<p>Generally, if someone produces two <em>valid</em> signatures for two <em>different</em> messages with the same private key and either the same nonce or two nonces with known arithmetic relationship, this produces a system with two unknowns in two equations that can be solved for the private key.</p>
<p>In this case, at least one of these two signatures is not a valid signature: <strong>a signature can only be valid in the context of the message that was signed</strong>. Here both the signature (r, s) and the commitment hash (z) for one of the signature are derived from the other. This means that at least one of the provided two commitment hashes does not have a known pre-image (the message). It is trivial to create such a mutation of a signature, but since this is just a variation of the same equation, this is insufficient to calculate the private key: you only have one equation and two unknowns.</p>
<hr />
<h2>An illustration of your issue</h2>
<p>Two equations {A, B} with two unknowns:</p>
<p>A: 2x + 3y = 17<br />
B: x + 2y = 14</p>
<p>⇒ 2×B-A: 2x + 4y - (2x + 3y) = 28 - 17<br />
⇒ y = 11<br />
⇒ x = -8</p>
<p>One equation A, and a mutated variant of A called A' with two unknowns:</p>
<p>A: x + 2y = 14<br />
A': 2x + 4y = 28</p>
<p>⇒ You cannot solve for x or y without the other also canceling out.</p>

CC BY-SA 4.0
2023-09-12T16:52:10.257Z
2023-09-12T19:17:06.450Z
2023-09-12T19:17:06.450Z
Murch
<p>Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that <code>k1*u+f=k2</code> be sufficient to reveal the private key(d)?</p>

CC BY-SA 4.0
2023-09-11T14:24:56.113Z
Could you please clarify whether both signatures are created with the same private key in your scenario?
Murch
CC BY-SA 4.0
2023-09-11T15:21:27.193Z
Yes, both signatures are created with the same private key.
Joakim20
CC BY-SA 4.0
2023-09-11T20:58:23.123Z
I've updated my question to add more context.
Joakim20
CC BY-SA 4.0
2023-09-12T17:09:00.887Z
While your edit did clarify your question, I’m afraid that it disimproved the usefulness as well. The set of equations provided is obviously unsolvable, and that means that someone is probably having a laugh at your expense. See my answer.
Murch
<signature><ecdsa><secp256k1>
Would two related nonces cause the private key to leak?
Joakim20
# Would two related nonces cause the private key to leak?

(Asked by: username_0 on 2023-09-11)

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that `k1*u+f=k2` be sufficient to reveal the private key(d)?

**Tags:** signature, ecdsa, secp256k1

> **Comments:**
> **username_1**: Could you please clarify whether both signatures are created with the same private key in your scenario?  
> **username_0**: Yes, both signatures are created with the same private key.  
> **username_0**: I've updated my question to add more context.  
> **username_1**: While your edit did clarify your question, I’m afraid that it disimproved the usefulness as well. The set of equations provided is obviously unsolvable, and that means that someone is probably having a laugh at your expense. See my answer.  

---

## 1 answers

### Answer by username_1 on 2023-09-12. Score: 1

Generally, if someone produces two *valid* signatures for two *different* messages with the same private key and either the same nonce or two nonces with known arithmetic relationship, this produces a system with two unknowns in two equations that can be solved for the private key.

In this case, at least one of these two signatures is not a valid signature: **a signature can only be valid in the context of the message that was signed**. Here both the signature (r, s) and the commitment hash (z) for one of the signature are derived from the other. This means that at least one of the provided two commitment hashes does not have a known pre-image (the message). It is trivial to create such a mutation of a signature, but since this is just a variation of the same equation, this is insufficient to calculate the private key: you only have one equation and two unknowns.

---

## An illustration of your issue

Two equations {A, B} with two unknowns:

A: 2x + 3y = 17  
B: x + 2y = 14

⇒ 2×B-A: 2x + 4y - (2x + 3y) = 28 - 17  
⇒ y = 11  
⇒ x = -8

One equation A, and a mutated variant of A called A' with two unknowns:

A: x + 2y = 14  
A': 2x + 4y = 28

⇒ You cannot solve for x or y without the other also canceling out.


---

