Partially known nonces and fault injection attacks on SM2 signature algorithm

Abstract

SM2 digital signature scheme, which is part of the Chinese public key cryptosystem standard SM2 issued by Chinese State Cryptography Administration, is based on the elliptic curve discrete logarithm problem. Since SM2 was made public, very few cryptanalytic results have been found in the literatures. In this paper, we discuss the partially known nonces attack against SM2. In our experiments, the private key can be recovered, given 100 signatures with 3 bits of nonces known for 256-bit SM2. We also provide a byte-fault attack on SM2 when a byte of random fault is injected on the secret key during the signing process.