<p>c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e is the nonce for the first rsz set.
a3c2dce777813dc3f0d7a105a5fd56d5894ba30ffa01ba79667cadba37a9d8df is the private key.</p>

CC BY-SA 4.0
2021-12-01T16:13:51.080Z
I don't see how you can compute this based on the information in the question. Can you elaborate on the technique you used?
Pieter Wuille
CC BY-SA 4.0
2021-12-01T19:31:09.220Z
I think someone put together this question or a challenge somewhere else to lead up to this kind of reveal. The "nonce" value `c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e` appears in multiple blog posts about "hacking bitcoin wallets".
Murch
CC BY-SA 4.0
2021-12-03T05:01:44.247Z
The private key posted here previously appeared in this stack exchange post before: https://bitcoin.stackexchange.com/q/37740/5406
Murch
CC BY-SA 4.0
2021-12-01T06:15:38.603Z
2022-09-20T01:01:26.220Z
2022-09-20T01:01:26.220Z
T M
<p>Assuming you're talking about ECDSA signing. For BIP340/Schnorr signatures, see <a href="https://bitcoin.stackexchange.com/questions/110811/why-is-it-important-that-nonces-when-signing-not-be-related">this answer</a>.</p>
<h3>For valid signatures</h3>
<p>Let:</p>
<ul>
<li><code>d</code>: the private key</li>
<li><code>P=d*G</code>: the public key</li>
<li><code>k1</code>: the (first) nonce</li>
<li><code>R1=k1*G</code>: the public first nonce</li>
<li><code>r1=R1.x mod n</code>: the public first nonce as it will be encoded in the signature.</li>
<li><code>k2=2*k1</code>, <code>R2=k2*G=2*R1</code>, <code>r2=R2.x mod n</code>: the same for the second nonce</li>
<li><code>z1</code> and <code>z2</code>: the respective message hash</li>
</ul>
<p>The two signatures will then be the pairs <code>(r,s)</code> and <code>(r',s')</code> for which:</p>
<ul>
<li><code>s1 = (z1 + r1*d) / k1 mod n</code></li>
<li><code>s2 = (z2 + r2*d) / k2 mod n = (m2 + r2*d) / (2*k1) mod n</code></li>
</ul>
<p>Multiplying both sides of the equations by their denominator on the right hand side:</p>
<ul>
<li><code>s1*k1 = z1 + r1*d mod n</code></li>
<li><code>2*s2*k1 = z2 + r2*d mod n</code></li>
</ul>
<p>Assuming <code>2*r1*s2 ≠ r2*s1</code>, this is a set of two linear equations in two unknowns (<code>k1</code> and <code>d</code>), with solution:</p>
<ul>
<li><code>d = (z2*s1 - 2*z1*s2) / (2*r1*s2 - r2*s1) mod n</code></li>
<li><code>k1 = (z2*r1 - z1*r2) / (2*r1*s2 - r2*s1) mod n</code></li>
</ul>
<p><em><strong>Don't ever use related nonces for ECDSA (or Schnorr) signatures. Create a fresh, independent, nonce every time. The industry standard is to generate nonces using <a href="https://datatracker.ietf.org/doc/html/rfc6979" rel="nofollow noreferrer">RFC6979</a>.</strong></em></p>
<h3>For fake &quot;signatures&quot;</h3>
<p>The values you've provided however do not correspond to real signatures, despite satisfying the equation. That's because for a signature to be valid, you have to give the messages which hash to the <code>z</code> values, not just the result. And you can't do that here, because <code>z2 = (r2/r1)*z1</code>. Such matching ratios will not (and cannot) occur for <code>z</code> values that are the result of hashing.</p>
<p>It turns out that given any ECDSA triplet <code>(r,s,z)</code>, and integer <code>a</code>, another triplet can be found. Let <code>R</code> be an elliptic curve point whose X coordinate equals <code>r</code> (mod n), and <code>R' = aR</code>, and <code>r'</code> the X coordinate of <code>R'</code>. Then <code>(r',r'*s/(a*r'),r'*z/r)</code> is another ECDSA triplet, corresponding to multiplying <code>k</code> with <code>a</code>. However, again, this is not a valid signature because its z value will not be the hash of a computable message. And the formula above will also fail to retrieve the private key in this case, because the second &quot;signature&quot; wasn't created by using the private key.</p>

