I'm studying lattice attack using this sage script. There are 2 options in script: LSB and MSB. The most interesting option for me is MSB. It recovers private key with less then 100 signatures provided with script. When I run it with my PQG generated by openssl and my own signatures with zeroed 8-bit MSB I was able to recover private key with 800 signatures in one case and unable to recover even with 1000 signatures in another case. It seems to me 800-1000 signatures is too much for 8 known bits. Sentinel value for this attack is 1. There is similar solution from mimoo for ECDSA. Sentinel value in this script is called "trick". As far as I understand this solution is for ECDSA only and I can't use it for DSA key recovery. Can anybody suggest sentinel values I can use to reduce the number of signatures?
Add a comment
|