4 ms·
Yes, if the 'k' values are predictable, then someone can extract the private key. The Python random module uses a Mersenne twister, so observing a sufficient nu
by sweis 17y ago
Yes, if the 'k' values are predictable, then someone can extract the private key. The Python random module uses a Mersenne twister, so observing a sufficient number of signatures would allow someone to extract the key.
This is not a flaw in DSA, but a flaw in the Keyczar Python implementation. Here's the original security advisory, again: http://groups.google.com/group/keyczar-discuss/browse_thread/thread/781c4db2c0b72b36 http://groups.google.com/group/keyczar-discuss/browse_thread...
PS - I was the grad student. Yes, I did get my degree, and no, they haven't asked for it back (yet).
- kragen 17y agoMy condolences. You must not be feeling very good right now. I don't know whether to agree that it's "not a flaw in DSA". DSA's failure mode is that if you ever use your private key, even once, with a single guessable random number, your opponent knows your key and can impersonate you thereafter. There are other digital signature algorithms that don't have this failure mode, such as RSA. Maybe it's better, from a "defense-in-depth" point of view, not to design DSA into new protocols.
- sweis 17y agoNo condolences necessary. I'm glad that more people are looking at Keyczar and finding these bugs. We learn from our mistakes and in the end have safer code for everyone.