← Back to CRACKON CTF

TANNHAUS ANOMALY

ECDSA Nonce Reuse (Repeated-k Attack) on secp256k1. Extract the shared r-value to solve for the private key and forge a valid signature.

Tools Used

PythonSageMathECDSA Cryptanalysis

Overview

The API endpoint returns two ECDSA-signed messages sharing the same public key. We must extract the keys and forge a valid signature for a target string.

Reconnaissance

Inspecting the API payload returns:

Message 1: Initialize Tannhaus Device, r = f8d47b6c...
Message 2: Calibrate Anomaly Thread, r = f8d47b6c...

The signatures share the same r value. In ECDSA, this proves that the same nonce value k was reused to sign both messages.

Exploitation Strategy

Using the relationship:

k = (H(m1) - H(m2)) / (s1 - s2) mod n

We calculate the reused nonce k. We then derive the private key d:

d = (s1 * k - H(m1)) / r mod n

With the private key, we sign the target message unlock_the_knot and submit the signature to retrieve the flag.

Solution Code

# Run the repeated-k calculation script:
# k = ((h1 - h2) * pow(s1 - s2, -1, n)) % n
# d = ((s1 * k - h1) * pow(r, -1, n)) % n
# Generate signature (r_forge, s_forge) for target "unlock_the_knot"
# Flag: CrackOn{ecdsa_nonce_reuse_forged}

Flag

CrackOn{ecdsa_nonce_reuse_forged}