← Back to HWJ CTF

EC-DÉJÀ-VU

Recover ECDSA private key from reused nonce k across signatures and decrypt AES database payload.

Tools Used

PythonECDSA Nonce ReuseAES-CBCPyCryptodome

Overview

Reused ECDSA nonces (k) across signatures leak administrator private key d.

Reconnaissance

Extract signatures r, s1, s2, z1, z2. Calculate k = (z1 - z2) * (s1 - s2)^-1 mod n.

Exploitation Strategy

Recover private key d = (s1*k - z1) * r^-1 mod n, derive AES key SHA256(d), and decrypt payload.

Solution Code

k = ((z1 - z2) * pow(s1 - s2, -1, n)) % n
d = ((s1 * k - z1) * pow(r, -1, n)) % n
key = hashlib.sha256(str(d).encode()).digest()
cipher = AES.new(key, AES.MODE_CBC, iv)
print(unpad(cipher.decrypt(ct), 16).decode())

Flag

hwj{n0nc3_r3us3_m33ts_A3S_d3crypt10n}