I was trying to generate 1-bit signatures using this repo I found. But I keep hitting a wall with "private key not found". I want to figure out how 1-bit signatures r, s, z can help with that. Anyone got these signatures to share here? I’m really keen to prove that 1-bit is enough to crack d.
Honestly, 1-bit signatures don't really add up, even for tiny elliptic curves like p=79, n=67. They call it 7-bit security, but it’s closer to 6-bit in practice. If you have r and s as single bits, they can only be 0 or 1. So you end up with four combinations. What’s the end goal here?
I thought the OP was talking about biased nonces to solve lattice problems. But s as a forced 1-bit… yeah, that doesn’t work since r is tied to kG.x mod n.
You can’t apply a Lattice attack with just 1-bit nonces. It just doesn’t work. The error vector is too noisy when you deal in larger dimensions. You’d be better off with a Fourier attack.
I think the confusion lies in how you’re defining a "1-bit r, s, z signature." Those values need to be full-sized. For lattice attacks, knowing the nonce k is more key than any cute labeling. One full nonce is enough for one signature; a few almost known can work too. But trying to claim you need 1-bit signatures? Nah.