<blockquote>
  <p>is there any other way to recover it from r s z ?</p>
</blockquote>

<p>What is the purpose of <code>private</code> key, if anyone would be able to recover it from other data?</p>

<blockquote>
  <p>is it possible to recover any private key using random R values ?</p>
</blockquote>

<p>the probability is the same as trying random values for guessing private key itself</p>

CC BY-SA 3.0
2018-03-21T15:36:51.313Z
as you can see on that example , the output of that example is actually a private key of  an existing bitcoin address . so I am asking if there's any other method/code which can calculate private key just like example but without having an identical R value .
Dion Winbush
CC BY-SA 3.0
2018-03-22T05:50:09.033Z
@DionWinbush And the answer perfectly answered that. If there was such a way, the private key would no longer be private and so the entire design would be fundamentally broken. Of course there is no known reason to think the design if fundamentally broken or people wouldn't be using it!
David Schwartz
CC BY-SA 3.0
2018-03-21T14:44:07.810Z
2018-03-21T14:44:07.810Z
amaclin
<p>I've seen many peoples are actually recovering their private keys using signatures pub key r s z values etc , anyway , I've found a way to recover it but using transaction  hex i can't found the identical R value , is there any other way to recover it from r s z ? or is it possible to recover any private key using random R values ? 
I have tried this method , In my case the values of R are different , this method is just for example having same/identical R value.  ;</p>

<pre><code>def inverse_mod( a, m ):
    """Inverse of a mod m."""
    if a &lt; 0 or m &lt;= a: a = a % m
    # From Ferguson and Schneier, roughly:
    c, d = a, m
    uc, vc, ud, vd = 1, 0, 0, 1
    while c != 0:
        q, c, d = divmod( d, c ) + ( c, )
        uc, vc, ud, vd = ud - q*uc, vd - q*vc, uc, vc

    # At this point, d is the GCD, and ud*a+vd*m = d.
    # If d == 1, this means that ud is a inverse.
    assert d == 1
    if ud &gt; 0: return ud
    else: return ud + m


def derivate_privkey(p, r, s1, s2, hash1, hash2):
    z = hash1 - hash2
    s = s1 - s2
    r_inv = inverse_mod(r, p)
    s_inv = inverse_mod(s, p)
    k = (z * s_inv) % p
    d = (r_inv * (s1 * k - hash1)) % p
    return d, k

p  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

# this case is right
public_key=0x04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff
r =0xd47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
s1=0x44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e
s2=0x9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab
z1=0xc0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e
z2=0x17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc
print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2)
print

# this case can be wrong
public_key=0x02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364
r =0x0861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d
s1=0x6cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
s2=0x4ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2
z1=0x01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6
z2=0x339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1

print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2) 
</code></pre>

<private-key>
Private key recovery?
Dion Winbush
# Private key recovery?

(Asked by: username_0 on 2018-03-21)

I've seen many peoples are actually recovering their private keys using signatures pub key r s z values etc , anyway , I've found a way to recover it but using transaction hex i can't found the identical R value , is there any other way to recover it from r s z ? or is it possible to recover any private key using random R values ?
I have tried this method , In my case the values of R are different , this method is just for example having same/identical R value. ;

```
def inverse_mod( a, m ):
    """Inverse of a mod m."""
    if a < 0 or m <= a: a = a % m
    # From Ferguson and Schneier, roughly:
    c, d = a, m
    uc, vc, ud, vd = 1, 0, 0, 1
    while c != 0:
        q, c, d = divmod( d, c ) + ( c, )
        uc, vc, ud, vd = ud - q*uc, vd - q*vc, uc, vc

    # At this point, d is the GCD, and ud*a+vd*m = d.
    # If d == 1, this means that ud is a inverse.
    assert d == 1
    if ud > 0: return ud
    else: return ud + m

def derivate_privkey(p, r, s1, s2, hash1, hash2):
    z = hash1 - hash2
    s = s1 - s2
    r_inv = inverse_mod(r, p)
    s_inv = inverse_mod(s, p)
    k = (z * s_inv) % p
    d = (r_inv * (s1 * k - hash1)) % p
    return d, k

p  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

# this case is right
public_key=0x04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff
r =0xd47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
s1=0x44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e
s2=0x9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab
z1=0xc0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e
z2=0x17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc
print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2)
print

# this case can be wrong
public_key=0x02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364
r =0x0861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d
s1=0x6cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
s2=0x4ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2
z1=0x01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6
z2=0x339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1

print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2) 

```

**Tags:** private-key


---

## 1 answers

### Answer by username_1 on 2018-03-21. Score: 1 | Accepted answer

> is there any other way to recover it from r s z ?

What is the purpose of `private` key, if anyone would be able to recover it from other data?

> is it possible to recover any private key using random R values ?

the probability is the same as trying random values for guessing private key itself

> **Comments:**
> **username_0**: as you can see on that example , the output of that example is actually a private key of  an existing bitcoin address . so I am asking if there's any other method/code which can calculate private key just like example but without having an identical R value .  
> **username_2**: @username_0 And the answer perfectly answered that. If there was such a way, the private key would no longer be private and so the entire design would be fundamentally broken. Of course there is no known reason to think the design if fundamentally broken or people wouldn't be using it!  

---

