Attacking (EC)DSA with partially known multiples of nonces

Abstract

In this paper, we introduce a series of attacks on DSA schemes that, under certain assumptions, can expose the secret key when one or more signed messages are accessible. By utilizing these signed messages, we construct a system of linear congruences with at most one solution smaller than a specific bound, which can be efficiently determined using Babai's Nearest Plane Algorithm. As a case study, we provide a successful attack on secp161k1, assuming that a particular multiple of an ephemeral key is 161 bits long.