We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported and must be performed outside of the secure element.
Assuming the signature is the following:
d=private key
R = k.G = Q (unique random key, TRNG sourced inside secure element, can only be used once), and
S = k + d . H( Q | P | M )
The steps would be the followings:
- generate and get Q and get Q and P as output from secure element
- calculate and reinject H(Q | P | M) in secure element
- finalize and output S = k + d . H( Q | P | M )
Assuming the secure element functions as an oracle, and an attacker can inject H( Q | P | M ) = "1" and thus extract k + d (It cannot inject H( Q | P | M ) = "0" with same k, it changes all the time), without limitation, would d be vulnerable ? Has anyone read some discussions on that subject ?
For sake of clarity, note that our goal is to evaluate the possibility to guess the private key (d) which is hidden in a secure element, with unlimited possibility to calculate S=k + d*(any_integer_you_choose) . The secure element can only perform scalar multiplications, generate pseudo random (k) but unfortunately not some specific hash functions. It must thus be calculated outside and re-injected, thus potentially opening up vulnerabilities.
For this exercise, we assume the secure elements that hides (d) can perform unlimited S calculations whatever (H) is, and is in the hand of the attacker with full access to cryptographic calculations on S= k + dH. The attacker cannot control k, which is generated inside the secure element, used only once, and is ever hidden. On the other hand, the attacker can ignore (Q | P | M) and can choose any (H) to send to the secure element to calculate S= k+d.H, thus choosing H=0,1,2,3.. for example, and getting S1=k1+d1, S2=k2+d*2, etc.....in return, with no limitation of tries. Even if always obfuscated by the different random k, can that help you guess (d)?....
(You could ask then: if the attacker has access to calculations on (d), then its like having (d). Well not exactly as an attacker could secretly extract (d), and wait for a use case later in time)
