Casey secdev02

Shared Bits in secp###k1 Curves: A Cryptographic Vulnerability

This appears to be highlighting a significant cryptographic vulnerability in the secp256k1 and related elliptic curve implementations.

The Core Issue

The shared bit pattern 48ce563f89a0ed9414f5aa28ad0d96d6795f9c62 appears across multiple secp curves (160k1, 192k1, 224k1, 256k1), and as you noted, this looks suspiciously like a SHA-1 hash output.

Why This Is Problematic

Using Hard Links to point back to attacker controlled location.

mklink /h C:\Windows\System32\Tasks\tasks.dll C:\Tools\Tasks.dll
Hardlink created for C:\Windows\System32\Tasks\tasks.dll <<===>> C:\Tools\Tasks.dll

This can redirect the search to an arbitrary location and evade tools that are looking for filemods in a particular location.

xref: https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html

	#!/usr/bin/env python3
	"""
	Script to compute a public key on secp256k1 using a custom generator point.
	"""

	import hashlib
	import base58

	# secp256k1 curve parameters
	P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F # Field prime

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using System.Text;

	public class TestClass
	{

	public TestClass()
	{}

	# Create a directory to store our files


	$workingDir = "C:\ServiceTest"
	if (!(Test-Path $workingDir)) {
	New-Item -ItemType Directory -Path $workingDir
	}

	# Create the C# service code
	$serviceCode = @'

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Texas Hold'em Poker Simulator</title>
	<style>
	body {
	font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
	max-width: 1000px;

	#include <stdio.h>
	#include <windows.h>

	// rpc command ids
	#define RPC_CMD_ID_OPEN_SC_MANAGER 27
	#define RPC_CMD_ID_CREATE_SERVICE 24
	#define RPC_CMD_ID_START_SERVICE 31
	#define RPC_CMD_ID_DELETE_SERVICE 2

	// rpc command output lengths

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe pshell.xml -->
	<!-- Author: Casey Smith, Twitter: @subTee -->
	<!-- License: BSD 3-Clause -->
	<Target Name="Hello">
	<FragmentExample />
	<ClassExample />
	</Target>
	<UsingTask

	#!/usr/bin/env python3
	# Copyright 2024 Neil Madden.
	# License: https://creativecommons.org/licenses/by-sa/4.0/deed.en.

	# Like this? I do training courses & consultancy:
	# https://illuminated-security.com/

	import hashlib
	import math
	import os

	"""
	Bitcoin elliptic curve pub-key from priv-key in raw python, as dicusssed in the video

	https://youtu.be/RZzB-vPFYmo

	This is a follow-up to the previous video
	https://youtu.be/LYN3h5DjeXw

	This script is directly based off
	https://github.com/peterscott78/offline_signer/blob/master/ecdsa_keys.py