-1

How do I know if my signatures has leak/weak signatures?

Is there a website or script where I can input my signatures to check for weak/leak Nonce part?

0

1 Answer 1

0

How do I know if my signatures has leak/weak signatures?

I guess you are looking for a method that determines this simply by analysing the signatures themselves. I don't know how I would do that and suspect it might involve reading a number of scholarly articles on the subject and developing a much deeper understanding of the mathematics than I have (or want). It has been done though - I believe people claim to have identified Bitcoin signatures in the blockchain that exhibit this fault. Their software is probably available. It seems that most of these weak/leaky signatures were signatures that were generated with some manual intervention and apparently not by well-known wallet software used in the intended way by most people.

For me, a simpler way to check is by checking how the nonce is chosen by the particular software you used to make those signatures. I believe you need to ensure that the nonce was chosen randomly using a good source of randomness or is indistinguishable from that by an attacker who lacks the private-key. I believe a new such nonce must be used for each signature.

If we take, for example, Bitcoin Core. In How to specify ECDSA nonce used in bitcoin signing code? the answer pointed out the source, which I find contains

prng.Generate((unsigned char*)&nonce, 32);

Which looks encouraging to me. Though I'm certainly no expert on the subject of ECDSA and key leakage. I guess I'd also have to look at the source for any older versions I have used.

That answer also says

libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.

See


Is there a website [which provides a signature checking service]

I don't know of one. There is also a rule here that discourages me from recommending websites:

Questions seeking product or service reviews are off-topic because they tend to attract subjective, low-quality, and spam answers. On the other hand, offerings in the Bitcoin space are still evolving rapidly which often renders answers outdated quickly.

which refers to a discussion at this site's "META" site: How should questions that function like reviews be handled?

2
  • Note that RFC6979 does not generate random nonces. It generates nonces that are indistinguishable from random to an attacker which does not know the provate key, which is sufficient, and far less error prone than actually using fresh randomness for each signature. Oct 1 at 11:52
  • @Pieter, thanks. Answer updated slightly. Oct 1 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.