Topic: lattice-attack || how to run without error - page 4. (Read 3185 times)

This is an example from the data.json file from https://github.com/bitlogik/lattice-attack


{"curve": "SECP256K1", "public_key": [66412380102939781024918160349386680014552536369061587637080774389860461092925, 43765600116551195273677149966008783624760986110490190619082891899095205821463], "known_type": "LSB", "known_bits": 6, "signatures": [{"r": 77527664235581399957092079345479688400475999610428178825522649055070157244692, "s": 27028479468528243957334746793835087615740874028178347534667218420099431266524, "kp": 51, "hash": 36925504434266069211917383521197840104244330385311344434522880060028429358956}, {"r": 1695214956238129249280118258814363243967244974939577175204794511553033886344, "s": 84915535421556974430475608108845062567200591001138706902138971666887762297461, "kp": 23, "hash": 76485972818364982894032873079629726025969313708578174583231327504986349400949}, {"r": 109269381046386034156037076068908319933850763940108273610325408412215759654951, "s": 48609197671516297208867726715248596584655415925682996149314879813291177259719, "kp": 49, "hash": 8857850795789766547675189849758610890848461200122419912004299328172940180927}, {"r": 41835540276419198058500360048414380626372941221767888918686846392248041576696, "s": 1825469084617584873286736453038639812754935222429578990673573348028125348352, "kp": 29, "hash": 11771613120662486178657899205469606751879506909643902145426207541353014498651}, {"r": 107103142771724135475440435595118756234545765813796109423691918131480012001322, "s": 76403726951992633295737606623610572293691262686449016257400538234410247449075, "kp": 44, "hash": 109029154205057617106956764551702586575882058359417649302233515615948131520073}, {"r": 54544573696288124190943111180088654937224138523771919858599448193516058012815, "s": 75774534848938869077595821409914703967303095416625781047518021857023231109081, "kp": 44, "hash":


Is this the public key its trying to look for [66412380102939781024918160349386680014552536369061587637080774389860461092925, 43765600116551195273677149966008783624760986110490190619082891899095205821463] ?

So I convert the r,s,z into decimal, I see the r and s. Which one is the z, is it the kp?

I'm trying to see what goes where.

@ecdsa123

You get all data what you need for make lattice ?

---

how many none bit in sighs ?

for latticce i think alll sighs mast be same bits. But yours trans N2 is not  equeilto others transaction by lenght - r2 is bigger then r at other sighs

---

transaction has msb or lsb ?

you make gauss reduction for them ?

on this adress only  1 transaction for output transaction, doing something with input transaction and add them to lattice matrix  bad idia....

then you will modify  sighs from 256 bit to 100 ?

---

can you generate for puz 120,  89 sighns with nonce not more 2^248 ?

you can do it without msb or lsb

---

yoy can find 128 core at https://vast.ai/

[moderator's note: consecutive posts merged]

@COBRAS
hello
This is puzzle 120 public calculated 100 sample with 120 bit random data
MSB 16 bits is must "0000" in nonce, tested with multiple 120 bit range my own sample private keys.

https://pastebin.com/RTg4PVv0
For LLL.reduction its no issue but BKZ.reduction will show error "infinite loop in babai"
Same in liner random.

This can't be fixed so far i know.

you need only one of this  transaction - outgoing transaction

original RSZ from 120

     R: 00a285a9151ac1f9c40e88a2a80b79c702336536462a9390fd00dda999da45420a
     S: 1844883eb808df18a9138ee2c13439ecf716799edcf073772f2696e4f9384f58
     Z: 7e17cf7c5b7ccfaa4c7c05874e4fb4f12661662b8e33188e2e62b3739931ade5
PubKey: 02ceb6cbbcdbdf5ef7150682150f4ce2c6f4807b349827dcdbdd1f2efa885a2630

Bro, I cant find a my crypt  fir getting  all rsz from 1 adress, but for one rsz this utill is good:

https://github.com/iceland2k14/rsz

waiting from you generated rsz data with nonce <=128 bit

ps

code for calculating how many bits in r:


file = open('r.txt', 'r+')
for address in file.readlines():

    num = int(address)
    length = len(bin(num))
    length -=2
    print ("total number of bits: ", length)

You need only pubkey. For lattice attack, your r,s,z can be faked, it will be as useful as something collected from some real transaction.

