The Problem is as follows:
sage: p=235322474717419 sage: a=0 sage: b=8856682 sage: E = EllipticCurve(GF(p), [a, b]) sage: P = E(200673830421813, 57025307876612) sage: Q = E(40345734829479, 211738132651297) sage: P.order() == p True
As we can see, P.order() is equal to p, so obviously we can use Smart's attack to calculate the value of k, so i implement the Smart's attack according to the paper Weak Curves In Elliptic Curve Cryptography.
And when we use this kind of attack we will get k = 9762415993955:
sage: SmartAttack(P,Q,p,8) 9762415993955
But actually the correct value of k is 152675955744921:
sage: P*152675955744921 == Q True
So my question is:
Why Smart's attack doesn't work on this ECDLP?
P.S. The implement of Smart's attack is correct cuz it can calculate the correct value of k in some former CTF games.