Applied Cryptography
In ECDSA digital signatures, a secret random number k is used for each signature. Which of the following correctly describes how k must be handled?
- Ak is included in the signature and made public, so using the same value any number of times does not affect security
- BIf the same k is used for signatures on different messages, the private key can be computed from the two signatures
- CEven if k is a predictable value, signatures cannot be forged unless the private key itself leaks
Show answer and explanation
Answer: B. If the same k is used for signatures on different messages, the private key can be computed from the two signatures
An ECDSA signature (r, s) is computed from k, the hash value of the message and the private key. If two messages are signed with the same k, k can be eliminated from the two equations for s, and both k and the private key can be found. It is known that even a partial bias or predictability in the bits of k can let the private key be recovered from many signatures. Therefore either a good-quality random number is used, or k is generated deterministically from the private key and the message, as in RFC 6979.
- A. k itself is not made public. Reusing k makes r in the signatures identical, which gives a clue for finding the private key.
- B. Correct. Reusing the same k leads directly to leaking the private key.
- C. If k is known, the private key can be computed from the signature equation. Once the private key is known, signatures can be forged.