<blockquote>
<p>How many times can I reuse my bitcoin address until someone has enough information from all my transaction data to break my private key?</p>
</blockquote>
<p>An <em>arbitrary</em> number of times.</p>
<p>Assuming the discrete logarithm problem for secp256k1 is hard (the basic security assumption underlying Bitcoin's digital signatures), it does not matter at all how many signatures an attacker sees. He will not be able to find the private key, or be able to forge a signature.</p>
<p>There are two contexts in which the advice for not reusing keys appears:</p>
<ul>
<li><strong>Privacy</strong>. Reusing addresses increases the linkability of your transactions, which reduces your privacy as well as everyone else that you interact with through that address.</li>
<li><strong>Post-quantum security</strong>. As soon as you've spent an output assigned to a given address once, its public key becomes public knowledge. Before that point, someone with a hypothetical machine that can compute private keys from public keys cannot even start their search. I personally think this is not a particularly strong reason not to reuse addresses though (the real reason not to is privacy); see <a href="https://bitcoin.stackexchange.com/questions/95123/what-are-the-potential-attacks-against-ecdsa-that-would-be-possible-if-we-used-r/95133#95133">What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?</a> for why.</li>
</ul>
<blockquote>
<p>What is the term for this case/matter? is it &quot;chosen cipher text attack&quot;, &quot;plain text attack&quot; etc.</p>
</blockquote>
<p>This crypto SE answer is relevant: <a href="https://crypto.stackexchange.com/a/32715/72983">https://crypto.stackexchange.com/a/32715/72983</a></p>
<p>What you really want is protection against <em>existential forgery</em> (the ability for an attacker to sign a message he has never seen a signature for). That is a stronger notion of security than what you were talking about (as forgeries do not require the attacker to actually learn your private keys).</p>

CC BY-SA 4.0
2020-06-26T03:30:49.707Z
TQ for the additional information. I will look it up.
Cisco Mmu
CC BY-SA 4.0
2020-06-26T13:08:06.893Z
Most security notions in classic crypto -- I don't know about post-quantum -- rely on adversaries being polynomially bounded in their runtime. Hence, even if you have a EUF-CMA-secure -- existentially unforgeable under chosen message attack -- signature scheme, saying one can sign "an unlimited number of times" is a bit of a stretch in my opinion. For practical purposes, yes. Theoretically speaking, no.
ComFreek
CC BY-SA 4.0
2020-06-26T15:48:19.210Z
@ComFreek Sure, I was trying to keep things simple. But EUF-CMA also only prevents the attacker from forging in a polynomial amount of time, which I would think implies he can't examine more than a polynomial number of signatures either?
Pieter Wuille
CC BY-SA 4.0
2020-06-26T16:07:37.490Z
@PieterWuille Oh, true, so even if you publish "exponentially many" signatures, the adversary can only inspect "polynomially many". (I'm sure you know, but for other readers: speaking of functions actually doesn't make much sense if one is talking about concrete instances with fixed security parameters anyway.) In any case, I happily retract my comment.
ComFreek
CC BY-SA 4.0
2020-06-26T18:23:21.093Z
Actually your second point doesn't apply. Your private key is only worth something once someone sent you some bitcoins, at which point the public key is made visible in the ledger.
csiz
CC BY-SA 4.0
2020-06-26T20:30:52.510Z
@csiz The public key is visible as soon as you've *spent* an output that was sent to the corresponding address; it needs more than just sending to it.
Pieter Wuille
CC BY-SA 4.0
2020-06-26T20:42:28.670Z
@PieterWuille Ah, I thought address and public key are the same. I (re)learned now that addresses are a hash of the pub key for extra security.
csiz
CC BY-SA 4.0
2020-06-26T03:22:19.453Z
2020-06-26T03:22:19.453Z
Pieter Wuille
<p>There is one case the private key is revealed: Nonce reuse. For the same private key, if two different messages are signed with the same nonce, your private key becomes &quot;public&quot;.</p>
<p>Secp256k1 signing uses an 256-bit nonce. If you sign about 2^256 transactions, I guarantee that your private key will have been revealed. (But theoretically! Though you need a super-super-super-computer to scan for duplicates. Complexity O(n^2) For 2^256, that's just even less infeasible than bruteforcing private keys)</p>
<p>By default, on most implementations the nonce is generated as defined in RFC6979. The nonce is defined as the hash of <em>some signing data in some order</em>.</p>
<p>If you're going to sign 2^128 transactions, the probability that a nonce will be reused is about 39%. Therefore, using a counter to sign a large number of transactions is safer.</p>
<p>Note that even 2^128 transactions is not realistic.</p>

