Post
Topic
Board Development & Technical Discussion
Re: ECDSA Weak signing
by
gmaxwell
on 09/09/2013, 16:17:39 UTC
it costs nothing to add this test in the module signature;
Sure it does. For example, with OpenSSL it would force you to add your own K generation conversion to R and Rinv. In that code you get a free chance to make many mistakes or insert many backdoors.

Assuming your RNG isn't broken you're describing something that will happen at a rate in once in the number of points on the curve... which is true for all K values. You might as well just deny K=11, since if they used 11 (or any other specific value) and you know it you could recover the private key too.

[Edit: Ah, I see iddo pointed this out too]