Comment by mkj
3 days ago
With ecdsa the number of signatures needed to attack biased nonces seems low, hundreds or thousands? https://blog.trailofbits.com/2020/06/11/ecdsa-handle-with-ca...
3 days ago
With ecdsa the number of signatures needed to attack biased nonces seems low, hundreds or thousands? https://blog.trailofbits.com/2020/06/11/ecdsa-handle-with-ca...
That's when you have at least one bit of each nonce. But if you think about it, the probability of this broken generator giving exactly the same output as the unbroken generator is (2^64-1)÷(2^64) so that's a lower bound on how often you don't get any information from this bias. (Assuming 64-bit generation!)
getting any information at all based on this bias