Implémenter ECDSA signatures
ECDSA (Elliptic Curve Digital Signature Algorithme) provides digital signatures avec smaller clés than RSA. Apprendre signing et verification.
- 1
ECDSA: to sign message m with private key d, compute e = hash(m), pick random k, compute (x, y) = k*G, r = x mod n, s = k^(-1)(e + r*d) mod n. Signature is (r, s). To verify with public key Q = d*G: compute w = s^(-1) mod n, u1 = e*w, u2 = r*w, (x, y) = u1*G + u2*Q, verify x mod n = r. The random k must never repeat or leak — this broke PlayStation 3 and some Bitcoin wallets.
- 2 Générateur HMAC →
Générer a deterministic HMAC for the message. ECDSA requires a hash of the message — use SHA-256. For deterministic ECDSA (RFC 6979), derive k from the private key and message hash using HMAC, eliminating the need for random k and preventing nonce reuse vulnerabilities.
- 3 Calculatrice de hash →
Hash the message with SHA-256 before signing. The hash reduces the message to a fixed-size digest that fits in the curve's field. Use SHA-256 for P-256, SHA-384 for P-384. Never use MD5 or SHA-1 — they are broken and allow signature forgery.
Questions fréquentes
- What happens if the ECDSA nonce k is reused?
- Catastrophic key compromise. If two messages are signed with the same k, an attacker can compute the private key d from the two signatures. This broke Sony PlayStation 3 (static k) and some early Bitcoin implementations. Use deterministic ECDSA (RFC 6979) to eliminate this risk.
- ECDSA vs EdDSA?
- ECDSA requires a random nonce per signature (or deterministic derivation). EdDSA (Ed25519) is deterministic by design, uses Edwards curves (faster, simpler, no special cases), and is strongly unforgeable. Use Ed25519 (EdDSA) for new systems — it is simpler, faster, and avoids the nonce pitfall.