fake signature generation

Quote from: AbadomRSZ on March 10, 2025, 01:56:55 AM

Quote from: krashfire on March 09, 2025, 07:19:44 PM

hi, im currently working on enhancing on Nonce Recurrence Attack. Read: https://eprint.iacr.org/2023/305.pdf

While i was able to recreate the attack describe in the paper, im thinking of enhancing this method. however, the enhance method would require me to generate some fake signatures that still points to the same public key. i vaguely remember that there was a discussion in some topic and someone mention that we could create fake signatures that could still be verified against the targeted public key but it wont be valid. or something to that effect.

Do you get what i am saying? does it make sense to you? i might not be explaining this correctly. but if you do, what is the formula to do that? i have forgotten the formula.

I HAVE WHAT YOU'RE LOOKING FOR, TALK TO ME IN PM

i have received your script. give me 1 day, and i will get back to you with my script. thanks buddy.

but if you want the Nonce recurrence attack script i wrote, you can download here. this one uses a generator and not the enhanced version. https://github.com/KrashKrash/nonce-recurrence-attack

thanks. it works.

Code:


------------------------------------------------------------------------------------------------------------------------------------------------------
Chosen recurrence relation for attack: k_next = 43511367934207785493205740240378275743609768675817908100722913788393695639657*k_prev + 78730372042131832072287759890573273005645422101261818863735891162602450516391 mod n
------------------------------------------------------------------------------------------------------------------------------------------------------
Generating artificial signatures...

Created artificial signature 1 between original signatures 1 and 2
  r_new = 23298015045193904612586625097013013238434742231554167744515936879399869488397, s_new = 110955400697554132573244702028682455501659791587247294823293562059184441715205, z_new = 114348426784376972262212387491392248456909105810912478725596391450242197501624
Created artificial signature 2 between original signatures 1 and 2
  r_new = 23298015045193904612586625097013013238434742231554167744515936879399869488397, s_new = 65922615754394972779235513816836497423895401971455841314960028650904449284001, z_new = 95651824604975196373056940850546687721428079367574184939506225302834722908348
Created artificial signature 3 between original signatures 2 and 3
  r_new = 34559190504341613833450353695106665408056903224372678973840446297532206243167, s_new = 68474226316309826745487865238288822884863264116278386354529472763624044908668, z_new = 14119843862881681218543777296966920285776233738925951248823701482312902925979
Created artificial signature 4 between original signatures 2 and 3
  r_new = 34559190504341613833450353695106665408056903224372678973840446297532206243167, s_new = 87856688150857517286884451144948438861914677933532768283681731806952275948583, z_new = 50454272941657236491777748105016448688256465114149558571605332890217841528754
Created artificial signature 5 between original signatures 3 and 4
  r_new = 19464743338216844258300736972864389034943655834701603668204034612723902071488, s_new = 64530538090822446044806789889239841870632092828991942322079830579050702743505, z_new = 100696216182135497006398112131941561404271020258497146408493916851894222017995
Created artificial signature 6 between original signatures 3 and 4
  r_new = 19464743338216844258300736972864389034943655834701603668204034612723902071488, s_new = 47235015937058937548982965514420387033624898602564791643518102370593631469157, z_new = 90587031616179313788031102499266527866257203397777530630520324049364149405545