CC BY-SA 4.0
2021-11-29T07:07:21.727Z
Thanks for your answer, I edited the question and provided the example , Have a look and if you answer according to that it will be easy for me to understand
Guest34122123
CC BY-SA 4.0
2021-11-30T17:19:19.087Z
I've updated my answer. Your input values don't correspond to actual signatures, and you cannot recover the private key from them.
Pieter Wuille
CC BY-SA 4.0
2021-12-01T05:56:30.257Z
pk = ((k1 - modinv(s2, n)*k2 + modinv(s1,n)*k1) * (modinv(modinv(s2,n)*r2 - modinv(s1,n)*r1, n)) % n)




,Is it possible to rewrite it
based on the k and k*2 rule
Guest34122123
CC BY-SA 4.0
2021-12-01T16:24:27.700Z
Sure, just substitute k2=2*k1. But you'll find that for the specific numbers you've given above, the formula you get doesn't let you compute the private key (you get a division by zero).
Pieter Wuille
CC BY-SA 4.0
2021-12-03T08:53:30.253Z
but `z` can be just `2` or so. like in eth. say id of the method. then this becomes possible
Алексей Неудачин
CC BY-SA 4.0
2021-11-28T15:54:49.257Z
2021-11-30T22:55:47.210Z
2021-11-30T22:55:47.210Z
Pieter Wuille
<p>Is the same private key using k and k*2 respectively in two different signatures vulnerable?
If yes How to calculate the key in this case</p>
<p>Here is an example, Both signatures are valid and the nonce of r2,s2,z2 is double the first signature's nonce, how do I calculate private key from these two signatures?</p>
<p>r1 = 0xdcf17de661e280dbf62e03ef1655d1baaabc301da9fc6b29a63e52e7780c115d</p>
<p>s1 = 0x20be91ddd5598e22fa43014172df5312275fbdb462a2e9855c7a7433138a4a9c</p>
<p>z1 = 0xbb1e00d2027efd3085b83de2a3602a8ea49e0c9d5b821cd6291d5feefd410303</p>
<p>r2 = 0x5baeea47c4d1759efc2b4a6a1948727648a7f9d0db6c77c09b0a26a0ae22d4ad</p>
<p>s2 = 0x4f08689cd10e8fd5e9be108d18e2ee582774dc409176643800284669d6e787eb</p>
<p>z2 = 0x0fa25a9a0712366012de680bed93f8c94ffa2c119464d1e59b0a03b1c115b54f</p>

CC BY-SA 4.0
2021-11-27T20:31:54.330Z
Are you using the RFC6979 standard for deriving k?
Chiru
CC BY-SA 4.0
2021-11-27T21:23:27.927Z
How to do that ?
Guest34122123
CC BY-SA 4.0
2021-11-28T15:59:27.307Z
Read the RFC: https://datatracker.ietf.org/doc/html/rfc6979
Pieter Wuille
CC BY-SA 4.0
2021-12-03T04:59:55.043Z
I've rolled back the edit of the question post to return it to the question. Please refrain from disparaging other users in posts.
Murch
<transactions><security><hash><ecdsa>
How to derive the Private key when the two the nonces are k and k*2
Guest34122123
# How to derive the Private key when the two the nonces are k and k*2

(Asked by: username_0 on 2021-11-27)

Is the same private key using k and k\*2 respectively in two different signatures vulnerable?
If yes How to calculate the key in this case

Here is an example, Both signatures are valid and the nonce of r2,s2,z2 is double the first signature's nonce, how do I calculate private key from these two signatures?

r1 = 0xdcf17de661e280dbf62e03ef1655d1baaabc301da9fc6b29a63e52e7780c115d

s1 = 0x20be91ddd5598e22fa43014172df5312275fbdb462a2e9855c7a7433138a4a9c

z1 = 0xbb1e00d2027efd3085b83de2a3602a8ea49e0c9d5b821cd6291d5feefd410303

r2 = 0x5baeea47c4d1759efc2b4a6a1948727648a7f9d0db6c77c09b0a26a0ae22d4ad

s2 = 0x4f08689cd10e8fd5e9be108d18e2ee582774dc409176643800284669d6e787eb

z2 = 0x0fa25a9a0712366012de680bed93f8c94ffa2c119464d1e59b0a03b1c115b54f

**Tags:** transactions, security, hash, ecdsa

> **Comments:**
> **username_1**: Are you using the RFC6979 standard for deriving k?  
> **username_0**: How to do that ?  
> **username_2**: Read the RFC: https://datatracker.ietf.org/doc/html/rfc6979  
> **username_3**: I've rolled back the edit of the question post to return it to the question. Please refrain from disparaging other users in posts.  

