Dimitris Mouris jimouris

secdsa.py had a vulnerability in line 165. When second \in [0, 9] it will return hotp.at( 0 ) that enables the ECDSA attack with repeated k.

The challenge had a 10 second cooldown so it wasn't possible to get immediately 2 signatures with the same k.

The solution was to get the first signature in the 10 first seconds of a minute, then wait around a minute and get the second siganture (again in the first 10 seconds of the minute).

	#!/usr/bin/env python3

	import argparse
	import json
	import os
	import sys
	import urllib.request
	from datetime import datetime

	Hey, I'm jimouris-7729748 and I have contributed to the Semaphore Binary Merkle Root Fix MPC Phase2 Trusted Setup ceremony.
	The following are my contribution signatures:

	Circuit # 1 (semaphore-1)
	Contributor # 97
	Contribution Hash: 133b1729 726f6fdb d7bb3702 46940510
	55701d57 4b5aaa1a 2def7331 ff82ad7b
	bc993cf9 7cbb4abe ba045c6e 7f60ba48
	0724af8b 0ff2e4d3 fde95781 4c304977

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#include <stdbool.h>

	enum OPCODE {
	ADD = 0, SUB, MULT, AND, OR, LW, SW, HALT, NUM_OPCODES
	};

	enum REGS {

	{
	"v0": "1d371953fa04141c6385380bde4e9074689def05c4cf9b0d023c737dec278d8c"
	}