<p>Calculating the private key from a signature (r and s) requires that you know the message (to calculate the "z" value) and the "k" value (which is used by the signer to derive the r value via a <a href="http://en.wikipedia.org/wiki/Trapdoor_function" rel="nofollow">trapdoor function</a>).</p>

<p>Calculating the "k" value (needed above) requires two signatures (you need two s values) which sign two different messages (you need two z values) using the <em>same private key</em> and the same r (therefore the same k) value.</p>

<p>In your question, you reference two transactions signed by <em>different</em> private keys (which you know by noticing their public keys differ), and therefore you do not have enough information to correctly calculate the k value.</p>

<p>In the <a href="/questions/37674/two-identical-r-value-finding-z-value-from-two-transaction">other similar question you recently asked</a>, the two transactions <em>were</em> signed by the same private key (and they have the same r &amp; k), so in that case it is possible to calculate the private key. (The service you linked to appears to calculate it correctly, however it doesn't display the uncompressed address.)</p>

CC BY-SA 3.0
2015-06-01T15:45:59.517Z
k=5930f1a23e39c1a223ea2fb086cbcabbdf0d09e70ba0aed342ff0f5318a542f0 priv1=5JbfQE5fTXHZxWZ8qBDRR1z6S9hAvdzPEGEWGQgn1LJRTuNtaqG priv2=5JEzySX3zHQyH4ccLNMjNzmZNJ9MoHXBfW8g4MRaPBJ3u6dH1V2
amaclin
CC BY-SA 3.0
2015-06-01T17:48:05.310Z
Yes, but you're "cheating" :). You're using additional broken signatures from the blockchain, I'm answering only the specific question asked. (Also your k is wrong, k = a6cf0e5dc1c63e5ddc15d04f79343542dba1d2ffa3a7f1687cd34f39b790fe51.)
Christopher Gurnee
CC BY-SA 3.0
2015-06-01T13:48:38.013Z
2015-06-01T13:48:38.013Z
Christopher Gurnee
<p>Answering your question: &quot;what's wrong&quot;?</p>
<p>For each transaction you can write down an equation:</p>
<pre><code>x*r + m = s*k
</code></pre>
<p>where x is the private key, r and s the signature. m the message hash, k the signing secret.  All calculations are modulus the group order.</p>
<p>You are looking at two transactions with the same 'r'.
You could write equations for those two like this:</p>
<pre><code>x1*R + M1 = S1*k
x2*R + M2 = S2*k
</code></pre>
<p>Here I use UPPER case letters to indicate the known values, and lower case to indicate the unknowns.</p>
<p>The problem is that you end up with two equations with three unknowns. This cannot be solved at this point.</p>
<p>There is however a solution for this particular case:</p>
<p><a href="https://i.sstatic.net/2teFh.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/2teFh.png" alt="graph of R and pub.x values" /></a></p>
<p>Here I created a graph where each node has the first 8 digits of the r-value and x-coord of the pubkey.</p>
<p>The red node indicates the r-value you are interested in.
Square boxes indicates a public-key, round/oval nodes are the r-values.
The Arrows indicate a signature using that pubkey.</p>
<p>You can see the green arrows form a loop in the diagram.</p>
<p>These form four transactions as follows:</p>
<pre><code>t1: r1, pub1
t2: r1, pub2
t3: r2, pub2
t4: r2, pub1
</code></pre>
<p>from that you can derive four equations in four unknowns, which you can solve:</p>
<pre><code>x1*R1+M1=S1*k1
x2*R1+M2=S2*k1
x2*R2+M3=S3*k2
x1*R2+M4=S4*k2
</code></pre>
<p>Then from there you can follow all the chains and find all the other keys.</p>
<p>Note that this is only a small part of this network, in total there are 1814 related transactions.</p>
<p>A side note, that 2coin.org link no longer works, but you can do the same calculations on this page ( by me ): <a href="https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html" rel="nofollow noreferrer">https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html</a></p>

CC BY-SA 4.0
2022-10-31T11:56:32.790Z
2022-10-31T18:40:45.487Z
2022-10-31T18:40:45.487Z
Willem Hengeveld
<p>same r value is used for two different bitcoin addresses? finding privatekey of both address? @amaclin  can you explain briefly how did you get private key. Answer with formula and program</p>
<p>and @Christopher Gurnee</p>
<p>How you think he cheated.
There is any way to finding privatekey of both address? When same r value is used for two different bitcoin addresses. Please answer with formula and program</p>

CC BY-SA 4.0
2024-08-26T22:34:25.633Z
2024-08-26T22:34:25.633Z
Bruce
<p>I have found as bellow:</p>
<p>p  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141<br />
r  = 0x6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a<br />
s1 = 0xa044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6<br />
s2 = 0x75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e<br />
z1 = 0x9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64<br />
z2 = 0x539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e</p>
<p>K = GF(p)</p>
<p>K((z1<em>s2 - z2</em>s1)/(r*(s1-s2)))</p>
<p>result dec: 8921113496817264148701652880922087877926656286340189747525982520215619494205</p>
<p>result hex: 13b92bda88a3f2dbac6032865bf56eed68eea22d4461c77404ad79c49697e13d</p>

