Skip to content

feat: Add ECDSA signature vulnerability data #95

Description

@oritwoen

Summary

Extend boha to include ECDSA signature data for cryptographic research and vulnerability analysis.

Context

The btcsec ecosystem currently covers:

  • Key generation vulnerabilities (vuke)
  • ECDLP solving (kangaroo)
  • Hash databases (shaha)

Missing: Signature vulnerability data - known cases of weak ECDSA signatures that can be used for:

  1. Research and education
  2. Testing signature analysis tools
  3. Historical vulnerability documentation

Proposed Data Structure

pub struct VulnerableSignature {
    pub tx_id: String,
    pub address: String,
    pub r: [u8; 32],
    pub s: [u8; 32],
    pub z: [u8; 32],  // message hash
    pub vulnerability_type: VulnerabilityType,
}

pub enum VulnerabilityType {
    NonceReuse,
    BiasedNonce,
    LcgNonce,
    // ... future types
}

Data Sources

  • Known nonce reuse transactions from blockchain
  • Historical vulnerability cases (Android SecureRandom 2013, etc.)
  • CTF/puzzle signatures

Provider Pattern

Following existing boha patterns: boha:signatures:nonce-reuse

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions