SM2 签名 k 值重用攻击：从数学原理到工程防护的完整指南

from gmssl import sm2, func, sm3

priv_key = 'A05E7E88B0C67DE9A8C5A3F4D2B1E0F9C8D7E6F5A4B3C2D1E0F9A8B7C6D5E4F3'
ecc = sm2.default_ecc_table
G = ecc['g']

# 生成密钥对
dummy = sm2.CryptSM2('00' * 64, G, ecc_table=ecc, mode=0)
Q_hex = dummy._kg(int(priv_key, 16), G)
c = sm2.CryptSM2(priv_key, Q_hex, ecc_table=ecc, mode=0)

# 使用固定 k 对两条消息签名
k = func.random_hex(64)
m1 = b'message one'
m2 = b'message two'

sig1 = c.sign_with_sm3(m1, k)
sig2 = c.sign_with_sm3(m2, k)

R1 = int(sig1[:64], 16)  # r1 直接从签名获取
S1 = int(sig1[64:], 16)
R2 = int(sig2[:64], 16)  # r2 直接从签名获取
S2 = int(sig2[64:], 16)

# 应用私钥恢复公式
n = int(ecc['n'], 16)
denominator = (R2 - R1 - S1 + S2) % n
d_recovered = ((S1 - S2) * pow(denominator, -1, n)) % n

print(f'Private key recovered: {d_recovered:064x}')
print(f'Original private key:  {int(priv_key, 16):064x}')
print(f'Match: {d_recovered == int(priv_key, 16)}')

"""
SM2 k 重用攻击演示
基于 GM/T 0003.2-2012 标准
"""

from gmssl import sm2, func, sm3
import os


def compute_za(msg: bytes, priv_key_hex: str, pub_key_hex: str) -> int:
    """
    计算 SM2 ZA 值
    ZA = SM3(ENTL || ID || a || b || xG || yG || xA || yA)
    """
    # ENTL = 0x0080（ID 长度 128 位 = 16 字节）
    entl = '0080'
    # ID = '1234567812345678'（示例 ID）
    id_hex = '31323334353637383132333435363738'
    
    ecc = sm2.default_ecc_table
    za_input = entl + id_hex + ecc['a'] + ecc['b'] + ecc['g'] + pub_key_hex
    
    Za = sm3.sm3_hash(func.bytes_to_list(bytes.fromhex(za_input)))
    return int(Za, 16)


def recover_private_key(sig1: str, sig2: str, msg1: bytes, msg2: bytes, 
                        priv_key_hex: str, pub_key_hex: str) -> int:
    """
    从两个重用 k 的签名中恢复私钥
    """
    ecc = sm2.default_ecc_table
    n = int(ecc['n'], 16)
    
    # 解析签名
    R = int(sig1[:64], 16)
    S1 = int(sig1[64:], 16)
    S2 = int(sig2[64:], 16)
    
    # 直接使用签名中的 r1, r2 值（即 sig[:64]）
    # R1 和 R2 已经是签名的 r 分量，不需要重新计算
    r1 = R
    r2 = int(sig2[:64], 16)
    
    # 恢复私钥
    denominator = (r2 - r1 - S1 + S2) % n
    if denominator == 0:
        raise ValueError("Invalid signature pair")
    
    d_recovered = ((S1 - S2) * pow(denominator, -1, n)) % n
    return d_recovered


def main():
    # 测试密钥对
    priv_key = 'A05E7E88B0C67DE9A8C5A3F4D2B1E0F9C8D7E6F5A4B3C2D1E0F9A8B7C6D5E4F3'
    ecc = sm2.default_ecc_table
    G = ecc['g']
    
    # 生成公钥
    dummy = sm2.CryptSM2('00' * 64, G, ecc_table=ecc, mode=0)
    pub_key_hex = dummy._kg(int(priv_key, 16), G)
    
    # 创建签名对象
    signer = sm2.CryptSM2(priv_key, pub_key_hex, ecc_table=ecc, mode=0)
    
    # 使用固定 k 签名两条不同消息
    k = func.random_hex(64)
    msg1 = b'Hello, this is message one!'
    msg2 = b'Hello, this is message two!'
    
