可以包括233个比特位的值，此处仅为示例性说明，对此不做限定。
针对每次签名运算，改变签名运算过程中产生的随机数中的一个比特位的值，即对签名运算过程中标量乘这一步中的随机数，每次注入一比特位故障，注入故障的随机数即为错误随机数k′。
也就是说，对随机数注入错误(注入故障)，实际上就是对随机数中的一比特位的值进行改变。例如，某一比特位的值为1，注入错误就可以是将1变为0；又例如，某一比特位的值为0，注入错误就可以是将0变为1。
在一种可能的实现方式中，可以按照随机数中各个比特位的值的排列顺序，依次注入错误。例如，对待签名消息进行多次签名运算，第一次签名运算时，改变签名运算过程中产生的随机数中的第一个比特位的值，得到一个错误随机数。第二次签名运算时，改变签名运算过程中产生的随机数中的第二个比特位的值，得到一个错误随机数。以此类推，直至随机数 中每个比特位的值都被注入错误，得到多个错误随机数。
在另一种可能的实现方式中，可以随机对随机数中各个比特位的值注入错误，每次注入错误后，记录本次注入错误的位置，如记录第N位比特位，之后注入错误时避开已经注入错误的比特位的值。反复执行，直至随机数中每个比特位的值都被注入错误，得到多个错误随机数。
本实施方式中，在每次签名运算时，改变签名运算过程中产生的随机数中的一个比特位的值，实现了对签名运算过程中产生的随机数的攻击。且每次改变一个比特位的值，便于后续快速计算错误随机数和第二坐标点，从而间接提升了破解私钥的速度。
S103：根据多个错误随机数和第一预设公式，计算得到椭圆曲线上的多个第二坐标点。
示例性地，按照S101步骤中描述的签名运算的流程，对待签名消息进行签名运算。值得说明的是，此过程中需要将S101步骤中签名运算过程中的随机数k替换为错误随机数k′，其余流程类似，计算得到错误的签名值(签名对)，本示例中用(r′,s′)表示错误的签名值(签名对)。
按照S101步骤中描述的根据待签名消息对应的正确的签名值(r,s)和第一预设公式计算第一坐标点的方式，根据待签名消息对应的错误的签名值(r′,s′)和第一预设公式计算第二坐标点，本示例中用Q′(x′ 1,y′ 1)表示第二坐标点。对每次签名运算过程都进行这样的处理，可计算得到椭圆曲线上的多个第二坐标点。
S104：根据正确的签名值、第一坐标点以及多个第二坐标点，确定椭圆曲线签名算法的私钥。
示例性地，用该第一坐标点与每个第二坐标点都进行差分运算，可得到多个逻辑值。利用多个逻辑值生成目标随机数，目标随机数中包括多个比特位，逻辑值表示目标随机数中任一比特位的值。值得说明的是，目标 随机数中比特位的数量与逻辑值的数量相同。根据第二预设公式、目标随机数以及正确的签名值，计算得到椭圆曲线签名算法的私钥。
本实施方式中，通过对签名运算过程中产生的随机数进行攻击，使得攻击后计算得到的坐标点还在原来的椭圆曲线上，不容易被检测到，从而不容易被防御。再基于正确的签名值、正确签名算法情况下计算得到的第一坐标点以及被攻击情况下计算得到的多个第二坐标点，确定椭圆曲线签名算法的私钥。整个攻击过程简单，无需像现有技术中那样逐步缩小范围去推测私钥，降低了破解私钥的困难程度，实现了快速、准确地获取到椭圆曲线签名算法的私钥。
请参见图2，图2是本申请另一示例性实施例示出的一种攻击椭圆曲线签名算法的方法的步骤S103的具体流程图，可选地，在一种可能的实现方式中，上述S103可包括S1031～S1032，具体如下：
S1031：根据多个错误随机数计算得到多个错误的签名值。
示例性地，可重新获取用户的自身消息和椭圆曲线的参数。对用户的自身消息和椭圆曲线的参数进行杂凑运算，得到杂凑值。也可以直接利用步骤S101中用到的杂凑值Z A，以实际情况为准，此处不做限定。
具体地，输入明文M。利用杂凑值Z A计算
Figure PCTCN2022137696-appb-000007
的值，如置
Figure PCTCN2022137696-appb-000008
即令
Figure PCTCN2022137696-appb-000009
根据哈希函数H和
Figure PCTCN2022137696-appb-000010
的值计算e的值，如计算
Figure PCTCN2022137696-appb-000011
利用随机数生成器生成随机数k，k∈[1,n-1]；
改变随机数k中的一个比特位的值，得到错误随机数k′；
计算k′*P＝(x 1,y 1)，其中，P表示椭圆曲线的基点，(x 1,y 1)表示椭圆曲线上的坐标点；
计算r′＝(e+x 1)mod n，其中，n表示椭圆曲线的阶。若r′＝0或者r′+k′＝n， 则返回执行利用随机数生成器生成随机数k这一步骤；
若r′≠0或者r′+k′≠n，则计算s′＝((1+d A) -1·(k′-rd A))mod n，其中，d A表示私钥。若s′＝0，则返回执行利用随机数生成器生成随机数k这一步骤；
若s′≠0，则输出错误的签名值(r′,s′)。
重复执行上述过程，得到多个错误的签名值。