CC BY-SA 4.0
2021-07-25T16:16:47.097Z
It would help if you added a couple sentences to explain what you did differently than the asker.
Murch
CC BY-SA 4.0
2021-07-25T07:41:14.433Z
2021-07-25T16:15:03.320Z
2021-07-25T16:15:03.320Z
Mohammad Ashraful
<p><a href="https://blockchain.info/tx/f10d5c469c634de25276aae9c4e14add80ad9c66000182fac1b30e72a99298fb" rel="nofollow">txid1</a></p>

<p><a href="https://blockchain.info/tx/cf0b65ec6a2f9b5e003358d7b9bb6e04b30138c4dba30724f600bf753bfc3f4a" rel="nofollow">txid2</a></p>

<p><strong>input script 1</strong></p>

<pre><code>304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 
0428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14
</code></pre>

<p>r = 6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a</p>

<p>s1 = a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6</p>

<p><strong>input script 2</strong></p>

<pre><code>304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e01
04c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13
</code></pre>

<p>s2 = 75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e</p>

<p><strong>Raw tx 1</strong></p>

<pre><code>010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000008b48304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601410428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14ffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac00000000
</code></pre>

<p><strong>calculating z1</strong></p>

<p>replace the input with the corresponding output script</p>

<pre><code>010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88acffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac0000000001000000
</code></pre>

<p>then do sha256(sha256(modified transaction))</p>

<p>z1 = 9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64</p>

<p><strong>Raw tx 2</strong></p>

<pre><code>0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000008a47304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e014104c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13ffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac00000000
</code></pre>

<p><strong>calculating z2</strong></p>

<p>replace the input with the corresponding output script</p>

<pre><code>0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88acffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac0000000001000000
</code></pre>

<p>then do sha256(sha256(modified transaction))</p>

<p>z2 = 539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e</p>

<p><strong>priv key calculation,it not given correct address and priv anything wrong</strong></p>

<p>posting the r , s1 , s2 , z1 , z2 below</p>

<p><a href="http://2coin.org/tx.asmx?op=GetPrivateKeyFromIdenticalRs" rel="nofollow">http://2coin.org/tx.asmx?op=GetPrivateKeyFromIdenticalRs</a></p>

<p>it given <strong>18MRDftXYkGqzo9hvcdnUs7yaPXrD1DXsq</strong> address </p>

<p>but</p>

<p>trans 1 address = <strong>19owWJcPbTEe1mVYer1ymnbduJDza9jpRH</strong></p>

<p>trans 2 address = <strong>1FRDgmxVrUUNiiB7GN3NNcJDEEXtFB22rm</strong></p>

<p>what's wrong</p>

CC BY-SA 3.0
2015-05-31T14:25:24.127Z
All of the encoding/decoding/math you show above looks correct to me, as are the z values you calculated. I don't understand your final question, though. Are you trying to derive a private key from just the information above (which isn't possible despite the reused k values because the private keys differ)?
Christopher Gurnee
<transactions><signature><hash><ecdsa>
same R value is used for two different addresses? finding z1 and z2 value and privatekey
Prabu r
# same R value is used for two different addresses? finding z1 and z2 value and privatekey

(Asked by: username_0 on 2015-05-31)

[txid1](https://blockchain.info/tx/f10d5c469c634de25276aae9c4e14add80ad9c66000182fac1b30e72a99298fb)

[txid2](https://blockchain.info/tx/cf0b65ec6a2f9b5e003358d7b9bb6e04b30138c4dba30724f600bf753bfc3f4a)

**input script 1**

```
304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 
0428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14

```

r = 6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a

s1 = a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6

**input script 2**

```
304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e01
04c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13

```

s2 = 75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e

**Raw tx 1**

```
010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000008b48304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601410428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14ffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac00000000

```

**calculating z1**

replace the input with the corresponding output script

```
010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88acffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac0000000001000000

```

then do sha256(sha256(modified transaction))

z1 = 9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64

**Raw tx 2**

```
0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000008a47304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e014104c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13ffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac00000000

```

**calculating z2**

replace the input with the corresponding output script

```
0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88acffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac0000000001000000

```

then do sha256(sha256(modified transaction))

z2 = 539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

**priv key calculation,it not given correct address and priv anything wrong**

posting the r , s1 , s2 , z1 , z2 below

<http://2coin.org/tx.asmx?op=GetPrivateKeyFromIdenticalRs>

it given **18MRDftXYkGqzo9hvcdnUs7yaPXrD1DXsq** address

but

trans 1 address = **19owWJcPbTEe1mVYer1ymnbduJDza9jpRH**

trans 2 address = **1FRDgmxVrUUNiiB7GN3NNcJDEEXtFB22rm**

what's wrong

**Tags:** transactions, signature, hash, ecdsa

> **Comments:**
> **username_1**: All of the encoding/decoding/math you show above looks correct to me, as are the z values you calculated. I don't understand your final question, though. Are you trying to derive a private key from just the information above (which isn't possible despite the reused k values because the private keys differ)?  

