# Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?

CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.

The formulas appearing in ecp_jac.c do not handle the case when the addition produces infinity or adds a point to itself. An attacker can use this to generate specially-crafted signatures that cause the validation algorithm to compute the incorrect point.

For the equations and other details, please check the following link: https://bugzilla.mozilla.org/show_bug.cgi?id=1125025

Could this Elliptic Curve Cryptography issue really lead to spoofed ECDSA signatures or is this purely a theoretical attack?

## 1 Answer

Glancing through the Mozilla notes, it would appear that it would actually be infeasible to generate a forged signature (that is, not involving the private key) that would tickle this bug. In fact, if someone could generate a signature that would tickle this bug, they could deduce the private key (and so wouldn't need exploit this implementation flaw).

During ECDSA signature generation, the verifier creates two EC points $u_1 G$ and $u_2 Q$, where $Q$ is the public key, and $u_1, u_2$ are two integers computed as a part of the verification problem. The verification routine then adds these two points, apparently, the bug happens if either $u_1G = u_2Q$ (the addition is actually a point doubling), or if $u_1G = -u_2Q$ (the result of the addition is the neutral element).

However, if either is true, then $\pm u_2^{-1} u_1 G = Q$, and hence $\pm u_2^{-1} u_1$ is the private key. Hence, if the attacker can generate a signature that satisfies either of these two conditions, he can compute $u_1, u_2$, and then directly recover the private key. And, with the private key, the attacker can sign anything he wants.

Now, Mozilla was quite correct in fixing this bug; however it doesn't look like it's exploitable.

• " it doesn't look like it's exploitable." So the worst that can happen is that you get an incorrect signature? – Yustack Jun 2 '17 at 0:26
• @Omatera: if I interpret the notes in the bug report properly, yes. The notes did say that the bug might allow a forgery for signature algorithms other than ECDSA; that might be correct... – poncho Jun 2 '17 at 0:28