Attack Lindell17

Overview

This repository contains a set of minimal, easy-to-reproduce attack demos. They showcase how an attacker can pick any base b they like and then craft nonce values of the form $k_2=b^\ell$. By doing this, the attacker can slowly leak the honest party’s key share through the signatures themselves. These attacks follow the ideas described in Paper [1] and apply to implementations of Lindell17 — a well-known two-party ECDSA protocol — as well as several of its variants.

• Lindell17 (+)
• Lindell17 (*)
• Refresh Lindell17 (+)
• Patched HD Lindell17

---

Implementation

This repository contains attack demos implemented in two languages:

• C++ demos:

  • Lindell17 (+)
  • Lindell17 (*)
  • Refresh Lindell17 (+)

• Go demo:

  • HD Lindell17 (based on OKX’s implementation)

The following two sections explain how to build and run them.

---

Running the C++ Attack Demos

Build the project

mkdir build && cd build
cmake ..
make

The executable is usually:

./AttackLin17

Select which attack to run

Edit main.cpp and uncomment the attack you want to execute:

// To run the attack on Lindell(*), uncomment the following line:
// run_lin17_mul_with_corrupted_p2();

// To run the attack on Lindell(+), uncomment the following line:
// run_lin17_plus_with_corrupted_p2();

// To run the attack on Refresh Lindell(+), uncomment the following line:
run_refresh_lin17_plus_with_corrupted_p2();

Rebuild and run:

make -j
./attack_lind17_demo

Modify the malicious nonce selection (Selected-k2 Attack)

Each demo exposes a file where you can change the base $b$ while $k_2 = b^{\ell}$:

• Lindell(+): lin17_plus/digit_by_digit_attack.cpp

• Lindell(*): lin17_mul/digit_by_digit_attack.cpp

• Refresh Lindell(+): lin17_mul/refresh_lin17_plus.cpp

Edit the file, adjust the parameter $b$, and rebuild.

---

Running the Golang Attack Demo

This patched HD Lindell17 attack demo is implemented in Go and is based on the open-source OKX threshold-lib. The attack is reproduced by modifying the behavior of the corrupted party (P2) inside the signing protocol, allowing the Selected-K2 Attack to be triggered in practice.

To run the attack:

cd tss/ecdsa/sign
go test -run TestEcdsaSignWithMaliciousP2_2

Note: This demo targets a specific historical commit of OKX’s threshold-lib and does not apply to the latest version of their open-source library on the master branch.

---

Disclaimer

This repository is intended solely for academic research and demonstration of known vulnerabilities in existing papers and implementations.

Do not use any of this code in production systems !!!

---

Reference

[1] Attacks on Implementations of Lindell 17 and Its Variants.