An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This public key is used to verify a signature (the adversary can insert whatever signature he chooses). Is this a vulnerability? E.g. what are the chances the random string ends up corresponding to a low order curve where the adversary can brute force the signature?

  • 3
    $\begingroup$ That will depend heavily on details of the format of the public key, and the checks made by the signature verification software on that. The question specifies neither. Apparently the question assumes the public key specifies an elliptic curve and a point on the curve, rather than only a point on an implicitly defined curve in one of the usual two formats: with or without point compression. $\endgroup$
    – fgrieu
    Mar 11, 2023 at 18:12
  • $\begingroup$ Could you clarify when it matters? Is there actually a format where it matters? $\endgroup$
    – Joe
    Mar 13, 2023 at 15:08
  • $\begingroup$ One several usual formats for ECDSA public keys is the one in sec1v2, 2.3.3, point compression is not being used (choice 3). That is a byte 04, followed by $x$ then $y$ coordinates each as a 32-byte big-endian bytestring, for a point implicitly on elliptic curve secp256r1. It's common that signature verification starts by verifying that the public key's $x$ and $y$ match the curve's equation. That has probability about $2^{-264}$ for random 65-byte public key. $\endgroup$
    – fgrieu
    Mar 13, 2023 at 15:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.