ECDSA (Elliptic Curve Digital Signature Algorithm) Reference
Reference 为 ECDSA 签名 scheme, 其 parameters, 验证, 和安全注意事项.
Signature Algorithm
ECDSA generates signatures over a message hash using an elliptic curve private key. The signature consists of two values (r, s) computed from a per-signature random nonce k. Verification checks that the recovered point has the correct x-coordinate modulo the curve order. The nonce must be unpredictable and never reused, or the private key can be recovered algebraically.
- signature
- Pair (r, s)
- nonce k
- Must be random and unique
- verification
- Public equation check
two curve scalarsreuse leaks keyno secret neededSecurity Considerations
Nonce reuse or biased nonce generation allows private key recovery (as exploited against PlayStation 3 and some Bitcoin wallets). RFC 6979 specifies deterministic nonce generation from the key and message to eliminate randomness failures. Side-channel attacks on scalar multiplication can also leak the nonce. EdDSA is preferred in new designs for its deterministic, fault-resistant signing.
- nonce reuse
- Fatal: leaks private key
- RFC 6979
- Deterministic nonce
- side-channel
- Leaks nonce via timing
PS3 hackHMAC-basedconstant-time needed