可以理解的是，步骤S101中k*P＝(x 1,y 1)，本实施方式中k′*P＝(x 1,y 1)，虽然两个(x 1,y 1)都表示椭圆曲线上的坐标点，但是前者是基于随机数k确定的，后者是基于错误随机数k′确定的，所以两个(x 1,y 1)表示的并不是椭圆曲线上的同一个坐标点。
S1032：根据多个错误的签名值和第一预设公式，计算得到多个第二坐标点。
示例性地，根据待签名消息对应的一个错误的签名值(r′,s′)和第一预设公式计算一个第二坐标点Q′(x′ 1,y′ 1)。
第一预设公式为：
Figure PCTCN2022137696-appb-000012
将r′、i、n、e的值代入第一预设公式中，计算出第二坐标点Q′(x′ 1,y′ 1)的值。重复执行上述过程，得到多个第二坐标点。
本实施方式中，利用错误随机数计算错误的签名值，再利用错误的签名值和第一预设公式，计算得到第二坐标点，这样得到的第二坐标点还在原来的椭圆曲线上，不容易被检测到，从而不容易被防御。
请参见图3，图3是本申请又一示例性实施例示出的一种攻击椭圆曲线签名算法的方法的步骤S104的具体流程图，可选地，在一种可能的实现方式中，上述S104可包括S1041～S1043，具体如下：
S1041：对第一坐标点和多个第二坐标点进行差分运算，得到多个逻辑 值。
示例性地，用该第一坐标点与每个第二坐标点都进行差分运算，可得到多个逻辑值。例如，假设随机数k的第I位被注入故障，那么
Figure PCTCN2022137696-appb-000013
其中，
Figure PCTCN2022137696-appb-000014
并且第一坐标点和第二坐标点满足以下关系：
Figure PCTCN2022137696-appb-000015
由此可以推导出I和k I的值，即得到随机数k被注入错误的一比特位(二进制位)的逻辑值。通过同样的方法，可以得到多个逻辑值，逻辑值的数量与随机数k中比特位的数量相同。
如在签名运算过程中，改变注入错误的位置，遍历所有的
Figure PCTCN2022137696-appb-000016
直至获取到所有的k I的值。
S1042：根据多个逻辑值生成目标随机数。
对哪个位置的比特位注入错误得到了该逻辑值，该比特位的位置即为该逻辑值对应的比特位的位置。每个比特位在随机数k中都有对应的位置，将每个逻辑值按照其对应的比特位的位置进行排列，得到目标随机数。由于目标随机数是由多个逻辑值生成的，目标随机数中比特位的数量与逻辑值的数量相同。
S1043：根据第二预设公式、目标随机数以及正确的签名值，计算得到私钥。
由于s＝((1+d A) -1·(k-rd A))mod n，可推导出第二预设公式：
d A＝(k-s)(s+r) -1mod n，值得说明的是d A＝(k-s)(s+r) -1mod n公式中的k表示目标随机数。
示例性地，将正确的签名值(r,s)和目标随机数代入第二预设公式，计算得到d A的值，即得到椭圆曲线签名算法的私钥。
本实施方式中，基于正确的签名值、正确签名算法情况下计算得到的第一坐标点以及被攻击情况下计算得到的多个第二坐标点，确定椭圆曲线签名算法的私钥。计算过程简单，降低了破解私钥的困难程度，实现了快速、准确地获取到椭圆曲线签名算法的私钥。
可选地，在一种可能的实现方式中，对待签名消息进行签名运算的次数，根据随机数的比特位的个数和预设取值范围确定。
示例性地，预设取值范围为
Figure PCTCN2022137696-appb-000017
其中，k表示随机数，I表示随机数中的第I位比特位，I取最大值时与随机数的比特位的个数相同。由于要保证遍历所有的k I，因此，I取的最大值即为进行签名运算的次数。
本实施方式中，根据随机数的比特位的个数和预设取值范围确定进行签名运算的次数，从而保证能够遍历所有的k I，进而便于后续基于所有的k I生成目标随机数，为破解私钥提供了保障。
可选地，在一种可能的实现方式中，在步骤S104之后，该方法还可包括：确定椭圆曲线签名算法的防御策略。
示例性地，S101～S104描述了椭圆曲线签名算法的攻击方法，即如何对椭圆曲线签名算法进行攻击，从而快速、准确地得到椭圆曲线签名算法的私钥。本实施方式中，根据椭圆曲线签名算法的攻击方法，确定椭圆曲线签名算法的防御策略，即根据S101～S104中对椭圆曲线签名算法进行攻击的方法，制定防御这种攻击方法的策略。
例如，防御策略可以为监控椭圆曲线签名算法的验签次数，当检测到椭圆曲线签名算法的验签次数比正常次数多时，预测椭圆曲线签名算法受到攻击，从而尽早防御。
又例如，本申请采用的攻击方法是运算过程中的结果量，是可以直接获取的。因此，防御策略可以为对结果量进行监控，实时监测结果量是否异常。此处仅为示例性说明，对此不做限定。
本实施方式中，研究对椭圆曲线签名算法的攻击方法，能够帮助设计者尽早发现算法和硬件中存在的潜在风险，使得在设计阶段就能做出相应的防御措施，规避可能的风险。制定的防御策略，能够规避风险，能够在椭圆曲线密码产品出厂之前，对椭圆曲线算法的安全性进行评估，减少椭圆曲线密码产品在出厂后存在安全漏洞的情况。
