Linked Questions
17 questions linked to/from How does the "biased-$k$ attack" on (EC)DSA work?
0
votes
0
answers
138
views
In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]
If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
- 1
0
votes
0
answers
75
views
Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]
Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected?
Will small nonce bias be easily ...
34
votes
3
answers
11k
views
Can ECDSA signatures be safely made "deterministic"?
Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
- 732
3
votes
2
answers
611
views
Can I get away with generating 512-bit k (and d) for ECDSA based on P-521?
I've been implementing a hobbyist cryptography library, and I'm at the part where elliptic-curve cryptography is being implemented. I've already implemented and tested ECDSA with P-256 and P-384, ...
- 7,581
5
votes
1
answer
636
views
Exactly what RNG weaknesses endanger (EC)DSA?
RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction
One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random value (...
- 130k
0
votes
1
answer
589
views
Help breaking ECDSA with biased nonces
I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
- 176
3
votes
2
answers
571
views
How robust is RSA-FDH against distribution bias?
Suppose we want to use the RSA-Full Domain Hash (-FDH) signature scheme. This essentially works precisely like textbook RSA but instead of signing $m$ directly, we sign $H(m)$ with $H:\{0,1\}^*\to\...
- 45.2k
2
votes
1
answer
430
views
Is it possible to brute-force the nonce used in ECDSA?
It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
- 123
1
vote
2
answers
254
views
Recovering nonce in ECDSA with known shared components in ECDSA
This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces.
Given a random $k$:
$$
k_1 = ka,
k_2 = kb
$$
I am now signing two messages, which ...
- 111
-2
votes
1
answer
373
views
Calculating $K,N,X$ in ECDSA?
I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
- 11
1
vote
1
answer
210
views
DSA - can $k$ be 1?
I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
- 11
0
votes
0
answers
305
views
Can knowing the ephemeral key recover the private key in ECDSA
If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key?
If so, would knowing the ...
- 153
2
votes
1
answer
105
views
Can private key be specified on key pair creation?
Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
- 77
0
votes
0
answers
281
views
Choosing K in ECDSA SECP256K1
I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
2
votes
0
answers
255
views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
