ITADN
systemslibrarian/crypto-lab-ecdsa-forge
代码 动态 Issues 合并请求 版本
systemslibrarian/crypto-lab-ecdsa-forge · 文件
文件最后提交记录最后更新时间
README.md

crypto-lab-ecdsa-forge

What It Is

Browser-based ECDSA (Elliptic Curve Digital Signature Algorithm) demo with full protocol implementation on secp256k1 (Bitcoin, Ethereum) and P-256 (NIST, TLS). Uses @noble/curves for audited field arithmetic; all ECDSA protocol logic is implemented from scratch in this repository. Demonstrates the critical nonce reuse vulnerability that compromised the Sony PS3, Android Bitcoin wallets, and numerous other systems by performing real private key recovery from two signatures sharing a nonce. Shows RFC 6979 deterministic nonces as mitigation, verified against RFC 6979 Appendix A.2.5.

When to Use It

  • Understand why TLS certificates, Bitcoin transactions, and SSH/JWT verification rely on ECDSA.
  • Teach PS3 nonce reuse and Android wallet RNG failures with real math, not simulation.
  • Learn RFC 6979 deterministic nonce derivation and reproducible ECDSA signing behavior.
  • Compare legacy ECDSA pitfalls to safer modern signature defaults like Ed25519.
  • Not for production signing libraries; use @noble/curves or platform-native APIs in production.

Live Demo

systemslibrarian.github.io/crypto-lab-ecdsa-forge

The demo visualizes ECDSA on both a hand-checkable toy curve and real 256-bit keys: point addition (chord-and-tangent) and the k·G walk that makes the discrete-log gap tangible, a transparent two-equations / two-unknowns nonce-reuse attack that recovers a private key live with an explicit recovered-equals-victim proof, and RFC 6979 deterministic nonces shown as the mitigation. Every term is defined and every claim is cited to FIPS 186-5, SEC 1/2, RFC 6979, and the PS3 disclosure.

What Can Go Wrong

  • This demo uses @noble/curves for scalar multiplication and curve arithmetic. Production systems also need comprehensive side-channel controls and hardened key management.
  • The nonce reuse attack here is real. If two signatures share nonce k, private key recovery follows directly from modular arithmetic.
  • Browser JavaScript timing is noisy and can leak execution patterns; timing and fault attacks are out of scope but relevant in real signing oracles.
  • ECDSA signatures are malleable: both (r, s) and (r, n-s) can verify unless low-S normalization is enforced by protocol rules.

Real-World Usage

ECDSA is standardized in NIST FIPS 186-5 and SEC 2. It underpins TLS 1.2/1.3 certificates, Bitcoin, Ethereum, SSH ECDSA keys, secure boot chains, JWT ES256 tokens, and WebAuthn/passkeys. Global verification volume is massive (roughly 10^9+ checks daily). RFC 6979 (Pornin, 2013) deterministic nonces are now standard in mature ECDSA deployments to eliminate nonce entropy failures.

How to Run Locally

git clone https://github.com/systemslibrarian/crypto-lab-ecdsa-forge
cd crypto-lab-ecdsa-forge
npm install
npm run dev

Development

  • Install: npm install
  • Build: npm run build
  • Unit tests (Vitest): npm test
    • test/ecdsa.test.ts — real 256-bit sign/verify round-trips, forgery rejection, and the modular-arithmetic helpers, on both secp256k1 and P-256.
    • test/attack.test.ts — nonce-reuse key recovery equals the victim key exactly, the forged signature verifies under the victim public key, and recovery correctly refuses when nonces differ.
    • test/rfc6979.test.ts — deterministic-nonce reproducibility plus the RFC 6979 Appendix A.2.5 known-answer vector.
    • test/toycurve.test.ts — hand-checkable toy-curve group structure, ECDSA, and exhaustive nonce-reuse recovery across all (d, k, e1, e2).
  • Browser gate (Playwright): npm run test:a11y — runs both e2e/ suites against the production build (builds are gated on this in CI).
    • e2e/a11y.spec.ts — axe-core WCAG A/AA scan in both themes, every <details> expanded.
    • e2e/claims.spec.ts — the page's load-bearing claims, asserted against the rendered DOM: the recovered private key equals the victim key and derives the published public key, the captured signatures verify, the toy panel's integers are re-derived independently, every failure path (no key, no signature, tampered message, identical hashes, degenerate nonce, RFC 6979) is reached and explains itself, and the 18 plotted toy points plus 𝒪 account for the claimed order n = 19.

Teaching Features

  • Curve geometry, visualized — point addition over the reals (chord-and-tangent, plus doubling) and the same group as a finite field of points, with the k·G walk that makes the discrete-log gap tangible.
  • Transparent nonce-reuse attack — the two-equations / two-unknowns derivation, an interactive toy curve (y² = x³ + 2x + 2 mod 17, 18 affine points, prime group order 19) where every value is a hand-checkable small integer, and the same attack run live on real 256-bit keys with full values and an explicit recovered-equals-victim proof. On the toy curve the panel runs the actual verification equation on both captured signatures and on a fresh signature minted with the recovered key, so "the secret is exposed" is shown rather than asserted.
  • Glossary & primary sources — every term defined, every claim cited to FIPS 186-5, SEC 1/2, RFC 6979, and the PS3 disclosure.
  • Accessible & responsive — skip link, ARIA landmarks/live regions, keyboard-navigable, light/dark theme, reduced-motion support, and a mobile layout down to small screens.

License

Educational demo repository.

Part of the Crypto Lab suite.

"So whether you eat or drink or whatever you do, do it all for the glory of God." — 1 Corinthians 10:31