Total number of signatures (original + artificial): 10
------------------------------------------------------------------------------------------------------------------------------------------------------
Generating polynomial to solve for the private key...
Nonces difference equation:
(((((((k12*k12-k23*k01)*k13*k23-(k23*k23-k34*k12)*k01*k02)*k14*k24*k34-((k23*k23-k34*k12)*k24*k34-(k34*k34-k45*k23)*k12*k13)*k01*k02*k03)*k15*k25*k35*k45-(((k23*k23-k34*k12)*k24*k34-(k34*k34-k45*k23)*k12*k13)*k25*k35*k45-((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k12*k13*k14)*k01*k02*k03*k04)*k16*k26*k36*k46*k56-((((k23*k23-k34*k12)*k24*k34-(k34*k34-k45*k23)*k12*k13)*k25*k35*k45-((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k12*k13*k14)*k26*k36*k46*k56-(((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k12*k13*k14*k15)*k01*k02*k03*k04*k05)*k17*k27*k37*k47*k57*k67-(((((k23*k23-k34*k12)*k24*k34-(k34*k34-k45*k23)*k12*k13)*k25*k35*k45-((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k12*k13*k14)*k26*k36*k46*k56-(((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k12*k13*k14*k15)*k27*k37*k47*k57*k67-((((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k37*k47*k57*k67-(((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k47*k57*k67-((k56*k56-k67*k45)*k57*k67-(k67*k67-k78*k56)*k45*k46)*k34*k35*k36)*k23*k24*k25*k26)*k12*k13*k14*k15*k16)*k01*k02*k03*k04*k05*k06)*k18*k28*k38*k48*k58*k68*k78-((((((k23*k23-k34*k12)*k24*k34-(k34*k34-k45*k23)*k12*k13)*k25*k35*k45-((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k12*k13*k14)*k26*k36*k46*k56-(((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k12*k13*k14*k15)*k27*k37*k47*k57*k67-((((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k37*k47*k57*k67-(((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k47*k57*k67-((k56*k56-k67*k45)*k57*k67-(k67*k67-k78*k56)*k45*k46)*k34*k35*k36)*k23*k24*k25*k26)*k12*k13*k14*k15*k16)*k28*k38*k48*k58*k68*k78-(((((k34*k34-k45*k23)*k35*k45-(k45*k45-k56*k34)*k23*k24)*k36*k46*k56-((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k23*k24*k25)*k37*k47*k57*k67-(((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k47*k57*k67-((k56*k56-k67*k45)*k57*k67-(k67*k67-k78*k56)*k45*k46)*k34*k35*k36)*k23*k24*k25*k26)*k38*k48*k58*k68*k78-((((k45*k45-k56*k34)*k46*k56-(k56*k56-k67*k45)*k34*k35)*k47*k57*k67-((k56*k56-k67*k45)*k57*k67-(k67*k67-k78*k56)*k45*k46)*k34*k35*k36)*k48*k58*k68*k78-(((k56*k56-k67*k45)*k57*k67-(k67*k67-k78*k56)*k45*k46)*k58*k68*k78-((k67*k67-k78*k56)*k68*k78-(k78*k78-k89*k67)*k56*k57)*k45*k46*k47)*k34*k35*k36*k37)*k23*k24*k25*k26*k27)*k12*k13*k14*k15*k16*k17)*k01*k02*k03*k04*k05*k06*k07) = 0
------------------------------------------------------------------------------------------------------------------------------------------------------
Polynomial in d:
10076378950690840322333303104212707217658418276379388800499402055322370197830*dd^29 + 9907754340187044042462333394731559996501271924517098312112490292652290220374*dd^28 + 25413118996992445384351078544952248707143401694174929858895015610527546784254*dd^27 + 54637476460606508381736836066201543629053576715917127510892537352262580074245*dd^26 + 112660205308610187075066405664391979505309077946149247712537995226455794436810*dd^25 + 41916469819176829829003617962051564034209293180602522782111440946370565287073*dd^24 + 79200169230764140950417025891323641817621003989352606693423673374557515131241*dd^23 + 6892011050106687223571788452179503704436289455822671952398809341012131076293*dd^22 + 87282091338451661877346906037796853908695573093119175349285366988383343671979*dd^21 + 11304997998728144123509981342384890488924738957001454069700450158894601413555*dd^20 + 43979018229079941203255031467982475320154780564095188717134688641454823445236*dd^19 + 75899029772163776616855855544521674685821741983222872578787604745827781681373*dd^18 + 111185857515521162710720049266785741959219058774265220255138138663908361369509*dd^17 + 90097802487495971394348001492670173807693450020911370453545320234648163713708*dd^16 + 91619490151160204957571842154554124171353946727089446509984910179141836095578*dd^15 + 33619806607511208853645921383885292007303237141080347372188866889704588006017*dd^14 + 98507260632833035704714521876291822323109177386128401580070683384149763516801*dd^13 + 30322200714711228447010355230180551241231394995885110745433945031787692193260*dd^12 + 7096479951060851309715641712092460614122972796251168231097030576464187818685*dd^11 + 40542171423306135701504689200828153305093321849084037823359721756352871767487*dd^10 + 69643050130527340465724621294234560230601973582750268941005387368948139703866*dd^9 + 87241409706175103059766549621140491981504711229707304358100814572131640990309*dd^8 + 61237513059092026569007272320630567118531728841589147251671505528852005631367*dd^7 + 1453725589557907817852160717443063393256773858393394886840189629397322782141*dd^6 + 48670189451632826179229665351532123528783509993012732650965262261411195940816*dd^5 + 1812573516712236544783329436796020444157609066755981011895459683138721491048*dd^4 + 110725644076326742608099456151642593983254672417300349789291108993460560776502*dd^3 + 2954658004812788114563058055514340074961271172864817687704379643190729804515*dd^2 + 13438906721576106075723197136896004432378483577017847622586678742441233468181*dd + 108712551478291873565295586254742667835744622857708672501710504063220089310291
------------------------------------------------------------------------------------------------------------------------------------------------------
Finding roots of the polynomial...
Found 1 roots.
Roots of the polynomial:
Root: 103944520760024560506038323186664680005228038115110724833232378297114715088318, Multiplicity: 1
------------------------------------------------------------------------------------------------------------------------------------------------------
SUCCESS! Private key found: d = 103944520760024560506038323186664680005228038115110724833232378297114715088318

Verifying the artificial signatures follow the specified recurrence relation:
Artificial signature 1:
  Expected k: 90360872727669507550394887425756877359698428223587058630502028768486693956925
  Actual k:   90360872727669507550394887425756877359698428223587058630502028768486693956925
  Match: True
Artificial signature 2:
  Expected k: 90360872727669507550394887425756877359698428223587058630502028768486693956925
  Actual k:   90360872727669507550394887425756877359698428223587058630502028768486693956925
  Match: True
Artificial signature 3:
  Expected k: 20707329528702014598452831463605667149461823117219811019611191842061086457883
  Actual k:   20707329528702014598452831463605667149461823117219811019611191842061086457883
  Match: True
Artificial signature 4:
  Expected k: 20707329528702014598452831463605667149461823117219811019611191842061086457883
  Actual k:   20707329528702014598452831463605667149461823117219811019611191842061086457883
  Match: True
Artificial signature 5:
  Expected k: 19741724224496760945367500974295943818662631917946907732377899462187157547640
  Actual k:   19741724224496760945367500974295943818662631917946907732377899462187157547640
  Match: True

i will update the code properly and send you the enhance version tomorrow. cheers mate.