<p>I believe this would be trivial to break.</p>
<p>Let's say that:</p>
<ul>
<li><em>z = z<sub>0</sub> + 2<sup>128</sup>z<sub>1</sub></em>, with 128-bit <em>z<sub>0</sub>, z<sub>1</sub></em>.</li>
<li><em>d = d<sub>0</sub> + 2<sup>128</sup>d<sub>1</sub></em>, with 128-bit <em>d<sub>0</sub>, d<sub>1</sub></em>.</li>
</ul>
<p>In that case, according to your construction, <em>k = d<sub>1</sub> + 2<sup>128</sup>z<sub>1</sub></em>.</p>
<p>For ECDSA signatures <em>(r,s)</em>:</p>
<ul>
<li>We know <em>s = k<sup>-1</sup>(z + rd) (mod n)</em> (the signing equation)</li>
<li>Put otherwise: <em>sk = z + rd (mod n)</em></li>
<li>Substituting the above: <em>s(d<sub>1</sub> + 2<sup>128</sup>z<sub>1</sub>) = z<sub>0</sub> + 2<sup>128</sup>z<sub>1</sub> + r(d<sub>0</sub> + 2<sup>128</sup>d<sub>1</sub>) (mod n)</em>.</li>
<li>Grouping: <em>rd<sub>0</sub> + (2<sup>128</sup>r - s)d<sub>1</sub> = 2<sup>128</sup>z<sub>1</sub>(s - 1) - z<sub>0</sub> (mod n)</em>.</li>
</ul>
<p>All variables in the last equation above except for <em>d<sub>0</sub></em> and <em>d<sub>1</sub></em> are known. Finding solutions for those restricted to range <em>[0,2<sup>128</sup>)</em> is a simple lattice reduction, which likely has at most a few solutions. Those can be tested exhaustively.</p>

CC BY-SA 4.0
2022-12-13T22:10:05.750Z
2022-12-14T19:36:16.970Z
2022-12-14T19:36:16.970Z
Pieter Wuille
<p>My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is designed  by private key 'd' to message hash z , such that: k = 128 MSB bit of z + 128 bit MSB of d (privatekey)
example:</p>
<p>d= private key in hex<br />
z= message hash<br />
k= nonce; where nonce is equal first 128 bit of z + 128 bit of d</p>
<p>d= 0x<strong>036ed4f5f383049827edc4fe337f46f8</strong>3a240b124242620b02b97552b2fc11a4<br />
z= <strong>f55ab477c48f9afaf1a72ab448bf96b4</strong>a05f336f7a1e27e08993308dfaa783b5<br />
k = f55ab477c48f9afaf1a72ab448bf96b4 + 036ed4f5f383049827edc4fe337f46f8<br />
k= 0xf55ab477c48f9afaf1a72ab448bf96b4036ed4f5f383049827edc4fe337f46f8</p>
<p>signature:<br />
r= 62326678398279634483781267842729177896577268934832461436294590773005653623297<br />
s= 78373122694400608572761948114834235891083358005495335895684705221713649603747<br />
z= 110976909682006680432155795488402189554785886863009729379902726621537291961269</p>
<p>I have searched the stack exchanges and various articles and research papers and have not found a workable solution to this problem. My own linear algebra is not as strong as I would like it (it's been a number of years), and my attempts have not been successful.</p>
<p>Is there any way to calculate k or privatekey?</p>
<p>N: Finite field of the secp256k1</p>

<cryptography><math>
weak transaction in secp256k1
Ironic
# weak transaction in secp256k1

(Asked by: username_0 on 2022-12-13)

My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is designed by private key 'd' to message hash z , such that: k = 128 MSB bit of z + 128 bit MSB of d (privatekey)
example:

d= private key in hex  
z= message hash  
k= nonce; where nonce is equal first 128 bit of z + 128 bit of d

d= 0x**036ed4f5f383049827edc4fe337f46f8**3a240b124242620b02b97552b2fc11a4  
z= **f55ab477c48f9afaf1a72ab448bf96b4**a05f336f7a1e27e08993308dfaa783b5  
k = f55ab477c48f9afaf1a72ab448bf96b4 + 036ed4f5f383049827edc4fe337f46f8  
k= 0xf55ab477c48f9afaf1a72ab448bf96b4036ed4f5f383049827edc4fe337f46f8

signature:  
r= 62326678398279634483781267842729177896577268934832461436294590773005653623297  
s= 78373122694400608572761948114834235891083358005495335895684705221713649603747  
z= 110976909682006680432155795488402189554785886863009729379902726621537291961269

I have searched the stack exchanges and various articles and research papers and have not found a workable solution to this problem. My own linear algebra is not as strong as I would like it (it's been a number of years), and my attempts have not been successful.

Is there any way to calculate k or privatekey?

N: Finite field of the secp256k1

**Tags:** cryptography, math


---

## 1 answers

### Answer by username_1 on 2022-12-13. Score: 5 | Accepted answer

I believe this would be trivial to break.

Let's say that:

* *z = z0 + 2128z1*, with 128-bit *z0, z1*.
* *d = d0 + 2128d1*, with 128-bit *d0, d1*.

In that case, according to your construction, *k = d1 + 2128z1*.

For ECDSA signatures *(r,s)*:

* We know *s = k-1(z + rd) (mod n)* (the signing equation)
* Put otherwise: *sk = z + rd (mod n)*
* Substituting the above: *s(d1 + 2128z1) = z0 + 2128z1 + r(d0 + 2128d1) (mod n)*.
* Grouping: *rd0 + (2128r - s)d1 = 2128z1(s - 1) - z0 (mod n)*.

All variables in the last equation above except for *d0* and *d1* are known. Finding solutions for those restricted to range *[0,2128)* is a simple lattice reduction, which likely has at most a few solutions. Those can be tested exhaustively.


---