---

## 4 answers

### Answer by username_1 on 2015-06-01. Score: 3

Calculating the private key from a signature (r and s) requires that you know the message (to calculate the "z" value) and the "k" value (which is used by the signer to derive the r value via a [trapdoor function](http://en.wikipedia.org/wiki/Trapdoor_function)).

Calculating the "k" value (needed above) requires two signatures (you need two s values) which sign two different messages (you need two z values) using the *same private key* and the same r (therefore the same k) value.

In your question, you reference two transactions signed by *different* private keys (which you know by noticing their public keys differ), and therefore you do not have enough information to correctly calculate the k value.

In the [other similar question you recently asked](/questions/37674/two-identical-r-value-finding-z-value-from-two-transaction), the two transactions *were* signed by the same private key (and they have the same r & k), so in that case it is possible to calculate the private key. (The service you linked to appears to calculate it correctly, however it doesn't display the uncompressed address.)

> **Comments:**
> **username_2**: k=5930f1a23e39c1a223ea2fb086cbcabbdf0d09e70ba0aed342ff0f5318a542f0 priv1=5JbfQE5fTXHZxWZ8qBDRR1z6S9hAvdzPEGEWGQgn1LJRTuNtaqG priv2=5JEzySX3zHQyH4ccLNMjNzmZNJ9MoHXBfW8g4MRaPBJ3u6dH1V2  
> **username_1**: Yes, but you're "cheating" :). You're using additional broken signatures from the blockchain, I'm answering only the specific question asked. (Also your k is wrong, k = a6cf0e5dc1c63e5ddc15d04f79343542dba1d2ffa3a7f1687cd34f39b790fe51.)  

---

### Answer by username_3 on 2022-10-31. Score: 1

Answering your question: "what's wrong"?

For each transaction you can write down an equation:

```
x*r + m = s*k

```

where x is the private key, r and s the signature. m the message hash, k the signing secret. All calculations are modulus the group order.

You are looking at two transactions with the same 'r'.
You could write equations for those two like this:

```
x1*R + M1 = S1*k
x2*R + M2 = S2*k

```

Here I use UPPER case letters to indicate the known values, and lower case to indicate the unknowns.

The problem is that you end up with two equations with three unknowns. This cannot be solved at this point.

There is however a solution for this particular case:

[![graph of R and pub.x values](https://i.sstatic.net/2teFh.png)](https://i.sstatic.net/2teFh.png)

Here I created a graph where each node has the first 8 digits of the r-value and x-coord of the pubkey.

The red node indicates the r-value you are interested in.
Square boxes indicates a public-key, round/oval nodes are the r-values.
The Arrows indicate a signature using that pubkey.

You can see the green arrows form a loop in the diagram.

These form four transactions as follows:

```
t1: r1, pub1
t2: r1, pub2
t3: r2, pub2
t4: r2, pub1

```

from that you can derive four equations in four unknowns, which you can solve:

```
x1*R1+M1=S1*k1
x2*R1+M2=S2*k1
x2*R2+M3=S3*k2
x1*R2+M4=S4*k2

```

Then from there you can follow all the chains and find all the other keys.

Note that this is only a small part of this network, in total there are 1814 related transactions.

A side note, that 2coin.org link no longer works, but you can do the same calculations on this page ( by me ): <https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html>


---

### Answer by username_4 on 2024-08-26. Score: 0

same r value is used for two different bitcoin addresses? finding privatekey of both address? @username_2 can you explain briefly how did you get private key. Answer with formula and program

and @username_1

How you think he cheated.
There is any way to finding privatekey of both address? When same r value is used for two different bitcoin addresses. Please answer with formula and program


---

### Answer by username_5 on 2021-07-25. Score: -1

I have found as bellow:

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141  
r = 0x6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a  
s1 = 0xa044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6  
s2 = 0x75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e  
z1 = 0x9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64  
z2 = 0x539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

K = GF(p)

K((z1*s2 - z2*s1)/(r\*(s1-s2)))

result dec: 8921113496817264148701652880922087877926656286340189747525982520215619494205

result hex: 13b92bda88a3f2dbac6032865bf56eed68eea22d4461c77404ad79c49697e13d

> **Comments:**
> **username_6**: It would help if you added a couple sentences to explain what you did differently than the asker.  

---

