waxwing on Nostr: You probably know that ECDSA signatures in their default construction are malleable ...

You probably know that ECDSA signatures in their default construction are malleable (which caused problems in Bitcoin, earlier): if (r, s) is a valid signature on a message m, then so is (r, -s).

But did you know the reverse can be arranged to be true, using a party trick: you can generate a scenario where the same signature (r, s) signs two different messages m1, m2?

Like this: start in the usual way by choosing a nonce k, and calculating R and its x-coordinate r. Then, from m1, m2 and calculate the hashes h1 and h2 in the usual message hashing way. Then, construct the private key as x = -(h1 + h2)/2r. Then sign, say, m1 in the usual way as s = k^-1 (h1 + rx) and (r, s) will be a valid signature on both the messages m1, m2.

It's a party trick because you can only choose this special private key after already setting m1 and m2. But note that you can still keep signing other messages with that key, because you own it.

Like much other weirdness about ECDSA, this stems from the awkward element of the design: instead of committing to the R-value in a standard hashing step, you commit to it, separately from the message, with its x-coordinate (and even worse, you only encode the x-coordinate in the final signature, not the full curve point!).

#cryptography