I have been trying to understand the method of recovering the MSD of the nonce proposed by Fan et al. (section 4.2), in their attack targeting wNAF implementation for scalar multiplication in the OpenSSL implementation of ECDSA. They assume that the value of $L_0$ is known. I can see that using Flush+Reload, one obtains $L_{AD}$ - but (why) does this also hold for $L_{0}$?

  • 2
    $\begingroup$ Clarification: In the context, MSD stands for Most Significant Digit for a Windowed Non Adjacent Form of a secret scalar. $\endgroup$
    – fgrieu
    Commented Feb 21, 2023 at 14:40

1 Answer 1


In the paper $L_0$ is the length of the binary string that represents the secret scalar multiple. In good cryptographic implementations, this secret will be selected uniformly at random from the group order. In the case of the secp256k1 curve for example, the group order is very close to $2^{256}$ meaning that roughly 50% of the time $L_0=256$. One can either consider this an attack that works 50% of the time or alternatively exhaust over the first few most likely values of $L_0$. For example, repeating the attack for the guessed values $L_0=256, 255,\ldots,247$ would work for roughly 99.9% of secret scalars.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.