Exploring Twist Attacks and Pollard-Rho Method

4 replies 47 views
dan2015Hero Member
Posts: 14 · Reputation: 3344
#1Nov 22, 2019, 08:45 AM
So I figured out we can't just hit SECP256k1 straight on but we can create a twist on the curve by finding another Y coord on it. I checked this for the public key xy I'm working with. I had to identify the right curve and ensure the public keys x and y are legit on those curves. Then I worked on generating the generators and group order for this sub-group attack. Here's a snippet of my code. I've managed to create the twist and the sub-groups, even encrypted and decrypted a message, but now I'm stuck trying to get Pollard-Rho to work properly.
8 Reply Quote Share
stacksatsHero Member
Posts: 168 · Reputation: 2023
#2Nov 22, 2019, 11:30 AM
Did you check out that twist attack example on GitHub? Using twist attacks can be risky though... You only need to find one private key for the selected generator point's order. The total of your subgroup order must equal N. No infinity generator point is required for the twist attack. If I were in your shoes, I’d probably start with just one generator point.
3 Reply Quote Share
dan2015Hero Member
Posts: 14 · Reputation: 3344
#3Nov 24, 2019, 08:55 PM
Hey all! Appreciate the messages and links you sent me. I found a solution to this method. One of you here suggested using SageMath's built-in function for the discrete logarithm problem. I tried it on real public keys for 256-bit keys and it worked! It revealed the real private key. Honestly, this is a super strong attack. It took like 15 minutes to solve. Not sharing full code here, but I’ll share it with those who helped me out. Plus, I might get banned for posting it too publicly.
4 Reply Quote Share
Posts: 48 · Reputation: 19
#4Nov 24, 2019, 10:17 PM
Watch out. This looks like a classic bait to spread malware. Step 1: Pretend you can’t get things working. Step 2: Boast about a magical method that supposedly retrieves private keys, filled with confusing jargon. Step 3: When others ask for tools, hit them with malware. Quite often, those who do this are just scammers looking to steal coins. They may throw in real terms so people think it checks out, but they're misusing them. A twist attack isn’t meant for secp256k1; it’s about a related insecure curve.
5 Reply Quote Share
dan2015Hero Member
Posts: 14 · Reputation: 3344
#5Nov 26, 2019, 09:43 AM
Step 1: That’s a libelous claim. Step 2: There’s no magic involved. It’s just math; it’s not that complex. It’s been discussed here already. Check out this link, it's a good read but consider it carefully. Step 3: Clearly, you're not as informed as you think. You have a lot to learn since your understanding seems off. Step 4: I’ll be putting my code on GitHub soon. And just to clarify, I never claimed it’s an attack on secp256k1. Appreciate the input though, but maybe just re-read what I actually said.
0 Reply Quote Share

Related topics