Adaptation and analytical overview: This paper presents a systematic cryptanalytic overview of the Dark Skippy attack, structured according to the official disclosure (darkskippy.com Authors: L. Fournier, N. Farrow, R. Linus (2024)) with additional historical parallels and examples from the field of cryptanalysis.
Abstract. This paper presents a detailed cryptanalytic analysis of the Dark Skippy attack—a method for exfiltrating the master seed of a hardware wallet by manipulating the nonce used to generate Schnorr (and ECDSA) signatures. It is shown that previously known estimates requiring dozens of signatures to recover the seed can be radically revised: only two signatures are sufficient for complete compromise. The mathematical framework is considered, including the use of discrete logarithms in the elliptic curve group secp256k1, the Pollard-Kangaroo algorithm, and blinding and watermarking methods. Real-world examples from the history of cryptanalytic attacks on hardware wallets are given, including attacks on predetermined seeds and predetermined nonces. Existing and promising countermeasures are discussed.
1. Introduction
Hardware wallets are traditionally considered the gold standard of security in the cryptocurrency ecosystem due to the isolation of private keys from a potentially compromised host. However, trust in hardware relies on the assumption that the device’s firmware is trustworthy and free of malicious code. The Dark Skippy attack , uncovered in 2024 by Lloyd Fournier, Nick Farrow, and Robin Linus, demonstrates that even a single use of a compromised signing device can lead to the complete loss of funds.[reference:0]
Dark Skippy’s key innovation is that the malicious device embeds fragments of the master seed directly into the ephemeral secret nonces ( r ) used to generate signatures. Previously, it was thought that such exfiltration required dozens of transactions; the authors demonstrated that just two signatures are sufficient [reference:1]. This fundamentally changes the threat model: now even short-term access to the device or a single installation of malicious firmware can lead to catastrophic consequences.
Historical context: In 2018, an attack on counterfeit Trezor hardware wallets was detected, in which the attackers pre-installed a predetermined seed (predetermined seed attack)[reference:2]. Unlike that attack, Dark Skippy doesn’t require the user to use a device-generated seed—it even works with a user-provided seed[reference:3]. This makes it significantly more dangerous.
2. Taxonomy of attacks on signing devices
To understand Dark Skippy’s place among other attack vectors on hardware wallets, the authors propose a classification based on which component of the signature algorithm is compromised [reference:4]. Let’s look at the main types.
| Attack type | Compromised component | Description | A practical example |
|---|---|---|---|
| Predetermined seed | Seed generation | The device produces a seed known in advance to the attacker. | Fake Trezor (Kaspersky, 2018)[reference:5] |
| Malicious xpub | Public key / xpub | The device replaces xpub, directing funds to the attacker’s addresses | Theoretical attack, requires verification on an independent device[reference:6] |
| Predetermined nonce | Nonce ( r ) | Using a nonce known to the attacker → calculating the secret key | Classic nonce reuse attack in ECDSA (e.g. PlayStation 3 key leak) |
| Nonce grinding | Public nonce ( R ) | Embedding the seed bit into a public nonce and then grinding it | Previously considered the main one, but required many signatures[reference:7] |
| Dark Skippy | Secret nonce ( r ) | Low-entropy seed embedding in r + DLP solution | Demonstration on two signatures (2024)[reference:8] |
As can be seen from the table, Dark Skippy occupies a special place: unlike a predetermined nonce, the attacker does not know r in advance , but can recover it by solving the discrete logarithm problem due to its low entropy[reference:9].
3. Mathematical apparatus of the Dark Skippy attack
3.1 Schnorr and ECDSA signatures
The attack is based on the standard Schnorr signature protocol (a similar approach applies to ECDSA). Let x be the secret key, and X = x⋅G be the public key. To sign message m :
1. Выбор случайного секретного nonce: r ←$ ℤn
2. Вычисление публичного nonce: R = r⋅G
3. Вычисление хеш-вызова: c = H(X || R || m)
4. Вычисление ответа: s = r + c⋅x (mod n)
5. Подпись: σ = (R, s)
In ECDSA, the scheme is similar, but with a different equation: s = k⁻¹ (H(m) + x⋅R_x) . However, the principle of the attack remains the same: if nonce r (or k ) has low entropy, it can be recovered by solving the discrete logarithm problem.