可选地，在一种可能的实现方式中，本申请提供了一种验证方法，通过实验、模拟、使用证明上述实施例提供的攻击椭圆曲线签名算法的方法可行。可利用仿真技术(如verilog仿真)进行验证。
示例性地，选取美国国家标准与技术研究院(National Institute of Standards and Technology，NIST)推荐的m取值中的233，与之对应的三项式：f(z)＝z 233+z 74+1作为约减多项式。椭圆曲线GF(2 m)上的魏尔斯特拉斯函数(Weierstrass function)定义为：y 2+xy＝x 3+ax 2+b，其中，a,b∈GF(2 m)，且Δ＝b≠0，当b＝1,a＝0时，即为库兹涅茨曲线(Kuznets curve)，又称倒U曲线(inverted U curve)，是椭圆曲线密码体制实现中速度最快的曲线，本文简称为K-233曲线，曲线参数信息表1所示。
表1
Figure PCTCN2022137696-appb-000018
例如，用户A的身份是：ALICE123@YAHOO.COM，用ASCII编码记为：ID A：414C494345313233405941484F4F2E434F4D，ENTL A＝0090。
下面以待签名消息(明文)M＝6D65737361676520646967657374为例说明攻击椭圆曲线签名算法的过程，具体如下：
(1)输入明文M，对明文M进行上述S101中的签名运算，得到正确的签名值(r,s)；
r＝0x67f60a0306056a49579ae48da4579aa38a101280b76a6c856ee4a4760f；
s＝0x3d2089d9de3b9669af40a52182e50d6d0c3e619025c3936cc13588b6f2；
(2)通过正确的签名值(r,s)和第一预设公式计算第一坐标点Q(x 1,y 1)；
第一预设公式为：
Figure PCTCN2022137696-appb-000019
将r、i、n、e的值代入第一预设公式中，计算出第一坐标点Q(x 1,y 1)的值为：
x 1＝0xebee644b9230fe06f800580adc5c276234c2861e947ce115f087c7a7ae；
y 1＝0xd487a7fbd71127ae9bc23a64422b9fbff5eeb9a5c4ec85e2a45ee16928；
(3)继续输入同样的明文M，对该明文进行签名运算，在签名运算过程中，对标量乘这一步中的随机数k，每次注入一比特位故障，注入故障的随机数即为错误随机数k′。例如，对标量乘这一步中的随机数k的第233位注入一比特位故障(I＝233),注入故障的随机数即为错误随机数k′，最终得到注入故障情况下的签名值，即得到错误的签名值(r′,s′)。
r′＝0x2d0941109d2dc453ed6b455bd6b5cb4b1f7b4c617f324115668c7a681c；
s′＝0xa247adba046a18f5854422e93d1b413ce12972abb42acfb90da51e844；
(4)由上一步得到的错误的签名值(r′,s′)计算出注入故障情况下的Q′(x′ 1,y′ 1)；
x′ 1＝01b1019b59295958118dd0b8d90eba6544819feb790522abdb941284f179；
y′ 1＝001372f062204ba1fe4cca80c2b074e5578350e712fb121652614d80156b；
(5)例如，假设随机数k的第I位被注入故障，那么
Figure PCTCN2022137696-appb-000020
其中，
Figure PCTCN2022137696-appb-000021
并且第一坐标点和第二坐标点满足以下关系：
Figure PCTCN2022137696-appb-000022
改变注入错误的位置，遍历所有的
Figure PCTCN2022137696-appb-000023
直至获取到所有的k I的值，从而得到目标随机数k的值。
k＝1000101000000000000000001011101100000000000011011110111100000000000000001010101111000000000000000000000000000000000001101001110110001101110110010001010110111100110101000110110011101011000110101101010111110001011100111010101110111101；
(6)根据第二预设公式：d A＝(k-s)(s+r) -1mod n，计算出d A的值，即得到椭圆曲线签名算法的私钥。
