Reading — step 1 of 5
Deterministic Nonces (RFC 6979)
~1 min readECDSA Algorithm
Why nonces are catastrophic to get wrong
Vanilla ECDSA signing chooses a fresh random integer k for every signature, then publishes r = (k*G).x mod n and s = k^{-1}(z + r*d) mod n.
If k is ever predictable, biased, or reused, the attacker can solve algebraically for the priv
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…