<p>Yes, a signer can recover their own nonce.</p>
<p>Be <em>z</em> a hash of a message to sign, <em>d</em> a private key, <em>G</em> the generator point of secp256k1, <em>n</em> the integer order of <em>G</em>. An ECDSA signature <em>{r, s}</em> is generated as follows:</p>
<ol>
<li>Pick a random integer nonce <em>k</em> from [1, n-1]</li>
<li>Calculate its curve point (x<sub>1</sub>, y<sub>1</sub>) = k × G</li>
<li>r = x<sub>1</sub> mod n</li>
<li>s = k<sup>-1</sup>(z + rd)</li>
</ol>
<p>Since the {z, r, d, s} are known to the signer, the signer can recover the <em>k</em> from their own signature.</p>
<ol>
<li>k = s<sup>-1</sup>(d × r + z)</li>
</ol>
<hr />
<p>The signer is now presented with a foreign signature <em>{r,s<sub>2</sub>}</em> for the hash of a second message <em>z<sub>2</sub></em> that uses the same <em>r</em> as their own signature. Since <em>r</em> derives directly from <em>k</em>, the other signature must have been created using the same nonce <em>k</em> as the signer used.</p>
<p>Using this, they can calculate the private key used in the other signature, given the public information <em>{r, s<sub>2</sub>, z<sub>2</sub>}</em> and their private knowledge of <em>k</em>:</p>
<ol>
<li>s<sub>2</sub> = k<sup>-1</sup>(z<sub>2</sub> + rd<sub>2</sub>)</li>
<li>ks<sub>2</sub> = z<sub>2</sub> + rd<sub>2</sub></li>
<li>rd<sub>2</sub> = ks<sub>2</sub> - z<sub>2</sub></li>
<li>d<sub>2</sub> = r<sup>-1</sup>(ks<sub>2</sub> - z<sub>2</sub>)</li>
</ol>
<p><strong>Using a nonce another user has used before, leaks your private key to the other signer.</strong> Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.</p>

CC BY-SA 4.0
2023-01-18T20:53:54.680Z
Note that in order to be be able to use the same nonce that another user has used before in a valid signature, you must know their *k*, and therefore, by the same reasoning as you give above, you'd already know their private key too.
Pieter Wuille
CC BY-SA 4.0
2023-01-19T19:58:18.593Z
`Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.` In what way, if any, can all of the signing parties verify that the nonce is both random and not shared?
Poseidon
CC BY-SA 4.0
2023-01-20T15:02:20.547Z
Hi Poseidon, I think that's sufficiently removed from the original topic that you might better ask a new question.
Murch
CC BY-SA 4.0
2023-01-18T18:58:15.423Z
2023-01-18T19:15:11.850Z
2023-01-18T19:15:11.850Z
Murch
<p>I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was unclear whether the signer can recover the <code>k</code> from their own signature. Is that possible? And if it is, can they recover the other signer's private key?</p>

<signature><ecdsa><nonce>
Can a signer recover their own signature's nonce `k`?
Murch
# Can a signer recover their own signature's nonce `k`?

(Asked by: username_0 on 2023-01-18)

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was unclear whether the signer can recover the `k` from their own signature. Is that possible? And if it is, can they recover the other signer's private key?

**Tags:** signature, ecdsa, nonce


---

## 1 answers

### Answer by username_0 on 2023-01-18. Score: 3 | Accepted answer

Yes, a signer can recover their own nonce.

Be *z* a hash of a message to sign, *d* a private key, *G* the generator point of secp256k1, *n* the integer order of *G*. An ECDSA signature *{r, s}* is generated as follows:

1. Pick a random integer nonce *k* from [1, n-1]
2. Calculate its curve point (x1, y1) = k × G
3. r = x1 mod n
4. s = k-1(z + rd)

Since the {z, r, d, s} are known to the signer, the signer can recover the *k* from their own signature.

1. k = s-1(d × r + z)

---

The signer is now presented with a foreign signature *{r,s2}* for the hash of a second message *z2* that uses the same *r* as their own signature. Since *r* derives directly from *k*, the other signature must have been created using the same nonce *k* as the signer used.

Using this, they can calculate the private key used in the other signature, given the public information *{r, s2, z2}* and their private knowledge of *k*:

1. s2 = k-1(z2 + rd2)
2. ks2 = z2 + rd2
3. rd2 = ks2 - z2
4. d2 = r-1(ks2 - z2)

**Using a nonce another user has used before, leaks your private key to the other signer.** Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.

> **Comments:**
> **username_1**: Note that in order to be be able to use the same nonce that another user has used before in a valid signature, you must know their *k*, and therefore, by the same reasoning as you give above, you'd already know their private key too.  
> **username_2**: `Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.` In what way, if any, can all of the signing parties verify that the nonce is both random and not shared?  
> **username_0**: Hi username_2, I think that's sufficiently removed from the original topic that you might better ask a new question.  

---

