Skip to content

Instantly share code, notes, and snippets.

cd0b2-ec8fc
d4ca7-cbb2f
cd0b2-ec8fc
dd8fd-a90f9
dfaf5-bfb21
aed4b-47351
d1950-f654a
b05b8-aa6af
fdff0-a95f4
d347b-eff1d

DDH attack

sage attack.sage

Discriminant is  -174557545091416252635003194444861205363819426306550719724615444118398924653740853473200690165023980144269305313623219072619881598803017038440606788399640708500954596365702268338314218456077198381637651986824178122536367069027837416763824399587567438806907526544381205640408340191555642933450043607423990229926944652

starting DDH

starting attack DDH
#BLS6 curve taken from https://eprint.iacr.org/2019/431.pdf Table 15
def computeS(n,c):
"""
(Algorithm 2.35: Lenstra, Verheul: An overview of the XTR public key system)
Computes S_n(c) as defined in Lenstra, Verheul.
Parameters:
(int) n>0;
(GF(p^2)) c
Returns:
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
# assert p.is_prime()
# assert r.is_prime()
proof.arithmetic(False)
Fp = GF(p)
Fpx.<x> = Fp[]
<script>
var ec8fc = {
valueOf: function () {
alert("valueOf1");
return 1;
}
};
var cd0b2 = {
valueOf: function () {
alert("valueOf2");
test
<script>
window.crypto.subtle.generateKey(
{
name: "AES-GCM",
length: 256, //can be 128, 192, or 256
},
false, //whether the key is extractable (i.e. can be used in exportKey)
["encrypt", "decrypt"] //can "encrypt", "decrypt", "wrapKey", or "unwrapKey"
)
.then(function(key){
function recover(privateKey) {
console.log("recover");
const MALICIOUS_PRIME = new Uint8Array([129,0,0,0,0,0,0,0,0,0,0,0,0,0,0,17]);
// this generator has order 5
const MALICIOUS_GENERATOR = new Uint8Array([46,35,147,92,93,21,176,170,70,144,93,164,112,85,178,126]);
privateKey.algorithm.generator = MALICIOUS_GENERATOR;
privateKey.algorithm.prime = MALICIOUS_PRIME;
window.crypto.subtle.generateKey(
{