4 ms·

>infamous ECDSA nonce Why "infamous"?

• Dylan16807 4y ago
  I'm not particularly knowledgeable here, but I know it's extremely fragile, far beyond just needing to be unique. See "LadderLeak: Breaking ECDSA With Less Than One Bit of Nonce Leakage"
• SAI_Peregrinus 4y ago
  It's more properly called 'k'. It's really a secret key, but it has to be unique per-signature. If an attacker can ever guess a single bit of the nonce with probability non-negligibly >50%, they can find the private key of whoever signed the message(s). It makes ECDSA very brittle, and quite prone to side-channel attacks (since those can get attackers exactly such information.
  • drexlspivey 4y ago
    That makes no sense, how can you get the private key from knowing 1 bit of the nonce?
    • tptacek 4y ago
      See, cryptography engineering is sinking in! Here you go: https://toadstyle.org/cryptopals/62.txt https://toadstyle.org/cryptopals/62.txt What's especially great about this is that it's very easy to accidentally have a biased nonce; in most other areas of cryptography, all you care about when generating random parameters is that they be sufficiently (ie, "128 bit security worth") random. But with ECDSA, you need the entire domain of the k value to be random.
      • drexlspivey 4y ago
        Ok but for this scheme you need a large amount of signatures from the same biased RNG which makes sense. I thought that the GP was suggesting that you can recover the key from one signature with just a few bits.
        • cbhl 4y ago
          "same biased RNG" largely reduces to "I use the same computer to generate all my signatures"; for example see the Debian RNG bug from 2008 and "large amount of signatures" could be "I sign every email I send to a mailing list" or "I use this key to sign some widely distributed software every two weeks"
        • tptacek 4y ago
          When these bugs first came into fashion, the "bias" of the RNG was an implementation artifact, not some bug in /dev/random: it was the code you used to fill a bignum uniformly in the size of the nonce. So mentally substitute "same biased RNG" for "same implementation, with same keys". Yes, the attacks require many signatures. Like the infamous Bleichenbacher RSA attack, which was originally dubbed "The Million Message Attack", in part as a jab at how impractical they were presumed to be, collecting thousands of signatures is often a very realistic attack; for instance, any system that generates signed messages automatically.
    • na85 4y ago
      I guess like so: https://cryptopals.com/sets/8/challenges/62.txt https://cryptopals.com/sets/8/challenges/62.txt E: Thomas beat me to it
  • Mindless2112 4y ago
    There's an easy fix for that though -- generate k deterministically using the procedure in RFC6979 [1]. [1] https://datatracker.ietf.org/doc/html/rfc6979#section-3.2 https://datatracker.ietf.org/doc/html/rfc6979#section-3.2
  • dilippkumar 4y ago
    > If an attacker can ever guess a single bit of the nonce with probability non-negligibly >50%, they can find the private key of whoever signed the message(s). This doesn’t seem right. Why wouldn’t someone guess a bit 0, see if the recovered message makes sense, and if it doesn’t, then try bit 1? It would make the entire scheme useless no? Am I missing something?
    • Thorrez 4y ago
      I think they have to get the bit repeatedly and then combine the biased signatures together mathematically to get the key.