attack.py0000644000175000017500000000777713123147250012267 0ustar thomasthomas from utils import modular_exponentiation, modinv from elgamal_utils import encrypt_string, decrypt_string p = 12812033272825343573241964822155518150863989454698536013844541575691016995569569178157355531014735958545538469803461721165865131357287826603167548085422432164852828763636499492253106094452179644999836997538091041625475400951445399367587477344297734846220209516778109053851098073160657134265949614899121092961731911201 q = (p-1)/2 # factors of p-1, (factor, exponent) factors = [(2, 5), (3, 1), (5, 2), (784004352084511, 1), (1027227490406197, 1), (654902746474663, 1), (1036939576553807, 1), (596188499292077, 1), (892468311744169, 1), (659631355866083, 1), (957233047034401, 1), (724125034830403, 1), (932208036802673, 1), (884513720203747, 1), (669103258616449, 1), (706649413290787, 1), (778270471074587, 1), (1039970558488139, 1), (582911323916071, 1), (688320490973009, 1), (1084631666707019, 1), (650445618231881, 1), (567579678437593, 1), (791412759766441, 1)] g = 7 g_sq = 49 pk = 11214946957486257570931068175545968496744350981088326496998738223678449275341938500830930932856514631454393721163180060136363342367038564716782908459496412686082153401147924245851495623562748281729274527247449146795080120905454403270910973163616750436499747225020525711750786445759687172506314710559110766135479633753 # Public Key is (p, g_sq, pk) c = [(3926598068658773092514421685274215872791771583511069886398421604257772294135953712701010252811509079155370867149057187224356316563857718518690421058533658376846500258732047967806258722945384679378837869696315667248946521258544189346073830723019349032561953567943595483861292046240711288666651810334613864022293945616L, 9704800247133166969737715424535206650287554252969723278498306461588992036652551468753732881480225005608663883163315767071465171568148575710218082254732329252341749918030679861894402715236775580918851916203510069323456164998902825465730227378708761271910222640809097302879743391435151211199452965808980203803864680091L), (49752027103627609140789344994569940629674823077334583324934397294111574830597711407239020569769613380760664030160456662918415900732596845083852325717131469813703285413730413642464881576264943267163125308053759945631805321183885379586361857147607525296299472435998398047006007483928379215960335610861254261789050671L, 669725060326044344409138728219517052917261685862416615845174215841401321505645197978176031359672218371021353104769659626666753937484393974032079368316701427370461933725672388032918207098799751226267743144525471327552855377233125899062266884570478859479605313466357428237144619905732331261106717436704149030736818378L), (8426671491149654166098614065332284888637161470968384733972403384918714099222141491872970537945683803511765828536877096943924626179265667342517452096728499185872800076819828535861915395728636117481654196826782761447649168787358312494193765244609192517649024801402744864713330173464908642350800823053479530882281668687L, 12108192616810899490795945786608057863213654547171191654125035269977895619831365404776252525057614084241599915401631862927759735164854625812268824992958668654789609060695947444895942557791068253546035167861306636671196756298679142681654424572128802178429793151235194987338305904130275861837633894993123498156451048214L), (9841966477046289949218715998833012399125471776669699478182756765851872324695095841313978306057255618073313623021960468821204482996616076972296904256919298545925007651248703647130067939442884966673776349193495550521050524018056896246754161809547737852976610334536084607074948256043601758789226947511763172464276565488L, 9594712073720487183364292634503194569605218860412539453658742337586257635869170033035805191144144179670162621413113732247750474071288591512394431940463292049435628217901896907440433481513134645962070108402484465599043899748057942603807160884922940762070328990305152425326971529127921294212875946851046515280744026949L)] sk = 2 # TODO compute the DLog of pk to the basis g (and divide it by 2) print "Calculated sk:", sk m = decrypt_string(p, q, g_sq, sk, c) print """Resulting message: """, m elgamal_utils.py0000644000175000017500000000265113120773103013623 0ustar thomasthomasimport random from utils import modular_exponentiation, modinv, square_root_mod def MAX_ENC(p): return (p-1)/2 MAX_MESSAGE_LENGTH = 128 def elgamal_enc(p, q, g, pk, m): encoded = encode_message(m, p) r = random.randint(2, q-1) a = modular_exponentiation(g, r, p) b = (modular_exponentiation(pk, r, p) * encoded) % p return (a, b) def elgamal_dec(p, q, g, sk, c): a = c[0] b = c[1] m = (modinv(modular_exponentiation(a, sk, p), p) * b) % p return decode_message(m, p) def encrypt_string(p, q, g, pk, m): blocks = get_blocks(m, MAX_MESSAGE_LENGTH) c = [] for block in blocks: c.append(elgamal_enc(p, q, g, pk, block)) return c def decrypt_string(p, q, g, sk, ciphertexts): m = [] for c in ciphertexts: m.append(elgamal_dec(p, q, g, sk, c)) return ''.join(m) def encode_message(m, p): assert len(m) <= MAX_MESSAGE_LENGTH bytes = m.encode('ascii') number = 0 exp = 1 for b in bytes: number = number + (ord(b) * exp) exp = exp * 128 assert number < MAX_ENC(p) return (number*number) % p def decode_message(number, p): n = square_root_mod(number, p) # if there are two roots, use the one that is less than (p-1)/2 if n > MAX_ENC(p): n = (-n) % p number = n bytes = [] while number > 0: b = number % 128 number = number - b number = number / 128 bytes.append(chr(b)) return "".join(bytes) def get_blocks(string, length): return list((string[0+i:length+i] for i in range(0, len(string), length))) utils.py0000644000175000017500000000264713123147544012155 0ustar thomasthomasimport random # from http://www.math.umn.edu/~garrett/crypto/Code/FastPow_Python.html def modular_exponentiation(x, e, m): X = x E = e Y = 1 while E > 0: if E % 2 == 0: X = (X * X) % m E = E/2 else: Y = (X * Y) % m E = E - 1 return Y % m # from wikibooks def egcd(a, b): if a == 0: return (b, 0, 1) else: g, y, x = egcd(b % a, a) return (g, x - (b // a) * y, y) # from wikibooks def modinv(a, m): g, x, y = egcd(a, m) if g != 1: raise Exception('modular inverse does not exist') else: return x % m # according to https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm def square_root_mod(n, p): # assert n is quadratic residue assert modular_exponentiation(n, (p-1)/2, p) == 1 if (p % 4) == 3: return modular_exponentiation(n, (p+1)/4, p) else: Q = p - 1 S = 0 while Q % 2 == 0: Q = Q / 2 S = S + 1 # p-1 = 2^S * Q, Q odd while True: z = random.randint(2, p-1) # find quadratic non-residue if modular_exponentiation(z, (p-1)/2, p) == (-1) % p: break # z is quadratic non-residue R = modular_exponentiation(n, (Q+1)/2, p) c = modular_exponentiation(z, Q, p) t = modular_exponentiation(n, Q, p) M = S while t != 1: i = 1 while i < M: if modular_exponentiation(t, 2**i, p) == 1: break i = i + 1 b = modular_exponentiation(c, 2**(M-i-1), p) R = (R * b) % p c = (b * b) % p t = (t * b * b) % p M = i return R