1
$\begingroup$

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am trying to recover the plaintext messages and stumbled upon the Wikipedia : Elliptic Curve DSA page that explains that one can recover the private key given two cleartext messages, and their corresponding signatures where r is the same in both signatures. The problem is I don't have the cleartext messages, so I am wondering if it is possible to derive the private key and subsequently decrypt the messages from the givens that I currently have.

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ I presume you mean trying to find the input for the raw ECDSA operation, correct? Usually ECDSA operates on a hash, which is a one way function. In that case the best you can do is to iterate over all the input messages, something you can already do with just the public key. $\endgroup$ – Maarten Bodewes♦ Dec 23 '18 at 17:30
  • $\begingroup$ @MaartenBodewes I do lack some cryptography knowledge, but if I am reading the problem correctly, I see that ECDSA here is being used to encrypt messages, instead of only providing signatures. I also see that the two message samples I have are not the hashed messages, but actually an encrypted format. $\endgroup$ – user3490561 Dec 23 '18 at 18:11
  • $\begingroup$ The steps are starting with $e = Hash(m)$ and $m$ never used again. It is the digital signature of the message as mentioned Maarten it is the hash of the message. And, the message, with high probability, is encrypted with a symmetric algorithm, if any. The attack described in Wikipedia, also mentioned in the security part, fail0verflow announced recovery of the ECDSA **private key** $\endgroup$ – kelalaka Dec 23 '18 at 18:26
  • $\begingroup$ Revisiting this question: are you sure that the signature is over the plaintext - not the ciphertext - of the messages? $\endgroup$ – Maarten Bodewes♦ Dec 31 '18 at 9:40
  • $\begingroup$ @MaartenBodewes I didn't manage to solve the problem yet. However, I am almost certain now that the signature is over the ciphertext. Both the samples of the resulting ciphertexts and their signature are base64 encoded. I tried to use some sample signature validation code using different formats of the signature, but I still couldn't get it to work. $\endgroup$ – user3490561 Dec 31 '18 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.