<p>If I sign two messages with the same private key and nonce, it compromises security, making it possible to calculate the private key.</p>
<p>I'm implementing a system (outside of bitcoin) where a message, with a unique property, must be signed only once.</p>
<p>In order to enforce this, I'm making it mandatory to use a hash of the unique property as the nonce.</p>
<p>This means that signing a two messages, having the same unique property, will give away the signer's private key.  (Which is not something they want to do, in this system.)</p>
<p>How do I use the secp256k1 functions to obtain a private key from two signed messages which use the same nonce?  (This is alluded to in <a href="https://bitcoin.stackexchange.com/questions/84055/nonce-usage-in-ecdsa-signing-algorithm">this question</a>.)</p>

CC BY-SA 4.0
2020-06-28T06:16:52.880Z
Presumably, if the unique property for two messages is the same, the content of those messages is also the same (wouldn't be much of a unique property, otherwise) - if your systems is designed correctly, you would end up with the same signature in both instances then, which would not leak the private key. For leakage to occur, two different messages must be signed with a shared R value.
Raghav Sood
CC BY-SA 4.0
2020-06-28T06:23:04.367Z
@RaghavSood No, the messages might be {"election":2018,"vote":"green"} and {"election":2018,"vote":"blue"} with the unique property being just the election and NOT the vote.
fadedbee
CC BY-SA 4.0
2020-06-28T15:04:00.523Z
This does not work. The reason the private key leaks is because attackers now know a *relation* between those two signatures. If they know the nonce up front (as required by nonce=H(msg)), attackers will learn the private key from *one* signature directly.
Pieter Wuille
CC BY-SA 4.0
2020-06-29T05:23:45.543Z
@PieterWuille I'm confused, I thought nonces were not secret information (at least in encryption).  Can you verify a signature without knowing the nonce for secp256k1?
fadedbee
CC BY-SA 4.0
2020-06-29T05:25:26.970Z
The term nonce as used in signatures is confusing. It security requirement is not the same as those in encryption. It is not enough that they are just used once. They have to be completely unpredictable to an attacker, which implies they are secret (but even knowing one bit of information about each nonce in many signatures may be enough to recover the private key).
Pieter Wuille
<private-key><public-key><nonce><message-signing>
How do I compute a private key, if I have two messages signed using the same nonce?
fadedbee
# How do I compute a private key, if I have two messages signed using the same nonce?

(Asked by: username_0 on 2020-06-28)

If I sign two messages with the same private key and nonce, it compromises security, making it possible to calculate the private key.

I'm implementing a system (outside of bitcoin) where a message, with a unique property, must be signed only once.

In order to enforce this, I'm making it mandatory to use a hash of the unique property as the nonce.

This means that signing a two messages, having the same unique property, will give away the signer's private key. (Which is not something they want to do, in this system.)

How do I use the secp256k1 functions to obtain a private key from two signed messages which use the same nonce? (This is alluded to in [this question](https://bitcoin.stackexchange.com/questions/84055/nonce-usage-in-ecdsa-signing-algorithm).)

**Tags:** private-key, public-key, nonce, message-signing

> **Comments:**
> **username_1**: Presumably, if the unique property for two messages is the same, the content of those messages is also the same (wouldn't be much of a unique property, otherwise) - if your systems is designed correctly, you would end up with the same signature in both instances then, which would not leak the private key. For leakage to occur, two different messages must be signed with a shared R value.  
> **username_0**: @username_1 No, the messages might be {"election":2018,"vote":"green"} and {"election":2018,"vote":"blue"} with the unique property being just the election and NOT the vote.  
> **username_2**: This does not work. The reason the private key leaks is because attackers now know a *relation* between those two signatures. If they know the nonce up front (as required by nonce=H(msg)), attackers will learn the private key from *one* signature directly.  
> **username_0**: @username_2 I'm confused, I thought nonces were not secret information (at least in encryption).  Can you verify a signature without knowing the nonce for secp256k1?  
> **username_2**: The term nonce as used in signatures is confusing. It security requirement is not the same as those in encryption. It is not enough that they are just used once. They have to be completely unpredictable to an attacker, which implies they are secret (but even knowing one bit of information about each nonce in many signatures may be enough to recover the private key).  

---

## 0 answers

