1
$\begingroup$

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in the wiki link) was actually static, allowing the private key to be solved for. The attack is actually mentioned in the wiki link for the algorithm, and basically says the same thing as the video.

My question is, how did they discover $m$ was static, and how did they even know that particular ECDSA algorithm was used to generate the private key? Even once they knew these two things, wouldn't they need the particular curve sony used?

$\endgroup$
1
  • $\begingroup$ What if the PS3 signs the same message again? What can you see if the random $k$ ($m$ in the video notation) is used again? $\endgroup$ – kelalaka Mar 4 at 8:53
3
$\begingroup$

Per the notation of the wiki article, all signatures produced with the same random k would lead to the same value r which is published as part of the signature.

$\endgroup$
3
  • $\begingroup$ Right you are, I should have noticed that. $\endgroup$ – Prince M Mar 4 at 7:05
  • $\begingroup$ Let me know if you have anything for the other two parts of the question! $\endgroup$ – Prince M Mar 4 at 7:05
  • $\begingroup$ The ECDSA algorithm is a widely used standard which is typically only used with a few different curves (NIST P256 or curve 25519 are probably the most common choices). Any certificate for the signing key would include these details. If Sony did use a custom curve, this would also be specified in the verification certificate. $\endgroup$ – Daniel Shiu Mar 4 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.