Re: [Cfrg] Exposing the private key by signing "too many times"

There are also several so-called "lattice attacks", mostly based on work done
on modular polynomial factorization by Dan Coppersmith.

AFAIK all of these attacks assume that either some bits of the ephemeral are
leaked (e.g., by a timing attack), or that there's some way to control the
value of some bits of the ephemeral key (e.g., so-called glitch attacks). In
such circumstances the results of some number (sometimes quite small) of
signature operations are used to extract the private key.

See for example:

	http://www.hpl.hp.com/techreports/1999/HPL-1999-90.pdf

				Ned

> On Thu, Apr 14, 2016 at 02:44:43PM +0000, Dan Brown wrote:
> > Long ago DSA allowed biased ephemeral secrets, which Bleichenbacher
> > exploited to extract the private key.
> >
> > Not aware of history or survey papers on topic, sorry.

> The attack is described in this report from Serge Vaudenay (section 5):

>    http://www.ipa.go.jp/security/enc/CRYPTREC/fy15/doc/1002_reportDSA.pdf

> Serge says that the attack was announced in February 2001; apparently,
> according to that CHES 2013 article:

>    http://www.iacr.org/archive/ches2013/80860105/80860105.pdf

> the attack was also presented and discussed at an IEEE P1363 WG meeting
> on November 15th, 2000.

> To my knowledge it was never formally published.

> Conceptually, this is a generalization of the dreaded "secret value
> reuse". If you reuse the same k value in two distinct signatures (with
> the same private key) then the private key is revealed. Bleichenbacher's
> attack generalizes that result into leveraging a selection bias; plain
> reuse just being an awfully large selection bias.

> 	--Thomas Pornin

> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg