Sony PlayStation 3 ECDSA Nonce Reuse

Incident Overview

At 27C3 in December 2010, fail0verflow demonstrated that Sony used a constant value for the random nonce k in ECDSA code signatures. Given two signatures with the same nonce, simple algebra yields the master private key.

Technical Root Cause Analysis

Sony developers hardcoded the random nonce parameter k in ECDSA signature generation to a static constant value across all system software updates.

• ECDSA Equation: Signature consists of $r = (k cdot G)_x pmod n$ and $s = k^{-1}(z + r cdot d) pmod n$.
• Constant Nonce Flaw: If $k$ is constant, $r_1 = r_2$. Given two signatures $(r, s_1)$ and $(r, s_2)$ for messages $z_1, z_2$:
• Math Derivation: $s_1 - s_2 = k^{-1}(z_1 - z_2) implies k = rac{z_1 - z_2}{s_1 - s_2} pmod n$.
• Private Key Recovery: $d = r^{-1}(s_1 cdot k - z_1) pmod n$. Attacker recovers private key $d$ instantly.

ECDSA Private Key Recovery from Constant Nonce

def recover_ecdsa_private_key(z1, z2, s1, s2, r, n):
    # k = (z1 - z2) / (s1 - s2) mod n
    k = ((z1 - z2) * pow(s1 - s2, -1, n)) % n
    # d = (s1 * k - z1) / r mod n
    d = ((s1 * k - z1) * pow(r, -1, n)) % n
    return d

Incident Timeline