Polynonce: An ECDSA Attack and Polynomial Dance
Nils Amiet and Marco Macchetti introduce Polynonce, a novel cryptanalytic attack recovering ECDSA private keys from nonce bias across Bitcoin and Ethereum.
Summary
Vulnerabilities in ECDSA Nonce Generation
Elliptic Curve Digital Signature Algorithm (ECDSA) security hinges upon using a perfectly uniform, secret random nonce for every signature generated by a private key.
Introducing the Polynonce Attack
Nils Amiet and Marco Macchetti present Polynonce, a novel algebraic cryptanalysis attack that solves for private keys when nonces are generated by flawed pseudorandom number generators.
Scanning the Bitcoin and Ethereum Blockchains
Applying the Polynonce attack against historical transaction datasets across the Bitcoin and Ethereum public ledgers uncovered dozens of vulnerable wallet addresses.
Open-Source Implementation and Defenses
The authors release open-source verification code and an academic paper, urging developers to adopt RFC 6979 deterministic nonce generation to prevent catastrophic key recovery.
Related talks
RSAC Cybersecurity·25 min
Analysts investigate attack surfaces and defenses concerning Foundations of Bitcoin, Blockchain and Smart Contracts: Beginner's Guide to Ethereum, Tokens, an....
Main Stage·42 min
Michael Stay
Cryptanalyst Michael Stay recovers $300,000 in locked Bitcoin keys by executing a sophisticated partial-known-plaintext cryptanalysis attack against legacy Zip encryption.
Main Stage·29 min
Michael Stay
Michael Stay answers questions on GPU-accelerated PKZIP cryptanalysis, key reduction algorithms, and cryptocurrency archive recovery.