# Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces.

Approximately $$2 ^ {243} - 2^{244}$$.

Could it turn out that there will be a small leak of information about the first 3 bits of Nonces?

Accordingly, if Nonces is short, then it must contain null at the beginning. That is, the first 3 bits of Nonces contain null at the beginning.

Hence, for the sake of safety:

When creating an ECDSA signature, the value of signatures $$[R, S, H (e)]$$ that in this Nonces signature is short in size can be disclosed to an attacker?

• Welcome to Cryptography.SE. You may need to edit your Q. Nov 29 '21 at 17:36
• How does the "biased-k attack" on (EC)DSA work? Nov 29 '21 at 17:37
• @kelalaka Please show me an example of how with signatures [R, S, H (e)] can tell that Nonces is short-sized? Nov 29 '21 at 17:47
• eprint.iacr.org/2019/023.pdf Nov 29 '21 at 17:48
• @kelalaka On which page is this information written? Nov 29 '21 at 17:51