Can one extract a private key from a series of carefully constructed signed messages? In a situation in which A handles a message P for B to sign using ECDSA, and that event repeats itself many times, is there a way A can discover B's private key?
A can carefully choose what will be P every time, and be confident that B is always the same person using the same key to sign.
Does it change anything if P is always a string of 32 bytes that B won't hash before signing, he will just sign directly -- as it would do with a message he had hashed himself.
It is not possible if the signature scheme is secure, under the standard notion of &quot;existential unforgeability under chosen message attacks&quot;. According to this definition, the adversary is given the public key and can then choose messages to be signed one after another. If it can forge any signature, then the scheme is not secure. As such, if the scheme is secure, it's not possible to form special messages that result in the key being revealed, or any other vulnerability.