# Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?

CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.

The formulas appearing in ecp_jac.c do not handle the case when the addition produces infinity or adds a point to itself. An attacker can use this to generate specially-crafted signatures that cause the validation algorithm to compute the incorrect point.

For the equations and other details, please check the following link: https://bugzilla.mozilla.org/show_bug.cgi?id=1125025

Could this Elliptic Curve Cryptography issue really lead to spoofed ECDSA signatures or is this purely a theoretical attack?

During ECDSA signature generation, the verifier creates two EC points $u_1 G$ and $u_2 Q$, where $Q$ is the public key, and $u_1, u_2$ are two integers computed as a part of the verification problem. The verification routine then adds these two points, apparently, the bug happens if either $u_1G = u_2Q$ (the addition is actually a point doubling), or if $u_1G = -u_2Q$ (the result of the addition is the neutral element).
However, if either is true, then $\pm u_2^{-1} u_1 G = Q$, and hence $\pm u_2^{-1} u_1$ is the private key. Hence, if the attacker can generate a signature that satisfies either of these two conditions, he can compute $u_1, u_2$, and then directly recover the private key. And, with the private key, the attacker can sign anything he wants.