Exploring ECDSA Vulnerabilities Through Nonce Leakage

Just stumbled upon this research. The author managed to extract a private key by exploiting less than 4 bits of nonce leakage through multiple signatures. Crazy, right? I’m kinda stuck though. I have no k nonce, no leakage at all, and no clue about the private key or the message. So I'm tweaking my script. If 4 bits can leak a key, then maybe leaking 6 bits of k nonce could work. My script will try out 262,144 combinations... might as well give it a shot.

I was warned about this just yesterday. Totally slipped my mind while coding. Thanks for the heads-up! Really appreciate it.

Made some changes to my code, but there are some tricky details with how the signatures are selected. Gotta be careful with that.

So does the code actually find the privkey or what?

Here’s the research link again for anyone who missed it. It's got some interesting stuff.

To see if my script is working, I found 3 signatures where the k nonce is just 20 bits. Here’s what I got: r = 0x6f007fe0bc2a1a0f6d944b8d4a2353e48833e1f6be178f87f293068b25d6d96e s = 0xea5459e9fb80101fbc261b90c59bf20dc497f5f71c90356c9530d035d32bd023 z = 0x840131231b57268049ccbd6b2c84408251b935cb951c069ecb86cf8d4755bf34 k = 0xb37b1 And I have two more sets of data, but they’re similar.

Did you try using scrypt? What were the results? Were you able to recover the nonce or privkey from those signatures?

I’ve got a few nonces starting with 0x4000000 and 0x04000000. Here’s what I found: First r = fda403bfcb379b95a27ac76754fe77808e96b43419e33583cf5aba7d49c72f2d Second r = 3031b819c8bbdb7484bf70ca79542da5566900dca414b9519302ca74b332bf72 Nonce from 254 to 255 bit... What’s the full nonce or privkey? By the way, here’s the pubkey for that R used.