jvdsn/crypto-attacks密码学攻击与实用工具的 Python 实现。
密码学攻击与实用工具的 Python 实现。
你可以使用以下命令检查你的 SageMath Python 版本：``` $ sage -python --version Python 3.9.0
如果你的 SageMath Python 版本低于 3.9.0，某些脚本中的某些功能可能无法正常工作。
## 用法
单元测试位于 `test` 目录中，可以使用 `unittest` 模块或 `pytest` 来执行。这不会花费太长时间，具体取决于你的机器，可能需要几分钟。
要运行特定攻击，你必须在执行前将代码添加到相应的文件中。
### 示例
例如，你想使用 Boneh-Durfee 攻击来攻击 RSA，并使用以下参数（取自 [test_rsa.py](https://github.com/jvdsn/crypto-attacks/blob/master/test/test_rsa.py)）：```python
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249
e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511
在 boneh_durfee.py 文件的底部添加以下代码：```python import logging
logging.basicConfig(level=logging.DEBUG)
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249 e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511 p_bits = 512 delta = 0.26
p, q = attack(N, e, p_bits, delta=delta, m=3) assert p * q == N print(f"Found {p = } and {q = }")
然后，你可以简单地使用 Sage 执行该文件。无论你从哪里执行它都没有关系，Python 路径会自动设置（你也可以从其他 Python 文件中调用这些攻击，但那样的话你必须自己修复 Python 路径）：```commandline
[crypto-attacks]$ sage -python attacks/rsa/boneh_durfee.py
INFO:root:Trying m = 3, t = 1...
DEBUG:root:Generating shifts...
DEBUG:root:Creating a lattice with 11 shifts (order = 'invlex', sort_shifts_reverse = False, sort_monomials_reverse = False)...
DEBUG:root:Reducing a 11 x 11 lattice...
DEBUG:root:Reconstructing polynomials (divide_original = True, modulus_bound = False, divide_gcd = True)...
DEBUG:root:Polynomial at row 8 is constant, ignoring...
DEBUG:root:Reconstructed polynomial has gcd 1312232632720549890113031660369306919929075823824696839212183146130434668203517349691252841557097914064120078389640402109017308806168467714230057403815071456395553717020189622129706447677967264344568789118172311850383406340547579993263937406518074980025897726255316031512238322022839331135299265704052474541497687419350763703993630899191179705015113329644753599872380152055902238937889027950089072598069861391599563222633064848996619752054685734260976071760984100109990150069201501748622288840900421607423175114026653242500476408861976142751384898489130281755466581359057847077651502734556259387442296763474369957121 with polynomial at 8, dividing...
DEBUG:root:Reconstructed 10 polynomials
DEBUG:root:Computing pairwise gcds to find trivial roots...
DEBUG:root:Using Groebner basis method to find roots...
DEBUG:root:Sequence length: 10, Groebner basis length: 1
DEBUG:root:Sequence length: 9, Groebner basis length: 1
DEBUG:root:Sequence length: 8, Groebner basis length: 1
DEBUG:root:Sequence length: 7, Groebner basis length: 2
DEBUG:root:Found Groebner basis with length 2, trying to find roots...
Found p = 7866790440964395011005623971351568677139336343167390105188826934257986271072664643571727955882500173182140478082778193338086048035817634545367411924942763 and q = 11227048386374621771175649743442169526805922745751610531569607663416378302561807690656370394330458335919244239976798600743588701676542461805061598571009923
输出日志中显示的参数 m 和 t 值得特别关注。这两个参数在许多基于格（小根）算法中用于调整格的大小。从概念上讲，m（有时称为 k）和 t 表示格中使用的“移位”数量，这大致等于或正比于行数。因此，增加 m 和 t 会增大格的规模，同时也会增加执行格归约（目前使用 LLL）所需的时间。另一方面，如果 m 和 t 过低，则格归约可能无法产生合适的向量，从而浪费归约所花费的时间。因此，这是一个权衡。
在当前版本的项目中，m 必须始终由用户提供（默认值为 1）。在某些情况下，t 可以根据攻击所使用的特定小根方法计算得出。不过，用户仍然可以对其进行调整。一般来说，使用这类参数有两种方式：
m = 1 开始循环，直到找到答案（示例如下）。这是一种简单的方法，但可能因格过小而浪费在无用的计算上。```
m = 1
while True:
res = attack(..., m=m)
if res is not None:
# The attack succeeded!
break
m += 1* 实现一个你打算使用的攻击的调试版本（使用已知结果），并确定能产生良好格向量的 `m` 值。然后直接使用正确的 `m` 值调用攻击方法。
## 已实现的攻击
### 近似公约数
* [x] [多元多项式攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/acd/mp.py) [^acd_mp]
* [x] [基于正交的攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/acd/ol.py) [^acd_ol]
* [x] [联立丢番图逼近攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/acd/sda.py) [^acd_sda]
### CBC
* [x] [比特翻转攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc/bit_flipping.py)
* [x] [IV 恢复攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc/iv_recovery.py)
* [x] [填充预言机攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc/padding_oracle.py)
### CBC + CBC-MAC
* [x] [密钥重用攻击（加密并 MAC）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc_and_cbc_mac/eam_key_reuse.py)
* [x] [密钥重用攻击（先加密后 MAC）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc_and_cbc_mac/etm_key_reuse.py)
* [x] [密钥重用攻击（先 MAC 后加密）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc_and_cbc_mac/mte_key_reuse.py)
### CBC-MAC
* [x] [长度扩展攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/cbc_mac/length_extension.py)
### CTR
* [x] [比特翻转攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ctr/bit_flipping.py)
* [x] [CRIME 攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ctr/crime.py)
* [x] [分隔符预言机攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ctr/separator_oracle.py)
### ECB
* [x] [明文恢复攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecb/plaintext_recovery.py)
* [x] [明文恢复攻击（较难变体）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecb/plaintext_recovery_harder.py)
* [x] [明文恢复攻击（最难变体）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecb/plaintext_recovery_hardest.py)
### 椭圆曲线密码学
* [x] [ECDSA nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/ecdsa_nonce_reuse.py)
* [x] [Frey-Ruck 攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/frey_ruck_attack.py) [^ecc_frey_ruck_attack]
* [x] [MOV 攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/mov_attack.py) [^ecc_mov_attack]
* [x] [参数恢复](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/parameter_recovery.py)
* [x] [奇异曲线攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/singular_curve.py)
* [x] [Smart 攻击（针对扩域上的曲线）](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/ecc/smart_attack.py) [^ecc_smart_attack1] [^ecc_smart_attack2]
### ElGamal 加密
* [x] [nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/elgamal_encryption/nonce_reuse.py)
* [x] [不安全生成元攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/elgamal_encryption/unsafe_generator.py)
### ElgGamal 签名
* [ ] Bleichenbacher 攻击
* [ ] Khadir 攻击
* [x] [nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/master/attacks/elgamal_signature/nonce_reuse.py)