george0papasotiriou/cve-2026-21009-ecdsa-nonce-reuse-in-iot-firmware-signing
# ecdsa_nonce_reuse_sim.py - Signing firmware with repeated nonce (k)
import ecdsa, hashlib
sk = ecdsa.SigningKey.generate(curve=ecdsa.NIST256p)
vk = sk.get_verifying_key()
# Sign two different firmware images with same nonce due to bad RNG
# In reality, this can happen with deterministic k if seed is constant.
# We'll simulate by using the same k manually (not possible with ecdsa library, so fake it)
def sign_with_fixed_k(sk, msg_hash, k):
# Simplified: return signature (r,s) using fixed k (for educational purposes)
# Not actual ECDSA, but shows concept.
r = (k * ecdsa.NIST256p.generator).x()
k_inv = pow(k, -1, ecdsa.NIST256p.order)
s = k_inv * (int.from_bytes(msg_hash, 'big') + r * sk.privkey.secret_multiplier) % ecdsa.NIST256p.order
return ecdsa.ecdsa.Signature(r, s)
msg1 = b"Firmware v1.0"
msg2 = b"Firmware v2.0"
h1 = hashlib.sha256(msg1).digest()
h2 = hashlib.sha256(msg2).digest()
# Use same k
k = 123456789
sig1 = sign_with_fixed_k(sk, h1, k)
sig2 = sign_with_fixed_k(sk, h2, k)
print("Two signatures with same k. Attacker can recover private key from (r,s1) and (r,s2).")
An IoT device signs firmware updates using ECDSA, but due to a weak random number generator, the same nonce (k) is reused for two signatures. An attacker who observes both signatures can compute the private key and sign malicious firmware.
k, the private key can be derived algebraically.Run the simulation:
pip install ecdsa
python ecdsa_nonce_reuse_sim.py
The script demonstrates the creation of two signatures with the same k. A real attacker would recover the key using the formula k = (h1 - h2) / (s1 - s2) and then d = (s1*k - h1) / r.