Overview
The API endpoint returns two ECDSA-signed messages sharing the same public key. We must extract the keys and forge a valid signature for a target string.
Reconnaissance
Inspecting the API payload returns:
Message 1: Initialize Tannhaus Device, r = f8d47b6c...
Message 2: Calibrate Anomaly Thread, r = f8d47b6c...The signatures share the same r value. In ECDSA, this proves that the same nonce value k was reused to sign both messages.
Exploitation Strategy
Using the relationship:
k = (H(m1) - H(m2)) / (s1 - s2) mod n
We calculate the reused nonce k. We then derive the private key d:
d = (s1 * k - H(m1)) / r mod n
With the private key, we sign the target message unlock_the_knot and submit the signature to retrieve the flag.
Solution Code
# Run the repeated-k calculation script:
# k = ((h1 - h2) * pow(s1 - s2, -1, n)) % n
# d = ((s1 * k - h1) * pow(r, -1, n)) % n
# Generate signature (r_forge, s_forge) for target "unlock_the_knot"
# Flag: CrackOn{ecdsa_nonce_reuse_forged}Flag
CrackOn{ecdsa_nonce_reuse_forged}