The key finding problem for ECDSA can be reduced to the Hidden Number Problem (HNP) when nonce top bits leak with signatures and hashes. Two main HNP-solving methods exist: lattice-based attacks and Fourier analysis-based attacks. Bleichenbacher’s Fourier analysis-based attack can recover keys even if the nonces error rate is high. Aranha et al. (CCS 2020) use a 4-list sum algorithm for linear combinations of samples, which is important in the Fourier analysis-based attack.They evaluated the required number of signatures by assuming a uniform sum distribution in their algorithm. However, the actual distribution was not uniform, leading to an underestimation of the number of signatures. In this study, we derive the exact sum distribution and propose an algorithm incorporating it. Additionally, we introduce a signature reduction algorithm utilizing previously unused pairs. Previous studies assumed biased top nonces bits values by discarding certain samples to bias the nonces intentionally. However, we demonstrate that even unbiased nonces, if their top bits are leaked, enable signatures reduction and secret key recovery without altering execution time using the same algorithm. We show that for any key length, the number of signatures is reduced by 1/2 for 1 bit leakage, and the number of signatures is reduced by 1/4 for 2 or more bits leakage, and we confirm this experimentally for 131-bit ECDSA.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Bias from Uniform Nonce: Revised Fourier Analysis-Based Attack on ECDSA

  • Shunsuke Osaki,
  • Noboru Kunihiro

摘要

The key finding problem for ECDSA can be reduced to the Hidden Number Problem (HNP) when nonce top bits leak with signatures and hashes. Two main HNP-solving methods exist: lattice-based attacks and Fourier analysis-based attacks. Bleichenbacher’s Fourier analysis-based attack can recover keys even if the nonces error rate is high. Aranha et al. (CCS 2020) use a 4-list sum algorithm for linear combinations of samples, which is important in the Fourier analysis-based attack.They evaluated the required number of signatures by assuming a uniform sum distribution in their algorithm. However, the actual distribution was not uniform, leading to an underestimation of the number of signatures. In this study, we derive the exact sum distribution and propose an algorithm incorporating it. Additionally, we introduce a signature reduction algorithm utilizing previously unused pairs. Previous studies assumed biased top nonces bits values by discarding certain samples to bias the nonces intentionally. However, we demonstrate that even unbiased nonces, if their top bits are leaked, enable signatures reduction and secret key recovery without altering execution time using the same algorithm. We show that for any key length, the number of signatures is reduced by 1/2 for 1 bit leakage, and the number of signatures is reduced by 1/4 for 2 or more bits leakage, and we confirm this experimentally for 131-bit ECDSA.