Lattice Attack on Broken ECDSA Nonces with LLL Reduction
Mathematical Basis
Given signature pairs $(r_i, s_i)$ where $k_i = 2^8 a_i + b_i$ with known upper bits:
$$\sum_{i=1}^{m} t_i k_i \equiv 0 \pmod q$$
Using SageMath to construct the matrix:
PYTHON
from sage.all import Matrix, ZZ
M = Matrix(ZZ, m + 2, m + 2)
# fill matrix with weights and biases
reduced = M.LLL()FLAG SOLUTION // SPOILER
WHUB{lll_r3duct10n_n0nc3_b14s_3cds4}