d A＝01110111000111101111001111011011111111110101111100011100110111000011001010111001110001010111001010010011000001000111011000011001000110011001100010110010101111110111110010111001100000011101011111110101101100111001001000000010；
至此，私钥d A被破解。
图4为本申请实施例提供的一种攻击椭圆曲线签名算法的装置的示意图，如图4所示，该装置包括：
获取单元210，用于获取椭圆曲线上的第一坐标点，所述第一坐标点是根据待签名消息对应的正确的签名值计算得到的，所述正确的签名值是根据椭圆曲线签名算法对所述待签名消息进行正常的签名运算得到的；
运算单元220，用于对所述待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；
计算单元230，用于根据所述多个错误随机数和第一预设公式，计算得到所述椭圆曲线上的多个第二坐标点；
确定单元240，用于根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名算法的私钥。
可选的，所述随机数包括多个比特位的值，所述运算单元220具体用于：针对每次签名运算，改变签名运算过程中产生的所述随机数中的一个比特位的值，得到所述错误随机数。
可选的，所述计算单元230具体用于：
根据所述多个错误随机数计算得到多个错误的签名值；
根据所述多个错误的签名值和所述第一预设公式，计算得到所述多个第二坐标点。
可选的，所述确定单元240具体用于：
对所述第一坐标点和所述多个第二坐标点进行差分运算，得到多个逻辑值；
根据所述多个逻辑值生成目标随机数；
根据第二预设公式、所述目标随机数以及所述正确的签名值，计算得到所述私钥。
可选地，对所述待签名消息进行签名运算的次数，根据所述随机数的比特位的个数和预设取值范围确定。
可选地，该装置还包括：
策略确定单元，用于确定所述椭圆曲线签名算法的防御策略。
请参见图5，图5是本申请另一实施例提供的终端设备的示意图。如图5所示，该实施例的终端设备3包括：处理器30、存储器31以及存储在所述存储器31中并可在所述处理器30上运行的计算机程序33。所述处理器30执行所述计算机程序33时实现上述各个方法实施例中的步骤，例如图1所示的S101至S104。或者，所述处理器30执行所述计算机程序33时实现上述各实施例中各单元的功能，例如图4所示单元210至240功能。
示例性地，所述计算机程序33可以被分割成一个或多个单元，所述一个或者多个单元被存储在所述存储器31中，并由所述处理器30执行，以完成本申请。所述一个或多个单元可以是能够完成特定功能的一系列计算机指令段，该指令段用于描述所述计算机程序33在所述终端设备3中的执行过程。例如，所述计算机程序33可以被分割为获取单元、运算单元、计算单元以及确定单元，各单元具体功能如上所述。
所述终端设备可包括，但不仅限于，处理器30、存储器31。本领域技术人员可以理解，图5仅仅是终端设备3的示例，并不构成对设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述终端设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器30可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述存储器31可以是所述终端设备的内部存储单元，例如设备的硬盘或内存。所述存储器31也可以是所述终端设备的外部存储终端，例如所述终端设备上配备的插接式硬盘，智能存储卡(Smart Media Card，SMC)，安全数字(Secure Digital，SD)卡，闪存卡(Flash Card)等。进一步地，所述存储器31还可以既包括所述设备的内部存储单元也包括外部存储终端。所述存储器31用于存储所述计算机指令以及所述终端所需的其他程序和数据。所述存储器31还可以用于暂时地存储已经输出或者将要输出的数据。
本申请实施例还提供了一种计算机存储介质，计算机存储介质可以是非易失性，也可以是易失性，该计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述各个方法实施例中的步骤。
本申请还提供了一种计算机程序产品，当计算机程序产品在终端设备上运行时，使得该终端设备执行上述各个方法实施例中的步骤。
本申请实施例还提供了一种芯片或者集成电路，该芯片或者集成电路包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有该芯片或者集成电路的终端设备执行上述各个方法实施例中的步骤。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
以上所述实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方 案的本质脱离本申请各实施例技术方案的精神范围，均应包含在本申请的保护范围之内。

