<blockquote>
<p>Does the problem of repeating the value r still persist today in Bitcoin transactions?</p>
</blockquote>
<p>If your question is whether Bitcoin signatures are still vulnerable if their nonces are generated in a bad way: yes, absolutely. The security of the ECDSA scheme (and the Schnorr scheme introduced in <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki" rel="nofollow noreferrer">BIP340</a>) relies on signatures being created using nonces that are entirely unpredictable to attackers.</p>
<p>However, I do think it's fair to say that the software stacks used in Bitcoin software that constructs these signatures has matured so it occurs less in practice. Techniques like deterministic nonces as standardized in <a href="https://datatracker.ietf.org/doc/html/rfc6979" rel="nofollow noreferrer">RFC6979</a> makes it much easier to write safe implementations.</p>
<blockquote>
<p>If so, how can I find transactions that contain this thing?</p>
</blockquote>
<p>There are questions on this site that give more practical details, but in broad lines, you go over all the blockchain's transactions, group signatures by the public key they're created for, and within each group see if any R value is repeated. If so, you can generally compute the private key from the signatures.</p>
<p>Rest assured that any funds remaining in addresses whose keys can be retrieved this way are instantly stolen.</p>
<blockquote>
<p>I have research on how to protect digital assets.</p>
</blockquote>
<p>Use production-quality, well-reviewed, wallet software or libraries. They will produce signatures in secure way. If you're writing code yourself where bad nonces are a concern, you're almost certainly doing something wrong.</p>

CC BY-SA 4.0
2024-04-13T01:09:46.683Z
2024-04-13T19:23:29.343Z
2024-04-13T19:23:29.343Z
Pieter Wuille
<p>I want to ask a question: Does the problem of repeating the value r still persist today in Bitcoin transactions? If so, how can I find transactions that contain this thing? I have research on how to protect digital assets.</p>

<transactions><secp256k1><message-signing><security-key>
Is there still a digital signature loophole in Bitcoin transactions?
hisham yem
# Is there still a digital signature loophole in Bitcoin transactions?

(Asked by: username_0 on 2024-04-12)

I want to ask a question: Does the problem of repeating the value r still persist today in Bitcoin transactions? If so, how can I find transactions that contain this thing? I have research on how to protect digital assets.

**Tags:** transactions, secp256k1, message-signing, security-key


---

## 1 answers

### Answer by username_1 on 2024-04-13. Score: 6

> Does the problem of repeating the value r still persist today in Bitcoin transactions?

If your question is whether Bitcoin signatures are still vulnerable if their nonces are generated in a bad way: yes, absolutely. The security of the ECDSA scheme (and the Schnorr scheme introduced in [BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki)) relies on signatures being created using nonces that are entirely unpredictable to attackers.

However, I do think it's fair to say that the software stacks used in Bitcoin software that constructs these signatures has matured so it occurs less in practice. Techniques like deterministic nonces as standardized in [RFC6979](https://datatracker.ietf.org/doc/html/rfc6979) makes it much easier to write safe implementations.

> If so, how can I find transactions that contain this thing?

There are questions on this site that give more practical details, but in broad lines, you go over all the blockchain's transactions, group signatures by the public key they're created for, and within each group see if any R value is repeated. If so, you can generally compute the private key from the signatures.

Rest assured that any funds remaining in addresses whose keys can be retrieved this way are instantly stolen.

> I have research on how to protect digital assets.

Use production-quality, well-reviewed, wallet software or libraries. They will produce signatures in secure way. If you're writing code yourself where bad nonces are a concern, you're almost certainly doing something wrong.


---