CC BY-SA 4.0
2020-06-26T18:41:16.593Z
I also heard that even a slight bias of nonce can still lead to similar outcome of nonce reuse?
Chris Chen
CC BY-SA 4.0
2020-06-28T00:19:45.423Z
thanks MCCCS, i got something more to study.
Cisco Mmu
CC BY-SA 4.0
2020-06-26T16:58:49.337Z
2020-06-26T16:58:49.337Z
MCCCS
<p>Suppose my private key is properly generated. My public key is known to everybody.
I don't care about privacy.</p>
<p>How many times can I reuse my bitcoin address until someone has enough information from all my transaction data to break my private key?</p>
<p>Assume I operate as an eBay seller who sells USDT (zero loses purchases where anybody can resell later at the same price), where adversaries can freely transact with me to get the transaction data, signature etc.</p>
<p>What is the term for this case/matter? is it &quot;chosen cipher text attack&quot;, &quot;plain text attack&quot; etc.</p>

<security-key>
Breaking Bitcoin Private Key
Cisco Mmu
# Breaking Bitcoin Private Key

(Asked by: username_0 on 2020-06-25)

Suppose my private key is properly generated. My public key is known to everybody.
I don't care about privacy.

How many times can I reuse my bitcoin address until someone has enough information from all my transaction data to break my private key?

Assume I operate as an eBay seller who sells USDT (zero loses purchases where anybody can resell later at the same price), where adversaries can freely transact with me to get the transaction data, signature etc.

What is the term for this case/matter? is it "chosen cipher text attack", "plain text attack" etc.

**Tags:** security-key


---

## 2 answers

### Answer by username_1 on 2020-06-26. Score: 10

> How many times can I reuse my bitcoin address until someone has enough information from all my transaction data to break my private key?

An *arbitrary* number of times.

Assuming the discrete logarithm problem for secp256k1 is hard (the basic security assumption underlying Bitcoin's digital signatures), it does not matter at all how many signatures an attacker sees. He will not be able to find the private key, or be able to forge a signature.

There are two contexts in which the advice for not reusing keys appears:

* **Privacy**. Reusing addresses increases the linkability of your transactions, which reduces your privacy as well as everyone else that you interact with through that address.
* **Post-quantum security**. As soon as you've spent an output assigned to a given address once, its public key becomes public knowledge. Before that point, someone with a hypothetical machine that can compute private keys from public keys cannot even start their search. I personally think this is not a particularly strong reason not to reuse addresses though (the real reason not to is privacy); see [What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?](https://bitcoin.stackexchange.com/questions/95123/what-are-the-potential-attacks-against-ecdsa-that-would-be-possible-if-we-used-r/95133#95133) for why.

> What is the term for this case/matter? is it "chosen cipher text attack", "plain text attack" etc.

This crypto SE answer is relevant: <https://crypto.stackexchange.com/a/32715/72983>

What you really want is protection against *existential forgery* (the ability for an attacker to sign a message he has never seen a signature for). That is a stronger notion of security than what you were talking about (as forgeries do not require the attacker to actually learn your private keys).

> **Comments:**
> **username_0**: TQ for the additional information. I will look it up.  
> **username_2**: Most security notions in classic crypto -- I don't know about post-quantum -- rely on adversaries being polynomially bounded in their runtime. Hence, even if you have a EUF-CMA-secure -- existentially unforgeable under chosen message attack -- signature scheme, saying one can sign "an unlimited number of times" is a bit of a stretch in my opinion. For practical purposes, yes. Theoretically speaking, no.  
> **username_1**: @username_2 Sure, I was trying to keep things simple. But EUF-CMA also only prevents the attacker from forging in a polynomial amount of time, which I would think implies he can't examine more than a polynomial number of signatures either?  
> **username_2**: @username_1 Oh, true, so even if you publish "exponentially many" signatures, the adversary can only inspect "polynomially many". (I'm sure you know, but for other readers: speaking of functions actually doesn't make much sense if one is talking about concrete instances with fixed security parameters anyway.) In any case, I happily retract my comment.  
> **username_3**: Actually your second point doesn't apply. Your private key is only worth something once someone sent you some bitcoins, at which point the public key is made visible in the ledger.  
> **username_1**: @username_3 The public key is visible as soon as you've *spent* an output that was sent to the corresponding address; it needs more than just sending to it.  
> **username_3**: @username_1 Ah, I thought address and public key are the same. I (re)learned now that addresses are a hash of the pub key for extra security.  

---

### Answer by username_4 on 2020-06-26. Score: 3

There is one case the private key is revealed: Nonce reuse. For the same private key, if two different messages are signed with the same nonce, your private key becomes "public".

Secp256k1 signing uses an 256-bit nonce. If you sign about 2^256 transactions, I guarantee that your private key will have been revealed. (But theoretically! Though you need a super-super-super-computer to scan for duplicates. Complexity O(n^2) For 2^256, that's just even less infeasible than bruteforcing private keys)

By default, on most implementations the nonce is generated as defined in RFC6979. The nonce is defined as the hash of *some signing data in some order*.

If you're going to sign 2^128 transactions, the probability that a nonce will be reused is about 39%. Therefore, using a counter to sign a large number of transactions is safer.

Note that even 2^128 transactions is not realistic.

> **Comments:**
> **username_5**: I also heard that even a slight bias of nonce can still lead to similar outcome of nonce reuse?  
> **username_0**: thanks username_4, i got something more to study.  

---

