Scalar & Attack

Attack the Toy EC Discrete Log

The elliptic-curve discrete log is easy on this tiny curve. The table brute-forces k until Q appears.

highlighted = computed this step

Why the toy breaks

A tiny curve lets an attacker try scalar multiples in order. The hit row reveals which k produced Q.

kG=QkG=Q
Attack the toy EC discrete logScalar rows are recomputed until Q appears.Attack the toy EC discrete log - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)

Target Q

The public point is Q=(10,6).

Q=(10,6)Q=(10,6)
Attack the toy EC discrete logScalar rows are recomputed until Q appears.Attack the toy EC discrete log - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)

Recover k

The table finds Q at k=3.

k=3k=3
Attack the toy EC discrete logScalar rows are recomputed until Q appears.Attack the toy EC discrete log - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)

Summary

The toy discrete log is recovered immediately. NOTE: toy-modulus; no-side-channel; no-production; never-roll-your-own. Exact point arithmetic over a deliberately tiny prime field; real ECC uses about 256-bit curves such as Curve25519 in reviewed protocols.

tiny curve breaks\text{tiny curve breaks}
Attack the toy EC discrete logScalar rows are recomputed until Q appears.Attack the toy EC discrete log - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)