<p>It can easily be done, and has been done. See <a href="https://bitcointalk.org/index.php?topic=581411.0" rel="nofollow">https://bitcointalk.org/index.php?topic=581411.0</a> for example.</p>

CC BY-SA 3.0
2016-09-10T16:11:39.590Z
2016-09-10T16:11:39.590Z
Pieter Wuille
<p>The <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow">wikipedia page on ECDSA signature</a> explains how the signer's private key can be recovered if two signatures are produced with the same random (private key looking) element <code>k</code>. In fact, it is claimed on the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow">DSA page</a> that a fault in the implementation of <code>java</code>'s <code>SecureRandom</code> class have led to such collision. I would like to confirm that in principle, <strong>it is possible to write code checking for such collisions in the blockchain in order to steal bitcoin private keys</strong> in the hope that some faulty wallet implementation has prevailed somewhere. Does the following algorithm outline make sense?</p>

<ol>
<li>Check every signature of every transaction input in the blockchain</li>
<li>If two signatures correspond to the same public key, check if same <code>r</code></li>
<li>If same <code>r</code> assume there is a collision and derive private key</li>
<li>Check if corresponding address is part of utxo set</li>
</ol>

<p>Assuming this can be implemented, has it been done already? </p>

<ecdsa>
Testing the blockchain for ECDSA signature random collision
Sven Williamson
# Testing the blockchain for ECDSA signature random collision

(Asked by: username_0 on 2016-09-10)

The [wikipedia page on ECDSA signature](https://en.wikipedia.org/wiki/Elliptic_Curve_DSA) explains how the signer's private key can be recovered if two signatures are produced with the same random (private key looking) element `k`. In fact, it is claimed on the [DSA page](https://en.wikipedia.org/wiki/Elliptic_Curve_DSA) that a fault in the implementation of `java`'s `SecureRandom` class have led to such collision. I would like to confirm that in principle, **it is possible to write code checking for such collisions in the blockchain in order to steal bitcoin private keys** in the hope that some faulty wallet implementation has prevailed somewhere. Does the following algorithm outline make sense?

1. Check every signature of every transaction input in the blockchain
2. If two signatures correspond to the same public key, check if same `r`
3. If same `r` assume there is a collision and derive private key
4. Check if corresponding address is part of utxo set

Assuming this can be implemented, has it been done already?

**Tags:** ecdsa


---

## 1 answers

### Answer by username_1 on 2016-09-10. Score: 2 | Accepted answer

It can easily be done, and has been done. See <https://bitcointalk.org/index.php?topic=581411.0> for example.


---

