Armadillo ECDSA113
Hi
A month ago I launched my first attack on a armadillo protected target that was using level 10 armadillo license system (ECDSA) Level10 is ECDSA113 which of course is using Elliptic Curve. The curve size is 113 bit and the order of the public point is 112 bit. Order: "5192296858534827627896703833467507" The curve is a koblitz curve and the base is usually Optimal Normal Base Type 2 which is very slow when implemented in software. (Well. I was not able to speed it up to much) To solve the ecdlp on such a curve I first thought that the number of iteration needed would be ~sqrt(2^112) == 2^56 but for the koblitz curve there are speedups. First speedup would be using the frobenius map and second would be using negation map. For this one can expect a speedup of ~sqrt(113*2) and this brings us to a total number of iteration ~2^52 For the slow ONB2 curve this woule be too much (I think) but now the fun starts. There exist a isomorphic base (or there are many of them) but the fastest I could find is the polynomial base with the irreducible polynom x^113 + x^9 +1. Going from ONB2 to polynomial base was a bit pain at first but when you know what to do it's pretty easy. Also in 2010 intel introduced the CLMUL instruction that can do carry less multiplication (polynomial multiplication) in ASM and reducing modulo x^113 + x^9 +1 is pretty fast when using xmm registers. So the speed of the first solver I tested using the ONB2 code was about 20.000 iterations/sec. The one I ended up running did 46.000.000 iterations/sec running on a Core i7 CPU with 8 threads. My total combined speed was about 600mill/sec and after 2^50 iterations I solved ECDLP for this curve/target. I guess armadillo is not to much used any more so I guess all this was a bit to late. Or perhaps others have done this before me? I don't know. But if anyone know of a good/cool target using this protection it would be fun to try again. If any questions then just shoot. 
So... It effectively took three weeks to solve?

Quote:

Very interesting! I could integrate this in my Armadillo Key Tool (https://github.com/mrexodia/akt)...
The previous attack (as far as I know) was on a weak implementation by Baboon (http://baboon.rce.free.fr/index.php?post/2010/09/04/Armadillomangedesoursenslips) but I don't think a brute force approach was tested in public. You can get the best target by making your own unpackme, or try Armadillo itself... The latest public (and custom) v9.60 uses: Code:
Short V3 Level 10: 
Quote:
ECDLP is based on the birthday paradox so you never know exactly the among of work. 2^52 iterations would required 4 times more work. 
Quote:
Quote:
I thought armadillo was obsolete 
Would anyone be interested in running an attack on say armadillo?
This require running the solver on their pc and collect distinguished points. More CPU's will give faster result. Also if anyone are familiar with GPU coding them perhaps this could also be implemented and run on gfx cards. 
Quote:

Quote:
The power consummation on todays cpu is not that bad. My laptop Core i7 has a max TDP of 15w. Lets play with some numbers. My fastest PC did 46mill/sec. (a Core i76700 @ 3.4GHz) Say we as a group can collect 90 of them That should give a speed of ~2^32 / sec After 12 days we would reach 2^52 iterations. If we are as lucky as I and solve after 2^50 iterations then this would take only ~3 days :) Some other attacked this curve before I did and implemented it on FPGS's https://eprint.iacr.org/2014/368.pdf If I where to release a product today then I would not rely on a 113 bit's koblitz curve. Using a different 113 bits curve would be a bit better and perhaps out of reach for reversers today but new cpu's are hitting the market as we speak and the new inlet with 18 cores and amd with 16 corse will probably be speed monsters. Would also be fun to try implementing this on GPU. I know they did some research on this when attacking ecc2k131. 
Quote:
Love it. (Hope I wont get banned for this reply) 
Quote:

Quote:
I think a true keygen for v9.6 would be a fitting end to the Armadillo saga. 
When hashing GPU is 100x over CPU, +/ depending of the kind of hash.
I can test in a 3 GPU computer if someone programs that option. Good luck with this experiment, it is really interesting :) 
I can't find the latest armadillo version so if anyone can share that would be great.

Quote:

All times are GMT +8. The time now is 11:20. 
Powered by vBulletin® Version 3.8.8
Copyright ©2000  2019, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX