# Tag Info

In binary, your hash value is: 11011110100111110010.... And so the leftmost 17 bits would be 11011110100111110 or 1BD3E in hex. Normally, for curves we actually use for ECDSA, $n$ is a multiple of 8 (and so we just use the leftmost $n/8$ bytes); in your (toy) case, we need to be a bit more careful (and end up not preserving byte boundaries).
An attack is described in Section 4.1.6 of the SEC1 document. Regarding xagawa's answer: The attack you describe is different from that described in Section 4.5 of the Blake-Wilson--Menezes paper. Specifically, their attack: (a) does not require knowledge of the secret ephemeral key $k$, and (b) changes the reference point $P$, which is not allowed in ...