born too late to RSA, born too soon to ML-DSA, born just in time to ECDSA
December 27, 2024 at 10:12 PM
born too late to RSA, born too soon to ML-DSA, born just in time to ECDSA
A new advisory that affects deterministic ECDSA signing in elliptic, which was used in MetaMask. github.com/indutny/elli...
Private key extraction in ECDSA upon signing a malformed input (e.g. a string)
### Summary
Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input
Note that `elliptic` by...
github.com
February 15, 2025 at 1:41 PM
A new advisory that affects deterministic ECDSA signing in elliptic, which was used in MetaMask. github.com/indutny/elli...
that ecdsa signature is *so* valid
August 12, 2024 at 8:18 PM
that ecdsa signature is *so* valid
"Oh yeah ECDSA signatures totally make sense"
October 25, 2023 at 2:05 AM
"Oh yeah ECDSA signatures totally make sense"
guessing your ecdsa private key
March 3, 2026 at 7:19 PM
guessing your ecdsa private key
breaking ecdsa as a joke
How fast can we make the crypto financial crisis happen if we really pull together as a team
July 19, 2025 at 4:27 PM
breaking ecdsa as a joke
Never get a cryptographer to write music man wtf do u mean the time signature is ECDSA on the sect233r1 curve u can't do that
December 12, 2024 at 9:42 AM
Never get a cryptographer to write music man wtf do u mean the time signature is ECDSA on the sect233r1 curve u can't do that
LETS GOOOOOO
github.com/denoland/deno/…
github.com/denoland/deno/…
fix(node): support ECDSA with secp256k1 in `node:crypto` by bartlomieju · Pull Request #32390 · denoland/deno
Summary
Adds secp256k1 ECDSA support to node:crypto key generation, signing, verification, and key import/export (DER, PEM, JWK)
Adds Secp256k1 variant to EcPrivateKey/EcPublicKey enums using the ...
github.com
March 2, 2026 at 1:36 PM
LETS GOOOOOO
github.com/denoland/deno/…
github.com/denoland/deno/…
This is a fascinating vulnerability.
The root causes are implementing deterministic signatures instead of hedged, using a general purpose big number implementation, and leaking its API at the crypto layer.
JavaScript types are a red herring, could have happened in any language.
The root causes are implementing deterministic signatures instead of hedged, using a general purpose big number implementation, and leaking its API at the crypto layer.
JavaScript types are a red herring, could have happened in any language.
Private key extraction in ECDSA upon signing a malformed input (e.g. a string)
### Summary
Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input
Note that `elliptic` by...
github.com
February 16, 2025 at 10:08 AM
This is a fascinating vulnerability.
The root causes are implementing deterministic signatures instead of hedged, using a general purpose big number implementation, and leaking its API at the crypto layer.
JavaScript types are a red herring, could have happened in any language.
The root causes are implementing deterministic signatures instead of hedged, using a general purpose big number implementation, and leaking its API at the crypto layer.
JavaScript types are a red herring, could have happened in any language.
Let’s please not develop extremely complex anonymous credentials based on ECDSA. Let’s just use a different signature scheme.
June 30, 2025 at 9:37 AM
Let’s please not develop extremely complex anonymous credentials based on ECDSA. Let’s just use a different signature scheme.
bun node:crypto ecdsa secp256k1 support when
January 23, 2025 at 2:38 AM
bun node:crypto ecdsa secp256k1 support when
at some point, a potential bottleneck of (securely) processing the bsky firehose will be "how fast can you verify ecdsa signatures"
February 7, 2024 at 3:25 PM
at some point, a potential bottleneck of (securely) processing the bsky firehose will be "how fast can you verify ecdsa signatures"
bun and deno supports secp256k1 but only in ecdh, not ecdsa :/
January 1, 2025 at 5:05 PM
bun and deno supports secp256k1 but only in ecdh, not ecdsa :/
🚀 Deno v2.2.6 is released!
- Smarter peer dependency handling
- Faster npm installs
- Lazy dynamic imports (unstable)
- node:http, node:sqlite, and WebSocket fixes
- Cross-curve ECDSA support
Release notes: gist.github.com/ry/16b264485...
- Smarter peer dependency handling
- Faster npm installs
- Lazy dynamic imports (unstable)
- node:http, node:sqlite, and WebSocket fixes
- Cross-curve ECDSA support
Release notes: gist.github.com/ry/16b264485...
March 28, 2025 at 1:26 PM
🚀 Deno v2.2.6 is released!
- Smarter peer dependency handling
- Faster npm installs
- Lazy dynamic imports (unstable)
- node:http, node:sqlite, and WebSocket fixes
- Cross-curve ECDSA support
Release notes: gist.github.com/ry/16b264485...
- Smarter peer dependency handling
- Faster npm installs
- Lazy dynamic imports (unstable)
- node:http, node:sqlite, and WebSocket fixes
- Cross-curve ECDSA support
Release notes: gist.github.com/ry/16b264485...
