I'm studying lattice attack using this sage script. There are 2 options in script: LSB and MSB. The most interesting option for me is MSB. It recovers private key with less then 100 signatures provided with script. When I run it with my PQG generated by openssl and my own signatures with zeroed 8-bit MSB I was able to recover private key with 800 signatures in one case and unable to recover even with 1000 signatures in another case. It seems to me 800-1000 signatures is too much for 8 known bits. Sentinel value for this attack is 1. There is similar solution from mimoo for ECDSA. Sentinel value in this script is called "trick". As far as I understand this solution is for ECDSA only and I can't use it for DSA key recovery. Can anybody suggest sentinel values I can use to reduce the number of signatures?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.