Paper 2023/841 Original: eprint.iacr.org/2023/841 ↗
The curious case of the half-half Bitcoin ECDSA nonces
Abstract
We report on a new class of ECDSA signature vulnerability observed in the wild on the Bitcoin blockchain that results from a signature nonce generated by concatenating half of the bits of the message hash together with half of the bits of the secret signing key. We give a lattice-based attack for efficiently recovering the secret key from a single signature of this form. We then search the entire Bitcoin blockchain for such signatures, and identify and track the activities of an apparently custom ECDSA/Bitcoin implementation that has been used to empty hundreds of compromised Bitcoin addresses for many years.
Metadata
- Available format(s)
PDF- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- History
- 2023-06-06: last updated
- 2023-06-06: published
- Short URL
- https://ia.cr/2023/841
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2023/841,
author = {Dylan Rowe and Joachim Breitner and Nadia Heninger},
title = {The curious case of the half-half Bitcoin ECDSA nonces},
howpublished = {Cryptology {ePrint} Archive, Paper 2023/841},
year = {2023},
url = {https://eprint.iacr.org/2023/841}
}