Quote from: Yves Cuicui on September 09, 2013, 04:51:18 PM

Quote

You might as well just deny K=11, since if they used 11 (or any other specific value) and you know it you could recover the private key too.

Are you kidding me? Using k=d is made obvious by the fact that r=Qx. Using 11 or whatever cannot be guessed.

The subject is not that RNG are broken or bugged or ... I just want to draw attention to a situation on which nobody thinks

No, I am not kidding you. If k==11 then r==11*g, which is even _more_ obvious than r==Q (it's a static comparison instead of a variable one!). Or, if you're into dynamic comparisons... what if k were one of your other private keys?

The distinction with the comparison with zero is that 0 is not a valid point on the curve, so no correct signature can ever have that value. Vs k happening to take on the value of one of your private keys which is just as likely as any other point. If you go around disallowing a bunch of K values then you're decreasing security not increasing it... Though I would agree that this specific test is perhaps mildly useful as a "RNG fatally broken, do not pass go" check.