# Key Extraction Attacks on Threshold ECDSA Implementations **URL:** \ **Category:** Developers\ **Created:** [December 15, 2021, 1:26am UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676 "2021-12-15T01:26:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lastmjs](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lastmjs/32/3406_2.png) [@lastmjs](https://forum.dfinity.org/u/lastmjs)\ **Post date:** [December 15, 2021, 1:26am UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/1 "2021-12-15T01:26:29Z")
I just want to make sure the community is aware of this attack discovered on Threshold ECDSA implementations: [https://twitter.com/OmerShlomovits/status/1470747585132519430](https://twitter.com/OmerShlomovits/status/1470747585132519430) Not sure if it affects our upcoming implementation. ---
**Author:** ![diegop](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/diegop/32/569_2.png) [@diegop](https://forum.dfinity.org/u/diegop)\ **Post date:** [December 15, 2021, 7:03am UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/2 "2021-12-15T07:03:17Z")
Not sure, I’ll ping the folks working on this. ---
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [December 15, 2021, 8:48am UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/3 "2021-12-15T08:48:31Z")
Hi @lastmjs! I had a quick look at the paper yesterday. It looks to me that the attack does NOT apply to the protocol we are implementing. The attack applies to an optimisation of a scheme that uses ZK range proofs to ensure the correctness of additive shares of a product of two committed value. In the optimised protocol the range proofs are dropped and replaced with less expensive checks. However, this seems to leak some information which can be exploited by an attacker to progressively extract bits of the secret key (I haven’t verified the details of the papers though). In our protocol we use a different approach. We also compute shares of products of previously shared values, but we do include a ZK proof for the correctness of this product. We don’t need to use expensive range proofs for this, since we use homomorphic commitment schemes (e.g. Pedersen commitments) which support efficient ZK proofs for multiplicative relations of committed values. ---
**Author:** ![Manu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/manu/32/3999_2.png) [@Manu](https://forum.dfinity.org/u/Manu)\ **Post date:** [December 15, 2021, 1:49pm UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/4 "2021-12-15T13:49:43Z")
Thanks for the heads up @lastmjs! ---
**Author:** ![victorshoup](https://avatars.discourse-cdn.com/v4/letter/v/3ec8ea/32.png) [@victorshoup](https://forum.dfinity.org/u/victorshoup)\ **Post date:** [December 15, 2021, 2:30pm UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/5 "2021-12-15T14:30:48Z")
I’ll just echo @andrea’s reply, which is basically that the attacks in that paper are on protocol elements that are not at all present in our protocol. We are working on a document that describes our protocol in detail, including proofs of security. It is basically done, but not quite ready for public release. It should be publicly available in a few weeks…certainly before we release the tECDSA feature itself. ---
**Author:** ![lastmjs](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lastmjs/32/3406_2.png) [@lastmjs](https://forum.dfinity.org/u/lastmjs)\ **Post date:** [December 15, 2021, 2:56pm UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/6 "2021-12-15T14:56:21Z")
Awesome, thanks everyone! ---
**Author:** ![flyq](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/flyq/32/3637_2.png) [@flyq](https://forum.dfinity.org/u/flyq)\ **Post date:** [December 21, 2021, 7:36am UTC](https://forum.dfinity.org/t/key-extraction-attacks-on-threshold-ecdsa-implementations/9676/7 "2021-12-21T07:36:02Z")
more info about the attack on Threshold ECDSA > **["Alpha-Rays" behind the scenes - HackMD](https://hackmd.io/@omershlo/Sk_8JT-qt)** > > \# "Alpha-Rays" behind the scenes In a recently published \[paper\](https://eprint.iacr.org/2021/162