I've published c2sp.org/det-keygen, a specification for deterministic ECDSA key generation, implemented by filippo.io/keygen#ECDSA.
It reuses RFC 6979 components, it's FIPS 186-5 compliant, it's specialized for the NIST P curves, and it includes edge case test vectors.
I'd love feedback before v1!
It reuses RFC 6979 components, it's FIPS 186-5 compliant, it's specialized for the NIST P curves, and it includes edge case test vectors.
I'd love feedback before v1!
June 26, 2025 at 6:53 PM
I've published c2sp.org/det-keygen, a specification for deterministic ECDSA key generation, implemented by filippo.io/keygen#ECDSA.
It reuses RFC 6979 components, it's FIPS 186-5 compliant, it's specialized for the NIST P curves, and it includes edge case test vectors.
I'd love feedback before v1!
It reuses RFC 6979 components, it's FIPS 186-5 compliant, it's specialized for the NIST P curves, and it includes edge case test vectors.
I'd love feedback before v1!
"it's the same as if you lose your house keys" I can't call up a local tradesperson to break ECDSA what are you talking about
May 7, 2026 at 4:09 PM
"it's the same as if you lose your house keys" I can't call up a local tradesperson to break ECDSA what are you talking about
NIST standardisation organisation says that systems must phase out non-quantum-resistant cryptography by 2035. RSA, ECDSA, ECDH disallowed as insecure. nvlpubs.nist.gov/nistpubs/ir/...
November 13, 2024 at 5:54 AM
NIST standardisation organisation says that systems must phase out non-quantum-resistant cryptography by 2035. RSA, ECDSA, ECDH disallowed as insecure. nvlpubs.nist.gov/nistpubs/ir/...
ECDSA signatures be like
quote with a picture you have saved to your camera roll but haven't had a use for
I’ve had this as the one and only photo in a folder called ‘reactions’, and never used it
I’ve had this as the one and only photo in a folder called ‘reactions’, and never used it
November 5, 2023 at 6:03 AM
ECDSA signatures be like
it's ok, my correct ECDSA implementation has been signed by another correct ECDSA implementation
November 22, 2023 at 4:14 AM
it's ok, my correct ECDSA implementation has been signed by another correct ECDSA implementation
One thing I learned is that NIST removed all the rejection sampling implementations from ECDSA between FIPS 186-4 and 186-5.
July 9, 2025 at 4:19 PM
One thing I learned is that NIST removed all the rejection sampling implementations from ECDSA between FIPS 186-4 and 186-5.
Why don't ECDSA signatures store s⁻¹, instead of s? Wouldn't it make verification marginally cheaper?
February 18, 2024 at 8:25 AM
Why don't ECDSA signatures store s⁻¹, instead of s? Wouldn't it make verification marginally cheaper?
November in Servo…
🍔🖱️ context menus
🚀💇 parallel CSS parsing
🎨🤹 per-webview rendering contexts
🏷️🍲
🍔🖱️ context menus
🚀💇 parallel CSS parsing
🎨🤹 per-webview rendering contexts
🏷️🍲
December 16, 2025 at 8:51 AM
November in Servo…
🍔🖱️ context menus
🚀💇 parallel CSS parsing
🎨🤹 per-webview rendering contexts
🏷️🍲
🍔🖱️ context menus
🚀💇 parallel CSS parsing
🎨🤹 per-webview rendering contexts
🏷️🍲
Thinking of doing an impromptu livestream to keep myself focused as I port the ECDSA implementation into the upcoming Go FIPS module. Will probably start in the next half hour at www.twitch.tv/filosottile.
November 16, 2024 at 1:30 PM
Thinking of doing an impromptu livestream to keep myself focused as I port the ECDSA implementation into the upcoming Go FIPS module. Will probably start in the next half hour at www.twitch.tv/filosottile.
If I generate a secp256r1 key and a secp256k1 key that both reuse the same secret scalar, and then ECDSA-sign the same message using the same k with both keys - can the value of the secret scalar and/or k be recovered, from the signatures?
December 26, 2024 at 2:54 PM
If I generate a secp256r1 key and a secp256k1 key that both reuse the same secret scalar, and then ECDSA-sign the same message using the same k with both keys - can the value of the secret scalar and/or k be recovered, from the signatures?
Apparently there is a strong moral distinction between making a 256-bit ECDSA signature over the secp256r1 curve (good and virtuous) and making a 256-bit ECDSA signature over the secp256k1 curve (aka the scoundrel's curve)
October 2, 2025 at 8:11 PM
Apparently there is a strong moral distinction between making a 256-bit ECDSA signature over the secp256r1 curve (good and virtuous) and making a 256-bit ECDSA signature over the secp256k1 curve (aka the scoundrel's curve)