<blockquote>
<p>How do I know if my signatures has leak/weak signatures?</p>
</blockquote>
<p>I guess you are looking for a method that determines this simply by analysing the signatures themselves. I don't know how I would do that and suspect it might involve reading a number of scholarly articles on the subject and developing a much deeper understanding of the mathematics than I have (or want). It has been done though - I believe people claim to have identified Bitcoin signatures in the blockchain that exhibit this fault. Their software is probably available. It seems that most of these weak/leaky signatures were signatures that were generated with some manual intervention and apparently not by well-known wallet software used in the intended way by most people.</p>
<p>For me, a simpler way to check is by checking how the nonce is chosen by the particular software you used to make those signatures. I believe you need to ensure that the nonce was chosen randomly using a good source of randomness <em>or is indistinguishable from that by an attacker who lacks the private-key</em>. I believe a new such nonce <em>must</em> be used for each signature.</p>
<p>If we take, for example, Bitcoin Core. In <a href="https://bitcoin.stackexchange.com/q/32928/13866">How to specify ECDSA nonce used in bitcoin signing code?</a> the answer pointed out <a href="https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92" rel="nofollow noreferrer">the source</a>, which I find contains</p>
<pre><code>prng.Generate((unsigned char*)&amp;nonce, 32);
</code></pre>
<p>Which looks encouraging to me. Though I'm certainly no expert on the subject of ECDSA and key leakage. I guess I'd also have to look at the source for any older versions I have used.</p>
<p>That answer also says</p>
<blockquote>
<p>libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.</p>
</blockquote>
<p>See</p>
<ul>
<li><a href="https://bitcoin.stackexchange.com/q/84055/13866">Nonce usage in ECDSA signing algorithm</a></li>
<li><a href="https://www.rfc-editor.org/rfc/rfc6979" rel="nofollow noreferrer">RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)</a></li>
<li><a href="https://www.google.com/search?q=bitcoin+signature+nonce+leak" rel="nofollow noreferrer">https://www.google.com/search?q=bitcoin+signature+nonce+leak</a></li>
</ul>
<hr />
<blockquote>
<p>Is there a website [which provides a signature checking service]</p>
</blockquote>
<p>I don't know of one. There is also a rule here that <em>discourages</em> me from recommending websites:</p>
<blockquote>
<p>Questions seeking product or service reviews are off-topic because they tend to attract subjective, low-quality, and spam answers. On the other hand, offerings in the Bitcoin space are still evolving rapidly which often renders answers outdated quickly.</p>
</blockquote>
<p>which refers to a discussion at this site's &quot;META&quot; site: <a href="https://bitcoin.meta.stackexchange.com/q/221/13866">How should questions that function like reviews be handled?</a></p>

CC BY-SA 4.0
2022-10-01T11:52:07.543Z
Note that RFC6979 does *not* generate random nonces. It generates nonces that are indistinguishable from random to an attacker which does not know the provate key, which is sufficient, and far less error prone than actually using fresh randomness for each signature.
Pieter Wuille
CC BY-SA 4.0
2022-10-01T13:05:49.590Z
@Pieter, thanks. Answer updated slightly.
RedGrittyBrick
CC BY-SA 4.0
2022-10-01T09:50:25.957Z
2022-10-01T13:05:07.807Z
2022-10-01T13:05:07.807Z
RedGrittyBrick
<p>How do I know if my signatures  has leak/weak signatures?</p>
<p>Is there a website or script where I can input my signatures to check for weak/leak Nonce part?</p>

<script><signature>
What are Known Bits in a bitcoin Transaction?
Roy Nahar
# What are Known Bits in a bitcoin Transaction?

(Asked by: username_0 on 2022-09-30)

How do I know if my signatures has leak/weak signatures?

Is there a website or script where I can input my signatures to check for weak/leak Nonce part?

**Tags:** script, signature


---

## 1 answers

### Answer by username_1 on 2022-10-01. Score: 0

> How do I know if my signatures has leak/weak signatures?

I guess you are looking for a method that determines this simply by analysing the signatures themselves. I don't know how I would do that and suspect it might involve reading a number of scholarly articles on the subject and developing a much deeper understanding of the mathematics than I have (or want). It has been done though - I believe people claim to have identified Bitcoin signatures in the blockchain that exhibit this fault. Their software is probably available. It seems that most of these weak/leaky signatures were signatures that were generated with some manual intervention and apparently not by well-known wallet software used in the intended way by most people.

For me, a simpler way to check is by checking how the nonce is chosen by the particular software you used to make those signatures. I believe you need to ensure that the nonce was chosen randomly using a good source of randomness *or is indistinguishable from that by an attacker who lacks the private-key*. I believe a new such nonce *must* be used for each signature.

If we take, for example, Bitcoin Core. In [How to specify ECDSA nonce used in bitcoin signing code?](https://bitcoin.stackexchange.com/q/32928/13866) the answer pointed out [the source](https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92), which I find contains

```
prng.Generate((unsigned char*)&nonce, 32);

```

Which looks encouraging to me. Though I'm certainly no expert on the subject of ECDSA and key leakage. I guess I'd also have to look at the source for any older versions I have used.

That answer also says

> libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.

See

* [Nonce usage in ECDSA signing algorithm](https://bitcoin.stackexchange.com/q/84055/13866)
* [RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)](https://www.rfc-editor.org/rfc/rfc6979)
* <https://www.google.com/search?q=bitcoin+signature+nonce+leak>

---

> Is there a website [which provides a signature checking service]

I don't know of one. There is also a rule here that *discourages* me from recommending websites:

> Questions seeking product or service reviews are off-topic because they tend to attract subjective, low-quality, and spam answers. On the other hand, offerings in the Bitcoin space are still evolving rapidly which often renders answers outdated quickly.

which refers to a discussion at this site's "META" site: [How should questions that function like reviews be handled?](https://bitcoin.meta.stackexchange.com/q/221/13866)

> **Comments:**
> **username_2**: Note that RFC6979 does *not* generate random nonces. It generates nonces that are indistinguishable from random to an attacker which does not know the provate key, which is sufficient, and far less error prone than actually using fresh randomness for each signature.  
> **username_1**: @username_2, thanks. Answer updated slightly.  

---

