A nonce is a value intended for one use. In ECDSA, the signing operation chooses a random ephemeral key k_E for each message, producing a different signature even when messages repeat. This uniqueness is a security requirement, not merely an implementation preference. section 9.5.1 section 9.7
Equation 9.6
\[\begin{aligned} \begin{aligned} (R_x, R_y) &= k_E G \\ r &= R_x \\ s &= \frac{h(m) + d \cdot r}{k_E} \bmod N \end{aligned} \label{equation:ecdsa-3} \end{aligned}\]ECDSA computes the signature value r from k_E and uses k_E again in s; the same nonce therefore leaves a detectable algebraic relationship between signatures. section 9.5.1
A fixed nonce breaks ECDSA
A vulnerable Go implementation stores one value in notSoNonce and assigns it to k_E for every signature. Verification still accepts the signatures, but signatures for different messages have identical r values. Given two such signatures made with the same private key, an attacker derives the nonce from their s values and message hashes, then derives the private key. The recovered key can sign a new message that verifies against the original public key. section 9.5.1 section 9.5.2 section 9.7
Defensive rules:
- Use a unique, unpredictable nonce for every ECDSA signature. section 9.5.2
- Do not replace a cryptographic signer’s nonce generation with a fixed value or an unreliable random source. section 9.5.1
- Treat repeated r values from signatures made with one key as an urgent compromise indicator. section 9.5.2
