EPFL - I&C - ISC - LASEC
Station 14 - Building INF
Tel. +41 21 693 7603
Fax. +41 21 693 7689
Ref: Vau03aThe Security of DSA and ECDSASerge VaudenayPublished:
Advances in Cryptology PKC'03, Miam, Florida, USA, Lecture
Notes in Computer Science No. 2567 et pp. 309-323
DSA and ECDSA are well established standards for digital signature based on the discrete logarithm problem. In this paper we survey known properties, certification issues regarding the public parameters, and security proofs.
ECDSA also includes a standard certification scheme for elliptic curve which is assumed to guarantee that the elliptic curve was randomly selected, preventing from any potential malicious choice. In this paper we show how to bypass this scheme and certify any elliptic curve in characteristic two. The prime field case is also studied. Although this does not lead to any attack at this time since all possible malicious choices which are known at this time are specifically checked, this demonstrates that some part of the standard is not well designed. We finally propose a tweak.