What got Sony's playstation 3 pwned?

from ecdsa import SigningKey, SECP256k1, util
from hashlib import sha256

# https://ecdsa.readthedocs.io/en/latest/quickstart.html#getting-started
# Not to be used in production obviously

msg1 = b"hello alice"
msg2 = b"How are you doing today?"
with open("msg1.txt", "wb") as f:
    f.write(msg1)
with open("msg2.txt", "wb") as f:
    f.write(msg2)

hash_msg1 = int.from_bytes(sha256(msg1).digest(), "big")
hash_msg2 = int.from_bytes(sha256(msg2).digest(), "big")

signing_key_handler = SigningKey.generate(curve=SECP256k1)
verifying_key = signing_key_handler.verifying_key
secret_key = signing_key_handler.privkey.secret_multiplier
n = signing_key_handler.curve.order

with open("public.pem", "wb") as f:
    f.write(verifying_key.to_pem())

# BAD: Reused nonce
k = 0xBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBEEF

r = (signing_key_handler.curve.generator * k).x() % n
s1 = (pow(k, -1, n) * (hash_msg1 + r * secret_key)) % n
s2 = (pow(k, -1, n) * (hash_msg2 + r * secret_key)) % n

sig1_der = util.sigencode_der(r, s1, n)
sig2_der = util.sigencode_der(r, s2, n)

with open("sig1.der", "wb") as f:
    f.write(sig1_der)
with open("sig2.der", "wb") as f:
    f.write(sig2_der)

package main

import (
        "crypto/ecdsa"
        "crypto/elliptic"
        "crypto/rand"
        "crypto/sha256"
        "crypto/x509"
        "encoding/asn1"
        "encoding/pem"
        "fmt"
        "math/big"
        "os"
)

type ecdsaSignature struct {
        R, S *big.Int
}

func savePEM(filename string, der []byte, typ string) {
        block := &pem.Block{Type: typ, Bytes: der}
        os.WriteFile(filename, pem.EncodeToMemory(block), 0644)
}

func main() {
        curve := elliptic.P256()

        private_key, _ := ecdsa.GenerateKey(curve, rand.Reader)
        public_key := &private_key.PublicKey

        //      privBytes, _ := x509.MarshalECPrivateKey(priv)

        pubBytes, err := x509.MarshalPKIXPublicKey(public_key)
        if err != nil {
                panic(err)
        }

        //      savePEM("private.pem", privBytes, "EC PRIVATE KEY")
        savePEM("public.pem", pubBytes, "PUBLIC KEY")

        msg1 := []byte("hello alice")
        msg2 := []byte("What's good with you?")
        os.WriteFile("msg1.txt", msg1, 0644)
        os.WriteFile("msg2.txt", msg2, 0644)

        hash_msg1 := sha256.Sum256(msg1)
        hash_msg2 := sha256.Sum256(msg2)

        // BAD: static nonce reuse here
        k := new(big.Int)
        k.SetString("BADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBADBEEF", 16)
        n := curve.Params().N
        k.Mod(k, n)

        // r = (k*G).X mod n
        x, _ := curve.ScalarBaseMult(k.Bytes())
        r := new(big.Int).Mod(x, n)

        bytesToInt := func(hash []byte) *big.Int {
                return new(big.Int).SetBytes(hash)
        }

        kInv := new(big.Int).ModInverse(k, n)

        // s = k^-1 (hash_msg + r*d) mod n
        calcSig := func(hash []byte) *big.Int {
                tmp := new(big.Int).Mul(r, private_key.D)
                tmp.Add(tmp, bytesToInt(hash))
                tmp.Mod(tmp, n)
                s := new(big.Int).Mul(kInv, tmp)
                return s.Mod(s, n)
        }

        s1 := calcSig(hash_msg1[:])
        s2 := calcSig(hash_msg2[:])

        sig1Der, _ := asn1.Marshal(ecdsaSignature{r, s1})
        sig2Der, _ := asn1.Marshal(ecdsaSignature{r, s2})
        os.WriteFile("sig1.der", sig1Der, 0644)
        os.WriteFile("sig2.der", sig2Der, 0644)

        fmt.Println("[+] Signed messages with reused nonce k")
}

from ecdsa import SECP256k1, NIST256p, SigningKey, util
from hashlib import sha256
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec


def read_der_signature(path):
    with open(path, "rb") as f:
        sig_der = f.read()
    r, s = util.sigdecode_der(sig_der, SECP256k1.order)
    return r, s


def read_msg(path):
    with open(path, "rb") as f:
        return f.read()


def get_curve_from_pem(path):
    with open(path, "rb") as f:
        pub_key = serialization.load_pem_public_key(f.read(), backend=default_backend())

    if isinstance(pub_key.curve, ec.SECP256K1):
        print("[+] Detected curve: secp256k1")
        return SECP256k1
    elif isinstance(pub_key.curve, ec.SECP256R1):  # aka P-256
        print("[+] Detected curve: NIST P-256")
        return NIST256p
    else:
        raise ValueError("Unsupported curve")


msg1 = read_msg("msg1.txt")
msg2 = read_msg("msg2.txt")

hash_msg1 = int.from_bytes(sha256(msg1).digest(), "big")
hash_msg2 = int.from_bytes(sha256(msg2).digest(), "big")

r1, s1 = read_der_signature("sig1.der")
r2, s2 = read_der_signature("sig2.der")

# This is actually a visual indication of this problem.
# You will notice that the first parts of the signatures (the r) are the same
# for two different messages. This is because the same nonce k is used to calcualte
# the r part.
assert r1 == r2, "Reused nonce requires both signatures to have same r"
r = r1

curve = get_curve_from_pem("public.pem")
n = curve.order
k = ((hash_msg1 - hash_msg2) * pow(s1 - s2, -1, n)) % n
private_key = ((s1 * k - hash_msg1) * pow(r, -1, n)) % n

print(f"[+] Reused nonce (k): {hex(k)}")
print(f"[+] Recovered private key (d): {hex(private_key)}")

recovered_sk = SigningKey.from_secret_exponent(private_key, curve=curve)
with open("recovered_private.pem", "wb") as f:
    f.write(recovered_sk.to_pem())

evil_msg = b"ecdsa pwned"
evil_sig = recovered_sk.sign_deterministic(
    evil_msg, hashfunc=sha256, sigencode=util.sigencode_der
)

with open("evil.sig", "wb") as f:
    f.write(evil_sig)
with open("evil_msg.txt", "wb") as f:
    f.write(evil_msg)

print("[+] Recovered private key saved to recovered_private.pem")