1
$\begingroup$

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am trying to recover the plaintext messages and stumbled upon the Wikipedia : Elliptic Curve DSA page that explains that one can recover the private key given two cleartext messages, and their corresponding signatures where r is the same in both signatures. The problem is I don't have the cleartext messages, so I am wondering if it is possible to derive the private key and subsequently decrypt the messages from the givens that I currently have.

|improve this question
$\endgroup$
  • 1
    $\begingroup$ I presume you mean trying to find the input for the raw ECDSA operation, correct? Usually ECDSA operates on a hash, which is a one way function. In that case the best you can do is to iterate over all the input messages, something you can already do with just the public key. $\endgroup$ – Maarten Bodewes♦ Dec 23 '18 at 17:30
  • $\begingroup$ @MaartenBodewes I do lack some cryptography knowledge, but if I am reading the problem correctly, I see that ECDSA here is being used to encrypt messages, instead of only providing signatures. I also see that the two message samples I have are not the hashed messages, but actually an encrypted format. $\endgroup$ – user3490561 Dec 23 '18 at 18:11
  • $\begingroup$ The steps are starting with $e = Hash(m)$ and $m$ never used again. It is the digital signature of the message as mentioned Maarten it is the hash of the message. And, the message, with high probability, is encrypted with a symmetric algorithm, if any. The attack described in Wikipedia, also mentioned in the security part, fail0verflow announced recovery of the ECDSA **private key** $\endgroup$ – kelalaka Dec 23 '18 at 18:26
  • $\begingroup$ Revisiting this question: are you sure that the signature is over the plaintext - not the ciphertext - of the messages? $\endgroup$ – Maarten Bodewes♦ Dec 31 '18 at 9:40
  • $\begingroup$ @MaartenBodewes I didn't manage to solve the problem yet. However, I am almost certain now that the signature is over the ciphertext. Both the samples of the resulting ciphertexts and their signature are base64 encoded. I tried to use some sample signature validation code using different formats of the signature, but I still couldn't get it to work. $\endgroup$ – user3490561 Dec 31 '18 at 23:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.