Claims (10)

  1. 一种攻击椭圆曲线签名算法的方法，其特征在于，包括：
    获取椭圆曲线上的第一坐标点，所述第一坐标点是根据待签名消息对应的正确的签名值计算得到的，所述正确的签名值是根据椭圆曲线签名算法对所述待签名消息进行正常的签名运算得到的；
    对所述待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；
    根据所述多个错误随机数和第一预设公式，计算得到所述椭圆曲线上的多个第二坐标点；
    根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名算法的私钥。
  2. 根据权利要求1所述的方法，其特征在于，所述随机数包括多个比特位的值，所述对所述待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数，包括：
    针对每次签名运算，改变签名运算过程中产生的所述随机数中的一个比特位的值，得到所述错误随机数。
  3. 根据权利要求1所述的方法，其特征在于，所述根据所述多个错误随机数和第一预设公式，计算得到所述椭圆曲线上的多个第二坐标点，包括：
    根据所述多个错误随机数计算得到多个错误的签名值；
    根据所述多个错误的签名值和所述第一预设公式，计算得到所述多个第二坐标点。
  4. 根据权利要求1所述的方法，其特征在于，所述根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名 算法的私钥，包括：
    对所述第一坐标点和所述多个第二坐标点进行差分运算，得到多个逻辑值；
    根据所述多个逻辑值生成目标随机数；
    根据第二预设公式、所述目标随机数以及所述正确的签名值，计算得到所述私钥。
  5. 根据权利要求2至4任一项所述的方法，其特征在于，对所述待签名消息进行签名运算的次数，根据所述随机数的比特位的个数和预设取值范围确定。
  6. 根据权利要求1至4任一项所述的方法，其特征在于，所述根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名算法的私钥之后，所述方法还包括：
    确定所述椭圆曲线签名算法的防御策略。
  7. 一种攻击椭圆曲线签名算法的装置，其特征在于，包括：
    获取单元，用于获取椭圆曲线上的第一坐标点，所述第一坐标点是根据待签名消息对应的正确的签名值计算得到的，所述正确的签名值是根据椭圆曲线签名算法对所述待签名消息进行正常的签名运算得到的；
    运算单元，用于对所述待签名消息进行多次签名运算，并对每次签名运算过程中产生的随机数注入错误，得到多个错误随机数；
    计算单元，用于根据所述多个错误随机数和第一预设公式，计算得到所述椭圆曲线上的多个第二坐标点；
    确定单元，用于根据所述正确的签名值、所述第一坐标点以及所述多个第二坐标点，确定所述椭圆曲线签名算法的私钥。
  8. 一种终端设备，包括存储器、处理器以及存储在所述存储器中并可 在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至6任一项所述的方法。
  9. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至6任一项所述的方法。
  10. 一种芯片，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的终端设备执行如权利要求1至6任一项所述的方法。
PCT/CN2022/137696 2022-08-18 2022-12-08 攻击椭圆曲线签名算法的方法、装置、设备及存储介质 Ceased WO2024036833A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210992927.2 2022-08-18
CN202210992927.2A CN115473649B (zh) 2022-08-18 2022-08-18 攻击椭圆曲线签名算法的方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024036833A1 true WO2024036833A1 (zh) 2024-02-22

