Paper 2024/2018
On the BUFF Security of ECDSA with Key Recovery
Abstract
In the usual syntax of digital signatures, the verification algorithm takes a verification key in addition to a signature and a message, whereas in ECDSA with key recovery, which is used in Ethereum, no verification key is input to the verification algorithm. Instead, a verification key is recovered from a signature and a message. In this paper, we explore BUFF security of ECDSA with key recovery (KR-ECDSA), where BUFF stands for Beyond UnForgeability Features (Cremers et al., IEEE S&P 2021). As a result, we show that KR-ECDSA provides BUFF security, except weak non-resignability (wNR). We pay attention to that the verification algorithm of KR-ECDSA takes an Ethereum address addr as input, which is defined as the rightmost 160-bits of the Keccak-256 hash of the corresponding ECDSA verification key, and checks the hash value of the recovered verification key is equal to addr. Our security analysis shows that this procedure is mandatory to provide BUFF security. We also discuss whether wNR is mandatory in Ethereum or not. To clarify the above equality check is mandatory to provide BUFF security in KR-ECDSA, we show that the original ECDSA does not provide any BUFF security. As a by-product of the analysis, we show that one of our BUFF attacks also works against the Aumayr et al.'s ECDSA-based adaptor signature scheme (ASIACRYPT 2021). We emphasize that the attack is positioned outside of their security model.
Metadata
- Available format(s)
-
PDF
- Category
- Public-key cryptography
- Publication info
- Preprint.
- Keywords
- ECDSA with Key RecoveryBUFF Security
- Contact author(s)
- k-emura @ se kanazawa-u ac jp
- History
- 2024-12-18: revised
- 2024-12-13: received
- See all versions
- Short URL
- https://ia.cr/2024/2018
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2024/2018,
author = {Keita Emura},
title = {On the {BUFF} Security of {ECDSA} with Key Recovery},
howpublished = {Cryptology {ePrint} Archive, Paper 2024/2018},
year = {2024},
url = {https://eprint.iacr.org/2024/2018}
}