The curious case of the half-half Bitcoin ECDSA nonces

ePrint Report: The curious case of the half-half Bitcoin ECDSA nonces

Dylan Rowe, Joachim Breitner, Nadia Heninger

We report on a new class of ECDSA signature vulnerability observed in the wild on the Bitcoin blockchain that results from a signature nonce generated by concatenating half of the bits of the message hash together with half of the bits of the secret signing key. We give a lattice-based attack for efficiently recovering the secret key from a single signature of this …

bitcoin bits blockchain case class ecdsa eprint report generated message nonce report results signature vulnerability