Implement ECDSA signatures
ECDSA (Elliptic Curve Digital 签名 Algorithm) provides digital signatures 具有 smaller 关键 than RSA. Learn 签名和 验证.
- 1
ECDSA: 到 sign 消息 m 具有私有键 d, 计算 e = hash(m), 选取 random k, 计算 (x, y) = k*G, r = x mod n, s = k^(-1)(e + r*d) mod n. Signature 是 (r, s). 到验证具有公共键 Q = d*G: 计算 w = s^(-1) mod n, u1 = e*w, u2 = r*w, (x, y) = u1*G + u2*Q, 验证 x mod n = r. random k 必须从不 repeat 或 leak — 此 broke PlayStation 3 和一些 Bitcoin wallets.
- 2 HMAC 生成器 →
生成 a deterministic HMAC for the message. ECDSA requires a hash of the message — use SHA-256. For deterministic ECDSA (RFC 6979), derive k from the private key and message hash using HMAC, eliminating the need for random k and preventing nonce reuse vulnerabilities.
- 3 哈希计算器 →
Hash 消息具有 SHA-256 之前签名. hash reduces 消息到 固定-大小 digest 该 fits 在 curve's 字段. Use SHA-256 为 P-256, SHA-384 为 P-384. 从不 use MD5 或 SHA-1 — 它们是 broken 和允许签名 forgery.
常见问题
- 什么 happens 如果 ECDSA nonce k 是 reused?
- Catastrophic 键 compromise. 如果 two messages 是 signed 具有相同 k, attacker 能够计算私有键 d 从 two signatures. 此 broke Sony PlayStation 3 (静态 k) 和一些 early Bitcoin implementations. Use deterministic ECDSA (RFC 6979) 到 eliminate 此风险.
- ECDSA vs EdDSA?
- ECDSA requires random nonce per 签名 (或 deterministic derivation). EdDSA (Ed25519) 是 deterministic 通过设计, 我们 Edwards curves (faster, simpler, 否特殊 cases), 和是 strongly unforgeable. Use Ed25519 (EdDSA) 为新 systems — 它是 simpler, faster, 和 avoids nonce pitfall.