3.2. Data embedding principle
Instead of a random r, the malicious device uses a fragment of the master seed. For a 12-word seed (16 bytes of entropy), the device splits it into two 8-byte chunks[reference:10]:
seed = seed[0:8] || seed[8:16]
r₁ = seed[0:8] (для первой подписи)
r₂ = seed[8:16] (для второй подписи)
More sophisticated implementations use blinding using the attacker’s secret key and a watermark to identify compromised transactions in the mempool[reference:11].
Example from the demo: The authors’ working example[reference:12] uses blinding:
r₁ = (seed[0:9]) ⋅ H(SECRET || TXID || 0)
r₂ = (seed[9:16] || watermark-counter) ⋅ H(SECRET || TXID || 1)
Here SECRET is the blinding key known to the attacker, TXID is the transaction identifier, and the watermark counter allows for attack detection[reference:13].
3.3. Nonce recovery via discrete logarithm
An attacker, having discovered a transaction with suspicious public nonces R₁ and R₂ in the mempool , removes blinding (if it was applied) and obtains the points D₁ = r₁⋅G and D₂ = r₂⋅G . Then it is necessary to solve the discrete logarithm problem:
Найти r₁ такое, что r₁⋅G = D₁
Найти r₂ такое, что r₂⋅G = D₂
Since r₁ and r₂ are only 8–9 bytes (64–72 bits) long, the problem can be solved in reasonable time using Pollard’s Kangaroo algorithm [reference:14]. The expected running time for a 72-bit space is on the order of O(√n) = 2³⁶ operations, which is feasible on modern hardware[reference:15].
Real-world example: In 2013, an attack on Android’s random number generator was demonstrated, where insufficient entropy allowed the recovery of Bitcoin wallet private keys. However, this required analyzing thousands of transactions. Dark Skippy demonstrates that with active interference in the nonce generation process, just two signatures are sufficient.
4. Cryptanalytic performance evaluation
4.1 Complexity of recovery
Let the seed entropy be E bits. By embedding b bits in each nonce and using t signatures, the total number of extractable bits is b⋅t . For full recovery , b⋅t ≥ E is required . In the basic version of Dark Skippy , b = 64 , t = 2 , E = 128 .
The complexity of solving DLP for each nonce is O(2^{b/2}) batch multiplication operations. For b = 64 , this is 2³² ≈ 4.3⋅10⁹ operations, which is feasible in hours on a modern CPU. For b = 72 (with watermark), this is 2³⁶ ≈ 6.9⋅10¹⁰ , which is more resource-intensive but still achievable [reference:16].
4.2. Blinding and watermarks
To increase stealth, an attacker can:
- Blinding: Multiply the embedded data by a secret key known only to the attacker. This prevents other researchers from recovering the seed, even if they discover an anomaly [reference:17].
- Watermark: Add a special mark (e.g. a hash of SECRET and R₂) to the nonce to allow for quick identification of compromised transactions in the mempool[reference:18].
In the authors’ demonstration, the watermark is implemented by checking H(SECRET || R₂) for leading zero bytes[reference:19].
5. Comparison with known attacks
| Characteristic | Nonce grinding | Predetermined nonce | Dark Skippy |
|---|---|---|---|
| Required number of signatures | Dozens | One | Two |
| Required computations for an attacker | High (grinding) | Low (algebra) | Medium (Pollard’s Kangaroo) |
| Detectability | Theoretically possible | Low | Extremely low |
| Master seed exfiltration | Yes | No (only individual keys) | Yes |
| Vulnerability for stateless devices | No | No | Yes |
As can be seen from the comparison, Dark Skippy outperforms previous methods in a number of parameters: minimal number of signatures, full seed exfiltration, and applicability to stateless devices[reference:20][reference:21].
