Surprise-Factor

hackthebox

Task: remote secp256r1 ECDSA signing oracle emits a per-operation side-channel trace of traceable bignum/EC functions; nonce is masked additively (k+mN) and multiplicatively (m2*k) and points use projective randomization. Solution: reverse the full parity-augmented h/a/s trace of the binary extended-GCD s-division using x1≡s*u, x2≡s*v (mod N) to recover the exact masked denominator b=m2*(k mod N), ECM-factor b, identify k via x(kG)==r over factor subsets, then recover d=(s*k-h)/r mod N.