Short Nonces in ECDSA about crypto-attacks HOT 3 CLOSED

1. If the nonces are not generated uniformly at random in the interval [1, n - 1], then you have a biased nonce attack
2. If the modulus n is k bits, and the nonces are only l bits, with l < k, then the first (k - l) bits will be 0, yes
3. So if your modulus is 247 bits (weird choice of modulus), then the first 3 bits would be 0, yes

from crypto-attacks.

@jvdsn I'm interested in whether it is possible to determine that a specific signature contains short Nonce using the signature values [R, S, H (e)] for calculations? Is there a script or algorithm for these calculations?

from crypto-attacks.

In order to know if the nonce is biased, you need to know how it was generated. If you don't know that, like in your case where you only have the signature, then you can't know.

from crypto-attacks.