<blockquote>
<p>In what way, if any, can all of the signing parties verify that the nonce is both random</p>
</blockquote>
<p>By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce.</p>
<p>Even better, use a deterministic random nonce algorithm like RFC6979, which computes the nonce as a hash of the message and the private key. Since nobody else knows your private key (otherwise there is nothing left for them to learn...), this means the attacker can't get the nonce either.</p>
<blockquote>
<p>and not shared?</p>
</blockquote>
<p>Well by not sharing it with anyone, like you don't share your private key.</p>
<blockquote>
<p>Is this completely up to the signature implementation</p>
</blockquote>
<p>Yes, every (decent) ECDSA/Schnorr implementation does all of this internally.</p>
<blockquote>
<p>in the signature setup</p>
</blockquote>
<p>It happens at signing time, not at setup time.</p>
<blockquote>
<p>or is it bitcoin protocol specific?</p>
</blockquote>
<p>No.</p>

CC BY-SA 4.0
2023-01-21T15:01:47.160Z
2023-01-21T15:01:47.160Z
Pieter Wuille
<p>Original: <a href="https://bitcoin.stackexchange.com/questions/116825/can-a-signer-recover-their-own-signatures-nonce-k">Can a signer recover their own signature&#39;s nonce `k`?</a></p>
<p><code>Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.</code> In what way, if any, can all of the signing parties verify that the nonce is both random and not shared? Is this completely up to the signature implementation to do in the signature setup or is it bitcoin protocol specific?</p>

<signature><nonce><verification><random><specification>
Continuation question about nonce randomness and verification of the randomness by signing parties
Poseidon
# Continuation question about nonce randomness and verification of the randomness by signing parties

(Asked by: username_0 on 2023-01-21)

Original: [Can a signer recover their own signature's nonce `k`?](https://bitcoin.stackexchange.com/questions/116825/can-a-signer-recover-their-own-signatures-nonce-k)

`Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.` In what way, if any, can all of the signing parties verify that the nonce is both random and not shared? Is this completely up to the signature implementation to do in the signature setup or is it bitcoin protocol specific?

**Tags:** signature, nonce, verification, random, specification


---

## 1 answers

### Answer by username_1 on 2023-01-21. Score: 3 | Accepted answer

> In what way, if any, can all of the signing parties verify that the nonce is both random

By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce.

Even better, use a deterministic random nonce algorithm like RFC6979, which computes the nonce as a hash of the message and the private key. Since nobody else knows your private key (otherwise there is nothing left for them to learn...), this means the attacker can't get the nonce either.

> and not shared?

Well by not sharing it with anyone, like you don't share your private key.

> Is this completely up to the signature implementation

Yes, every (decent) ECDSA/Schnorr implementation does all of this internally.

> in the signature setup

It happens at signing time, not at setup time.

> or is it bitcoin protocol specific?

No.


---

