CSAW CTF Crypto Challenge: Breaking DSA

Summary: Trail of Bits contributed a CSAW CTF cryptography challenge in which a DSA signing server generated its nonce k with Python's Mersenne Twister via random.randrange, and a /forgotpass endpoint leaked 64-bit chunks of that same RNG state. Observing 624 32-bit outputs is enough to reconstruct the MT internal state, so players cloned the RNG, predicted k, and solved s = (kinv * (h + r * x)) % q to recover the private key x; 28 of 44 teams captured the flag during the 36-hour finals.
Bottom line: The same non-CSPRNG weakness underlies the PlayStation 3 firmware hack, and here a password reset token leaked the nonce that protects the signing key - one mild-looking endpoint turned into full private key recovery.

Read the original at Trail of Bits Blog ↗