ECDSA is an elliptic-curve digital signature algorithm used to authenticate code and other messages. Its security depends critically on generating a unique, random nonce for every signature. section 9.5 section 9.7
An ECDSA implementation performs three operations:
- Generate a keypair using an elliptic curve with generator G and order N; the public key is A = dG, where d is the private key. section 9.5.1
- Sign message m by choosing nonce k_E, computing R = k_EG, r = R_x, and s = (h(m) + d·r) / k_E mod N. section 9.5.1
- Verify (r, s) by calculating P = (h(m)G + rA) / s and accepting the signature when P_x equals r. section 9.5.1
Nonce reuse recovers the signing key
A vulnerable Go signer fixes k_E for every signature. Two signatures over different hashes then share the same r value. Subtracting their signature equations recovers k_E = (h(m1) − h(m2)) / (s1 − s2) mod N; substituting that nonce into d = (k_Es − h(m)) / r mod N recovers the private key. The recovered key can sign a new message that verifies against the original public key. section 9.5.2
Treat nonce generation as a security boundary: reuse is catastrophic, and even partial nonce leakage can enable advanced attacks. Prefer a standard signing implementation that mixes supplied randomness with a cryptographically secure random source. section 9.5.1 section 9.5.2
