A Note on the Security of ECDSA with Presignatures or Biased Nonces

What it is

Couteau and Makriyannis, "A Note on the Security of ECDSA with Presignatures or Biased Nonces" (IACR ePrint 2026/2545, received 19 October 2026, approved 20 October 2026), is a note on ECDSA variants built for faster distributed signing. It is a minor revision of a paper in ASIACRYPT 2026. The page gives only the abstract and metadata, not the proofs or parameters.

Preconditions / Affected

The abstract says these variants are implemented in public libraries and used by companies, sometimes in commercially deployed products, without sound security foundations. It names no library, product or version. The variants are not known to reduce to the standard ECDSA game.

The abstract attributes the known vulnerabilities to Groth and Shoup (Eurocrypt 2022). They arise especially when a variant is combined with two features:

• raw signing, meaning signing hash digests directly rather than pre-hashed messages;
• additive key derivation.

What to do

The abstract states no patch, command or configuration change. The one check it supports is to find out whether a signing stack uses presignatures or biased nonces, and whether it also exposes raw digest signing or additive key derivation. Those are the combinations Groth and Shoup flagged.

Caveats

• The positive result covers only "some" of the variants used in the wild, and the abstract does not say which. Security is shown equivalent to the average-case hardness of k-SUM, in the generic group and random oracle model. That is a model-level argument, not a proof against all attacks.
• The lower bounds on generic group attacks against the other modes are conditional on fine-grained complexity conjectures. The abstract gives no concrete running times or security levels.