ECDSA: Handle with Care

Summary: A Trail of Bits post explains that ECDSA private keys can be recovered if a nonce is ever revealed or repeated, and that lattice attacks have recovered keys from partial nonce leakage since Howgrave-Graham and Smart's 1999 work. The post cites Nguyen and Shparlinski recovering 160-bit DSA keys from three bits of each nonce across 100 signatures, Mulder et al breaking 384-bit ECDSA on a smart card from five bits across 4,000 signatures, and the LadderLeak attack recovering keys from less than one bit of nonce leakage in several OpenSSL versions.
Bottom line: The post states that a 256-bit ECDSA implementation can be broken completely by a lattice attack when the RNG introduces a bias of just 4 bits in the nonce, even without knowing which values are biased - and that the attack fits in under 100 lines of Python.

Read the original at Trail of Bits Blog ↗