Generation of ECDSA random k about micro-ecc HOT 2 CLOSED

Your interpretation of the ecdsa_sign() is correct. As for why it is that way… I had thought that the bias attacks on ECDSA were only effective on binary fields, but after further research that was not correct (eg http://eprint.iacr.org/2013/346.pdf). So I will change it to fail on k >= n. It doesn't seem to be a significant issue for ECDH but it is reasonable to do the same thing there.

It turns out that there is another more serious issue, which is that the Montgomery ladder implementation of point multiplication gives timing information about the number of bits in the scalar. This leads to a simple timing attack on the ECDSA code to get "small" values of k, which (with enough samples) can then be used to extract the private key. This should be possible to fix using the countermeasure described in http://eprint.iacr.org/2011/232.pdf

(Note that the Montgomery ladder point multiplication is preferred for ECDH because it doesn't leak any timing information about the values of the scalar bits).

from micro-ecc.

Thanks for letting me know about this issue.

from micro-ecc.