Biased Nonce Sense: Lattice Attacks Against Weak ECDSA Signatures in Cryptocurrencies

Breitner, Joachim; Heninger, Nadia

doi:10.1007/978-3-030-32101-7_1

Cited by 41 publications

(13 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Howgrave-Graham and Smart [HS01] and Nguyen and Shparlinski [NS02; NS03] used the HNP to show that the (EC)DSA schemes are insecure if the attacker can obtain information about the most significant bits of the nonces used. Since then, the HNP was used in many attacks against biased or leaked nonces in (EC)DSA, often utilizing side channels such as timing [ABuH Other attacks utilizing the HNP include using information about nonce distribution [BH19] or fault injection in the case of the SM2 signature algorithm [LCL13]. There have also been some theoretical extensions [FGR12;GRV16;HR06].…”

Section: Related Workmentioning

confidence: 99%

Minerva: The curse of ECDSA nonces

Jančár

Sedláček

Švenda

et al. 2020

TCHES

View full text Add to dashboard Cite

We present our discovery of a group of side-channel vulnerabilities in implementations of the ECDSA signature algorithm in a widely used Atmel AT90SC FIPS 140-2 certified smartcard chip and five cryptographic libraries (libgcrypt, wolfSSL, MatrixSSL, SunEC/OpenJDK/Oracle JDK, Crypto++). Vulnerable implementations leak the bit-length of the scalar used in scalar multiplication via timing. Using leaked bit-length, we mount a lattice attack on a 256-bit curve, after observing enough signing operations. We propose two new methods to recover the full private key requiring just 500 signatures for simulated leakage data, 1200 for real cryptographic library data, and 2100 for smartcard data. The number of signatures needed for a successful attack depends on the chosen method and its parameters as well as on the noise profile, influenced by the type of leakage and used computation platform. We use the set of vulnerabilities reported in this paper, together with the recently published TPM-FAIL vulnerability [MSE+20] as a basis for real-world benchmark datasets to systematically compare our newly proposed methods and all previously published applicable lattice-based key recovery methods. The resulting exhaustive comparison highlights the methods’ sensitivity to its proper parametrization and demonstrates that our methods are more efficient in most cases. For the TPM-FAIL dataset, we decreased the number of required signatures from approximately 40 000 to mere 900.

show abstract

Section: Related Workmentioning

confidence: 99%

Minerva: The curse of ECDSA nonces

Jančár

Sedláček

Švenda

et al. 2020

TCHES

View full text Add to dashboard Cite

show abstract

“…Elliptic curve over finite field 𝔽 2 𝑚 is used in practical cryptography, one of which is elliptic curve digital signature algorithm (ECDSA). ECDSA consists three steps: key generation, signature generation, and verification algorithm [14].…”

Section: Ifmentioning

confidence: 99%

A Modification of ECDSA to Avoid the Rho Method Attack

Zahra¹,

Sugeng²

2022

Advances in Computer Science Research

View full text Add to dashboard Cite

Elliptic Curve Digital Signature Algorithm (ECDSA) is a digital signature algorithm that utilizes an elliptic curve. ECDSA consists of three steps, which are key generation, signature generation, and verification algorithm. ECDSA is used on Bitcoin transactions to generate the user's public key, private key, and signature, and also to verify a Bitcoin user's signature. There are some researches on ECDSA weak randomness which can be exploited by attackers to reveal the user's private key, and causes thefts of the user's money. ECDSA weak randomness is generating a random number that is not cryptographically secure. Some modifications of ECDSA to overcome this problem have been done, such as generating the digital signature by using two private keys. Although those modified algorithms overcome ECDSA weak randomness exploitations, it is not resistant to the Rho method attack which can solve elliptic curve discrete logarithm problem (ECDLP). In case ECDLP can be solved, the user's private key can be revealed. Therefore, in this paper, we modify an ECDSA algorithm that overcomes the exploitation of ECDSA weak randomness and is also resistant to the Rho method attack by using three private keys.

show abstract

“…The public-key algorithm (ECDSA [32], EdDSA [6], Schnorr [48], ElGamal [24]) used for these keys have known attacks [8,27,29,35,45,47] that might be applied in some cases. There are real-world use cases [10,22]. To reduce the attack surface, it is necessary to use a library that implements the required cryptosystem with side-channel attack protections.…”

Section: Underlying Cryptosystemmentioning

confidence: 99%