Skip to main content
Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611

I'll use the notation in the references, thus the question's privkey1 (resp., privkey2, nonce1, nonce2) are noted $x_1$ (resp., $x_2$, $k_1$, $k_2$). The curve; and the prime order of curve secp256k1 is noted $p$ (rather than the usual $n$).

The question mentionmentions "(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSAECDSA signatures matching 2 private/public keys pairs using only 2 nonces, in the following arrangement:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The numbers given for $x_i$, $k_i$, $r_i$, $h_j$, $s_j$ for $i\in\{1,2\}$ and $j\in\{1,2,3,4\}$ all are in $(1,p)$; verify the equations; and $r_i$ is the function of $k_i$ prescribed by ECDSAECDSA on secp256k1secp256k1, that is $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, with the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention "(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching 2 private/public keys pairs using only 2 nonces, in the following arrangement:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The numbers given for $x_i$, $k_i$, $r_i$, $h_j$, $s_j$ for $i\in\{1,2\}$ and $j\in\{1,2,3,4\}$ all are in $(1,p)$; verify the equations; and $r_i$ is the function of $k_i$ prescribed by ECDSA on secp256k1, that is $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, with the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1, privkey2, nonce1, nonce2 are noted $x_1$, $x_2$, $k_1$, $k_2$; and the prime order of curve secp256k1 is noted $p$ (rather than the usual $n$).

The question mentions "(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching 2 private/public keys pairs using only 2 nonces, in the following arrangement:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The numbers given for $x_i$, $k_i$, $r_i$, $h_j$, $s_j$ for $i\in\{1,2\}$ and $j\in\{1,2,3,4\}$ all are in $(1,p)$; verify the equations; and $r_i$ is the function of $k_i$ prescribed by ECDSA on secp256k1, that is $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, with the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention _"(…) 4 transactions for 2 pubkeys with the same r1 and r2""(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching two2 private/public keys pairs using only 2 nonces, as followsin the following arrangement:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The equations verifynumbers given for $x_i$, $k_i$, $r_i$, $h_j$, $s_j$ for $i\in\{1,2\}$ and $r_1$$j\in\{1,2,3,4\}$ all are in (resp.$(1,p)$; verify the equations; and $r_2$)$r_i$ is the function of $k_1$ (resp. $k_2$)$k_i$ prescribed by ECDSA on secp256k1;, that is, for $i\in\{1,2\}$, $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, andwith the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention _"(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching two private/public keys pairs using only 2 nonces, as follows:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The equations verify, and $r_1$ (resp. $r_2$) is the function of $k_1$ (resp. $k_2$) prescribed by ECDSA on secp256k1; that is, for $i\in\{1,2\}$, $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, and the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention "(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching 2 private/public keys pairs using only 2 nonces, in the following arrangement:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The numbers given for $x_i$, $k_i$, $r_i$, $h_j$, $s_j$ for $i\in\{1,2\}$ and $j\in\{1,2,3,4\}$ all are in $(1,p)$; verify the equations; and $r_i$ is the function of $k_i$ prescribed by ECDSA on secp256k1, that is $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, with the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention _"(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching two private/public keys pairs using only 2 nonces, as follows:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The equations verify, and $r_1$ (resp. $r_2$) is the function of $k_1$ (resp. $k_2$) prescribed by ECDSA on secp256k1; that is, for $i\in\{1,2\}$, $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$. This

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, and the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing cancould be a decoy or, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention _"(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching two private/public keys pairs using only 2 nonces, as follows:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The equations verify, and $r_1$ (resp. $r_2$) is the function of $k_1$ (resp. $k_2$) prescribed by ECDSA on secp256k1; that is, for $i\in\{1,2\}$, $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$. This makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns, but none is stated.

One possibility is that there's none to be found. The whole thing can be a decoy or a joke. One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

I'll use the notation in the references, thus the question's privkey1 (resp. privkey2, nonce1, nonce2) are noted $x_1$ (resp. $x_2$, $k_1$, $k_2$). The curve order is noted $p$ (rather than the usual $n$).

The question mention _"(…) 4 transactions for 2 pubkeys with the same r1 and r2", but gives different values for r1 and r2. I'll read instead: 4 ECDSA signatures matching two private/public keys pairs using only 2 nonces, as follows:

hash nonce privkey signature equation$\pmod p$
$h_1$ $k_1$ $x_1$ $(r_1,s_1)$ $s_1k_1≡r_1x_1+h_1$
$h_2$ $k_1$ $x_2$ $(r_1,s_2)$ $s_2k_1≡r_1x_2+h_2$
$h_3$ $k_2$ $x_1$ $(r_2,s_3)$ $s_3k_2≡r_2x_1+h_3$
$h_4$ $k_2$ $x_2$ $(r_2,s_4)$ $s_4k_2≡r_2x_2+h_4$

The equations verify, and $r_1$ (resp. $r_2$) is the function of $k_1$ (resp. $k_2$) prescribed by ECDSA on secp256k1; that is, for $i\in\{1,2\}$, $r_i$ is the X coordinate of $k_i\,G$ reduced modulo $p$ (the reduction seldom makes a difference, and this is no exception).

But contrary to the references, it holds $s_1s_4≡s_2s_3\pmod p$. That prevents applying the method in the references to find $x_1$ and $x_2$, which requires that $r_1r_2(s_1s_4-s_2s_3)$ be invertible modulo $p$.

Under the assumption $h_1$, $h_2$, $h_3$, $h_4$ (or the corresponding signed messages) and $x_1$, $x_2$, $k_1$, $k_2$ are arbitrary, and the signatures derived from that, there is no reason $s_1s_4≡s_2s_3\pmod p$ would hold. That it holds makes the system of 4 equations with 4 unknowns $x_1$, $x_2$, $k_1$, $k_2$ impossible to solve from the signatures and hashes alone; we'd need some additional relation involving at least one of the unknowns $x_1$, $x_2$, $k_1$, $k_2$, but none is stated.

One possibility is that there's none to be found. The whole thing could be a decoy, a joke, perhaps a scam (which that comment suggests). One way to build the question's numbers would be that $s_4$ is computed as $s_1^{-1}\,s_2\,s_3\bmod p$, then $h_4$ is computed from $s_4$ rather than as the hash of some message.

Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611
Loading
Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611
Loading
Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611
Loading
Conclude
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611
Loading
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611
Loading