6. Examples from the history of cryptanalysis
Example 1: Attack on the PlayStation 3 (2010). The ECDSA implementation on Sony’s console used a fixed nonce value, k, for all signatures. This allowed attackers to deduce the private key used to sign firmware. Dark Skippy is a more sophisticated version of this idea: the nonce is not fixed but contains fragments of the seed, making the attack significantly less noticeable.
Example 2: Key leak due to a poor RNG (2013). A vulnerability in Android’s random number generator allowed the recovery of Bitcoin wallet private keys, as some addresses used identical k values . Recovery required analyzing a large number of transactions. Dark Skippy demonstrates that with device control, a similar result can be achieved with just two signatures.
Example 3: Attack on Ledger hardware wallets (2020). Researchers discovered that under certain conditions, it’s possible to extract the seed from the microcontroller through side-channel analysis. Dark Skippy uses a software-based rather than hardware-based attack vector, making it more accessible to a wider range of attackers.
7. Countermeasures and protection
7.1. Hardware measures
The main line of defense is preventing the loading of malicious firmware[reference:22]:
- Secure boot and locked JTAG/SWD interfaces .
- Physical protection of the device (access restrictions, safes).
- Firmware verification via open source codes and manufacturer digital signatures[reference:23].
7.2. Protocol measures
The most effective protocol solution is anti-exfil protocols , where the host wallet introduces additional randomness into the signing process, preventing the device from solely controlling the nonce[reference:24]:
- Implementation in the secp256k1-zkp library (for ECDSA)[reference:25].
- Supported by Blockstream Jade and ShiftCrypto BitBox devices [reference:26].
- Work is underway to adapt it to Schnorr signatures[reference:27].
An alternative approach is deterministic nonces (RFC 6979) , however, as the authors note, checking them on every signing is impractical, and a malicious device can conditionally switch between modes[reference:28][reference:29].
7.3. Promising solutions
The authors propose randomizing the nonce hash using PSBT fields, which would make Dark Skippy impossible [reference:30]. The use of protocols like Purify from MuSig-DN with zero-knowledge proofs of nonce determinism is also discussed [reference:31].
8. Conclusion
The Dark Skippy attack represents a significant breakthrough in cryptanalytic attacks on hardware wallets. Previously established strength estimates (requiring dozens of signatures for exfiltration) have been shown to be untenable: just two signatures are enough for an attacker to recover the master seed. This makes the implementation of protocol countermeasures, such as anti-exfil, critical, especially for Schnorr signatures, which are being actively implemented in the Bitcoin ecosystem (e.g., Taproot).
From a cryptanalytic perspective, Dark Skippy illustrates a fundamental principle: even if signatures appear to be valid, manipulating the nonce’s entropy opens an information leakage channel that can be used to completely compromise the system. This underscores the need to revisit threat models for hardware wallets and develop formal methods for verifying the validity of nonce generation.
Bibliographic references:
Dark Skippy: Cryptanalysis of the key exfiltration method via nonce: https://nordai.ru/dark-skippy-cryptanalysis-of-the-key-exfiltration-method-via-nonce/
[1] L. Fournier, N. Farrow, R. Linus. Dark Skippy Disclosure: A Powerful Method for Key Exfiltration from Hardware Wallets . 2024. URL: https://darkskippy.com/
[2] Blockstream. Anti-Exfil: Stopping Key Exfiltration . https://blog.blockstream.com/anti-exfil-stopping-key-exfiltration/
[3] ShiftCrypto. Anti-Klepto Explained: Protection Against Leaking Private Keys . https://bitbox.swiss/blog/anti-klepto-explained-protection-against-leaking-private-keys/
[4] Bitcoin-Dev Mailing List. Anti-exfil protocol discussion . March 2020. https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-March/017667.html