And that's why it would be better to start with 120-bit key, and make a lot of 240-bit signatures. You need some randomness to make it. I think getting it squared should be random enough to reveal the key, but this code still does not work for me, this "infinite loop in babai" is annoying and simply means that LLL found nothing, so other algorithms were used (and they failed somehow).

You really can make code for this , and code for gauss reduction ?

P.s. I will provide rsz  for you any way

I will make for 120, and simple with many transaction.

Little later today or tomorrow. Don go far away  from this thread

I have a communication with bitlogic (lattice-attack code)r previously. If you can explain what a bag I cab ask him for remove bag, or you can send him message directly.

@garlonicon

You know how to downgrade pubkey range ? I try, but with div or substraction but this like how to shut to the the galaxy from the gun. Task is finding very small range, for ex 2^80, need search this 2^80 in 2^119 so, about 549755813888 publick of 2^80  in range 2^119+2^119(total 1/2 of 2^150.

Substraction had same difficulty's. Then substract, after you get pubkey smaller then target pubkey, difficulties of pubkey start grow, against fail...




It is possible make fake rsz for known pubkey ?

Can someone generate rsz for pubkey 120 for ex , in format of lattice-attack script or  bkz-preducate ?

Br

Hello, did you try this code ? Maybe this code had no bag, and more "powerful" for this talk, because has 3;algorithm include lattice  

https://github.com/malb/bdd-predicate

It is a bug, because the code should not inform you that "something went wrong", but should give you the exact reason of what was wrong, and also why it could be wrong. Scripts should not just crash if you feed them with invalid entries. They should tell you, what is the correct format and why something does not work. So, "infinite loop in babai" says nothing. It says that there is some loop and that loop is infinite. But there could be a lot of reasons, actually, an assertion saying that "value==something" was false in file "sample.py" on line 123 would be a lot better than that. Also, I think that signatures are random enough, they are just random 240-bit values that are not connected at all. Adding random 120-bit and multiplying the result by random 120-bit will shuffle and mix everything, no matter what was the key we started with. And we can get infinitely many signatures, so there always will be enough to try this kind of attack (also because there was an example with only six known bits that was solved correctly).

@garlonicon
i don't think its bug.
"infinite loop in babai"
I think it's like math divide by 0 on lattice attack.
First calculated sign must be higher int value like i have posted.
0xf000000000000000000000000000000000000000000000000000000000000000
Later sign can use divide by 14 or 10 etc, til int reach to 2 then can use random 128 bit int and all this is valid and give first 33 only non zero MSB rest all are 0 starting K on MSB.
i have tested with all possible combination no matter what i try i can't go lower then 33 kp requirement for 4 bit leaking.

I tried it, but it is somewhat buggy. You can take 120-bit key and use two random 120-bit values to get as many 240-bit signatures as you need (because first you will add one random 120-bit number to another 120-bit number, and then you will multiply that by another 120-bit value, by choosing the right range, you can always make sure that the first 16 bits are zero). No matter how many 240-bit k-values in signatures I had, I could never reach any 120-bit key from that. LLL is going through that without printing any key, and then another algorithms have some bugs, because there are "infinite loop in babai" and other similar messages in their internal implementation.

So, I partially know how to attack 120-bit keys, but I cannot do that in practice (because this code is buggy, it would take some time to fix it).

So, you need 128 or 4*128 thread ?

64 thread is possible, I think 128 possible too.

Your code work with less 128 but nonce, you tested it ?

P.s. then I try with 0000 msb and lsb, nothing found with his lattice attack.

R.

I got the bitlogik lattice-attack to work    https://github.com/bitlogik/lattice-attack

So how do I go about attacking an public key or public keys?

@COBRAS
Its different attack with lowest nonce under 127 bit & his weakness.

Only bitlogik lattice-attack is most powerful i can feel.

For example if you have any private key under 128 bit. for example puzzle 120.
If you use liner random value or single known higher random(0xf000000000000000000000000000000000000000000000000000000000000000) to start with and divide it in each time till 100 sign is made.(after 51 sign can use 128 bit random to make sign.)
You just have 33 or less nonce kp to worry about, because rest is 0 on MSB
i tested on my single pc with 16 thread its not powerful to cover it.
need atlast 128 thread with 4/5 pc to finish whole range fast.

yes random, you can replace generetated r,s from rundom to r,s from vitcoiin sighnature, after it will be not rundom.

but, rhis wersion for 128 bit nonce. btx is a 252-256 bit nonce

What private key it was looking for because it was random