ECDSA signatures implementieren
ECDSA (Elliptic Curve Digital Signatur Algorithmus) provides digital signatures mit smaller Schlüssel than RSA. Lernen signing und verification.
- 1
ECDSA: to sign message m with private key d, compute e = hash(m), pick random k, compute (x, y) = k*G, r = x mod n, s = k^(-1)(e + r*d) mod n. Signature is (r, s). To verify with public key Q = d*G: compute w = s^(-1) mod n, u1 = e*w, u2 = r*w, (x, y) = u1*G + u2*Q, verify x mod n = r. The random k must never repeat or leak — this broke PlayStation 3 and some Bitcoin wallets.
- 2 HMAC-Generator →
Erzeugen a deterministic HMAC for the message. ECDSA requires a hash of the message — use SHA-256. For deterministic ECDSA (RFC 6979), derive k from the private key and message hash using HMAC, eliminating the need for random k and preventing nonce reuse vulnerabilities.
- 3 Hash-Rechner →
Hash the message with SHA-256 before signing. The hash reduces the message to a fixed-size digest that fits in the curve's field. Use SHA-256 for P-256, SHA-384 for P-384. Never use MD5 or SHA-1 — they are broken and allow signature forgery.
Häufige Fragen
- What happens if the ECDSA nonce k is reused?
- Catastrophic key compromise. If two messages are signed with the same k, an attacker can compute the private key d from the two signatures. This broke Sony PlayStation 3 (static k) and some early Bitcoin implementations. Use deterministic ECDSA (RFC 6979) to eliminate this risk.
- ECDSA vs EdDSA?
- ECDSA requires a random nonce per signature (or deterministic derivation). EdDSA (Ed25519) is deterministic by design, uses Edwards curves (faster, simpler, no special cases), and is strongly unforgeable. Use Ed25519 (EdDSA) for new systems — it is simpler, faster, and avoids the nonce pitfall.