Family

ID=84366271

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137696 Ceased WO2024036833A1 (zh) 2022-08-18 2022-12-08 攻击椭圆曲线签名算法的方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN115473649B (zh)
WO (1) WO2024036833A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118568741A (zh) * 2024-04-30 2024-08-30 广东创新科技职业学院 一种基于云计算的数据存储安全管控方法及系统
CN119814279A (zh) * 2025-03-11 2025-04-11 江苏意源科技有限公司 用于抗量子计算的混合加密认证方法、装置及设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118174846B (zh) * 2024-05-11 2024-08-13 深圳市纽创信安科技开发有限公司 针对sm9算法的故障注入方法、装置、设备、介质及程序
CN120074793B (zh) * 2025-02-26 2026-03-27 泉城省实验室 一种多参与方的椭圆曲线攻击方法、装置及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150092941A1 (en) * 2013-09-27 2015-04-02 Santosh Ghosh Fault tolerant apparatus and method for elliptic curve cryptography
CN109067554A (zh) * 2018-10-31 2018-12-21 北京云测信息技术有限公司 抗注入攻击的签名方法、装置、移动终端及存储介质
CN111835518A (zh) * 2020-07-10 2020-10-27 中金金融认证中心有限公司 椭圆曲线公钥密码算法安全性测评中的错误注入方法及系统
CN114465728A (zh) * 2020-11-09 2022-05-10 上海复旦微电子集团股份有限公司 攻击椭圆曲线签名算法的方法、装置、设备及存储介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104717060B (zh) * 2015-03-10 2017-11-17 大唐微电子技术有限公司 一种攻击椭圆曲线加密算法的方法和攻击设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150092941A1 (en) * 2013-09-27 2015-04-02 Santosh Ghosh Fault tolerant apparatus and method for elliptic curve cryptography
CN109067554A (zh) * 2018-10-31 2018-12-21 北京云测信息技术有限公司 抗注入攻击的签名方法、装置、移动终端及存储介质
CN111835518A (zh) * 2020-07-10 2020-10-27 中金金融认证中心有限公司 椭圆曲线公钥密码算法安全性测评中的错误注入方法及系统
CN114465728A (zh) * 2020-11-09 2022-05-10 上海复旦微电子集团股份有限公司 攻击椭圆曲线签名算法的方法、装置、设备及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118568741A (zh) * 2024-04-30 2024-08-30 广东创新科技职业学院 一种基于云计算的数据存储安全管控方法及系统
CN119814279A (zh) * 2025-03-11 2025-04-11 江苏意源科技有限公司 用于抗量子计算的混合加密认证方法、装置及设备

Also Published As

Publication number Publication date
CN115473649B (zh) 2025-02-07
CN115473649A (zh) 2022-12-13

Similar Documents

Publication Publication Date Title
WO2024036833A1 (zh) 攻击椭圆曲线签名算法的方法、装置、设备及存储介质
US11575501B2 (en) Preserving aggregation using homomorphic encryption and trusted execution environment, secure against malicious aggregator
CN113691502B (zh) 通信方法、装置、网关服务器、客户端及存储介质
CN111917533B (zh) 具有减少泄漏的区间统计量的隐私保护基准分析
CN110663215B (zh) 在白盒场景中的椭圆曲线点乘设备和方法
Syam Kumar et al. An efficient and secure protocol for ensuring data storage security in cloud computing
Garg et al. Comparative analysis of cloud data integrity auditing protocols
Chen et al. Data dynamics for remote data possession checking in cloud storage
Dhany et al. Encryption and decryption using password based encryption, MD5, and DES
CN110401627A (zh) 一种适用于分组密码算法感染防护的抗差分故障攻击安全性评估方法和系统
US11777717B2 (en) Method for end entity attestation
EP3020159A1 (en) Electronic signature system
Fanfara et al. Usage of asymmetric encryption algorithms to enhance the security of sensitive data in secure communication
Wu Research of cloud platform data encryption technology based on ECC algorithm
US12445303B2 (en) Processor to accelerate and secure hash-based signature computations
Nandalal et al. Design of programmable hardware security modules for enhancing blockchain based security framework
Syam Kumar et al. RSA-based dynamic public audit service for integrity verification of data storage in cloud computing using Sobol sequence
KR101026647B1 (ko) 통신 보안 시스템 및 그 방법과 이에 적용되는 키 유도 암호알고리즘
Li et al. SecDV: A lightweight secure deep neural network inference service with dynamic verification
Hermelink Side-channel and fault attacks in modern lattice-based cryptography
CN112766970A (zh) 一种信息存储方法、装置及系统
Gong et al. Practical Opcode-based Fault Attack on AES-NI
Shi et al. Protecting encrypted signature functions against intrusions on computing devices by obfuscation
Peng et al. Injecting a Chaos-Based Image Encryption Scheme in the Hardware Domain of IIoT
Solitario Research Outlook of Crypto Systems in the Quantum Computing Era

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22955602

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22955602

Country of ref document: EP

Kind code of ref document: A1