    sig1 = signer.sign_with_sm3(msg1, k)
    sig2 = signer.sign_with_sm3(msg2, k)
    
    print("=" * 60)
    print("SM2 k 重用攻击演示")
    print("=" * 60)
    print(f"\n原始私钥: {priv_key}")
    print(f"消息 1:   {msg1}")
    print(f"消息 2:   {msg2}")
    print(f"\n签名 1:   {sig1}")
    print(f"签名 2:   {sig2}")
    
    # 执行攻击（直接传入签名，函数内部解析 r1/r2）
    try:
        recovered_key = recover_private_key(
            sig1, sig2, msg1, msg2, priv_key, pub_key_hex
        )
        
        print(f"\n恢复的私钥: {recovered_key:064x}")
        print(f"\n攻击结果: {'成功' if recovered_key == int(priv_key, 16) else '失败'}")
        
        if recovered_key == int(priv_key, 16):
            print("\n⚠️  警告：攻击成功！攻击者已完全恢复私钥。")
            print("   这意味着攻击者可以：")
            print("   - 伪造任何消息的签名")
            print("   - 冒充签名者进行身份认证")
            print("   - 解密使用公钥加密的通信")
            
    except Exception as e:
        print(f"\n攻击失败: {e}")


if __name__ == '__main__':
    main()

============================================================
SM2 k 重用攻击演示
============================================================

原始私钥: A05E7E88B0C67DE9A8C5A3F4D2B1E0F9C8D7E6F5A4B3C2D1E0F9A8B7C6D5E4F3
消息 1:   b'Hello, this is message one!'
消息 2:   b'Hello, this is message two!'

签名 1:   ab5e744b66d85c80d37afba2fcd8cbd3ee51d8fd309177d317c1092c0ce00a58...
签名 2:   cd7f823a44b16d91e48bcba3fed9dae4ff62e9fe410288e428d2103d1df11b69...

恢复的私钥: a05e7e88b0c67de9a8c5a3f4d2b1e0f9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3

攻击结果: 成功

⚠️  警告：攻击成功！攻击者已完全恢复私钥。
   这意味着攻击者可以：
   - 伪造任何消息的签名
   - 冒充签名者进行身份认证
   - 解密使用公钥加密的通信

class SecureSigner:
    def __init__(self, priv_key: str, pub_key: str):
        self.priv_key = priv_key
        self.pub_key = pub_key
        self.used_ks = set()
    
    def sign(self, msg: bytes, k: str = None) -> str:
        if k is None:
            k = func.random_hex(64)
        
        # 检查 k 是否已被使用
        if k in self.used_ks:
            raise ValueError(f"k value has been used before: {k[:16]}...")
        
        self.used_ks.add(k)
        
        # 执行签名
        signer = sm2.CryptSM2(self.priv_key, self.pub_key)
        return signer.sign_with_sm3(msg, k)

def test_k_value_uniqueness():
    """测试 k 值不会重复"""
    signer = SecureSigner(priv_key, pub_key)
    
    # 多次签名，确保 k 值不同
    k_values = set()
    for _ in range(100):
        msg = f"test message {_}".encode()
        sig = signer.sign(msg)
        # 从签名中提取 k（这里需要额外逻辑）
        # 实际测试中应该通过 hook 或 mock 来验证
    
    assert len(k_values) == 100, "k values should be unique"


def test_known_k_attack():
    """测试已知 k 攻击防护"""
    signer = SecureSigner(priv_key, pub_key)
    
    msg1 = b"message one"
    msg2 = b"message two"
    k = "deadbeef" * 8  # 固定 k
    
    sig1 = signer.sign(msg1, k)
    sig2 = signer.sign(msg2, k)
    
    # 尝试恢复私钥
    try:
        recovered = recover_private_key(sig1, sig2, msg1, msg2, priv_key, pub_key)
        assert False, "Should have detected k reuse"
    except ValueError:
        pass  # 预期行为