Is/1481 improve randomness and ecdsa signatures

[PropzSaladaz]

Improve enclave randomness and harden ECDSA signing

Summary

Fixes a concurrency flaw in the enclave RNG that could cause ECDSA nonce reuse, corrects the nonce scalar domain, and hardens signing/verification edge cases. All changes are on the nonce-generation and internal-validation paths; signature output remains standard secp256k1 ECDSA.

Changes

RNG — fix concurrency race

• get_global_random now reads directly from the hardware DRNG (sgx_read_rand) on every call, and fails closed (aborts) on any RNG error.
• Removes the previous construction — a process-wide SHA256(seed ‖ counter) PRG whose counter used a non-atomic read-modify-write. Under the enclave's multi-TCS threading, two concurrent callers could observe the same counter and derive identical randomness → reused ECDSA nonces.

ECDSA nonce — correct scalar domain

• Nonce k is now reduced against the group order n (was the field prime p) using rejection sampling to a uniform value in [1, n-1], eliminating modulo bias and the zero-nonce case.

ECDSA signing — robustness

• Retry on a non-invertible k (mpz_invert return now checked) and on s == 0, alongside the existing r == 0 retry.

ECDSA verification — stricter input validation

• Fixed the r/s range check in signature_verify (&& → ||), which was previously a no-op, so out-of-range values are now correctly rejected.

Tests

• Added a concurrency distinctness test: repeated bursts of parallel key generation must never produce a colliding public key.

Backward compatibility

• No impact on existing signatures. The nonce is never an input to verification, so previously produced signatures remain valid and all output stays standard ECDSA. The one verification-side change only tightens rejection of already-invalid (out-of-range) signatures and affects the enclave's internal verifier, not external validators.

[Copilot]

Pull request overview

This PR hardens SGX enclave ECDSA signing by fixing the enclave RNG concurrency design, correcting ECDSA nonce generation to the proper scalar domain, and tightening signing/verification edge-case handling to reduce the risk of nonce reuse and invalid-signature acceptance.

Changes:

• Replace the previous global seed+counter SHA256 PRG with direct sgx_read_rand usage (plus init-time RNG self-test) to avoid concurrency-driven repetition.
• Update ECDSA signing to generate nonce k uniformly in [1, n-1] via rejection sampling, and add retries for non-invertible k and s == 0.
• Fix ECDSA verification range checking (r/s) and add an integration test that stresses concurrent key generation distinctness.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/integration/keys/ECDSAIntegrationTests.cpp	Adds a parallel keygen “distinctness under contention” integration test.
secure_enclave/Signature.c	Hardens ECDSA nonce selection and signing retry logic; fixes verifier range check logic.
secure_enclave/secure_enclave.c	Switches RNG to direct sgx_read_rand, adds RNG self-test at init, removes old global PRG state.
secure_enclave/EnclaveCommon.h	Removes the exported globalRandom declaration consistent with RNG refactor.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.