---

## 2 answers

### Answer by username_4 on 2021-12-01. Score: -4 | Accepted answer

c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e is the nonce for the first rsz set.
a3c2dce777813dc3f0d7a105a5fd56d5894ba30ffa01ba79667cadba37a9d8df is the private key.

> **Comments:**
> **username_2**: I don't see how you can compute this based on the information in the question. Can you elaborate on the technique you used?  
> **username_3**: I think someone put together this question or a challenge somewhere else to lead up to this kind of reveal. The "nonce" value `c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e` appears in multiple blog posts about "hacking bitcoin wallets".  
> **username_3**: The private key posted here previously appeared in this stack exchange post before: https://bitcoin.stackexchange.com/q/37740/5406  

---

### Answer by username_2 on 2021-11-28. Score: 3

Assuming you're talking about ECDSA signing. For BIP340/Schnorr signatures, see [this answer](https://bitcoin.stackexchange.com/questions/110811/why-is-it-important-that-nonces-when-signing-not-be-related).

### For valid signatures

Let:

* `d`: the private key
* `P=d*G`: the public key
* `k1`: the (first) nonce
* `R1=k1*G`: the public first nonce
* `r1=R1.x mod n`: the public first nonce as it will be encoded in the signature.
* `k2=2*k1`, `R2=k2*G=2*R1`, `r2=R2.x mod n`: the same for the second nonce
* `z1` and `z2`: the respective message hash

The two signatures will then be the pairs `(r,s)` and `(r',s')` for which:

* `s1 = (z1 + r1*d) / k1 mod n`
* `s2 = (z2 + r2*d) / k2 mod n = (m2 + r2*d) / (2*k1) mod n`

Multiplying both sides of the equations by their denominator on the right hand side:

* `s1*k1 = z1 + r1*d mod n`
* `2*s2*k1 = z2 + r2*d mod n`

Assuming `2*r1*s2 ≠ r2*s1`, this is a set of two linear equations in two unknowns (`k1` and `d`), with solution:

* `d = (z2*s1 - 2*z1*s2) / (2*r1*s2 - r2*s1) mod n`
* `k1 = (z2*r1 - z1*r2) / (2*r1*s2 - r2*s1) mod n`

***Don't ever use related nonces for ECDSA (or Schnorr) signatures. Create a fresh, independent, nonce every time. The industry standard is to generate nonces using [RFC6979](https://datatracker.ietf.org/doc/html/rfc6979).***

### For fake "signatures"

The values you've provided however do not correspond to real signatures, despite satisfying the equation. That's because for a signature to be valid, you have to give the messages which hash to the `z` values, not just the result. And you can't do that here, because `z2 = (r2/r1)*z1`. Such matching ratios will not (and cannot) occur for `z` values that are the result of hashing.

It turns out that given any ECDSA triplet `(r,s,z)`, and integer `a`, another triplet can be found. Let `R` be an elliptic curve point whose X coordinate equals `r` (mod n), and `R' = aR`, and `r'` the X coordinate of `R'`. Then `(r',r'*s/(a*r'),r'*z/r)` is another ECDSA triplet, corresponding to multiplying `k` with `a`. However, again, this is not a valid signature because its z value will not be the hash of a computable message. And the formula above will also fail to retrieve the private key in this case, because the second "signature" wasn't created by using the private key.

> **Comments:**
> **username_0**: Thanks for your answer, I edited the question and provided the example , Have a look and if you answer according to that it will be easy for me to understand  
> **username_2**: I've updated my answer. Your input values don't correspond to actual signatures, and you cannot recover the private key from them.  
> **username_0**: pk = ((k1 - modinv(s2, n)*k2 + modinv(s1,n)*k1) * (modinv(modinv(s2,n)*r2 - modinv(s1,n)*r1, n)) % n)     ,Is it possible to rewrite it based on the k and k*2 rule  
> **username_2**: Sure, just substitute k2=2*k1. But you'll find that for the specific numbers you've given above, the formula you get doesn't let you compute the private key (you get a division by zero).  
> **username_5**: but `z` can be just `2` or so. like in eth. say id of the method. then this becomes possible  

---

