1
$\begingroup$

For non-deterministic ECDSA:

Given message $m$ and private key $p$, produce a series of signatures $s_i = signature(p,m)$, $i=[1,n]$.

Does there exist some function $f$ such that $j_i=f(s_i)$ and $j_1=j_2=...=j_n$ ?

$\endgroup$

1 Answer 1

1
$\begingroup$

An ECDSA signature can't be verified unless the associated public key $P$ is known. If that public key is part of what is communicated as part of $s_i$, then the answer is simply $f(s_i) = P$.

If $P$ isn't known, but you know the secret random nonce $k_i$ used for each signature, then $f(s_i) = \frac{k_i\cdot r_i-m}{c_i}$, where $c_i$ is the x-coordinate of $k_iG$ and $r_i$ is the signature response calculated as $r_i= \frac{m+c_i\cdot p}{k_i}$. Anyone with knowledge of $k_i$ for a signature will be able to determine the private key $p$.

If neither $k_i$ nor $P$ are known, then there is no $f$ which can identify any signatures as belonging to the same signer. This is because using the x-coordinate of $kG$ as the challenge $c$ acts as a one-way function, similar in effect to the hash function used Schnorr signatures.

$\endgroup$
6
  • $\begingroup$ I did not translated my intentions to the correct question, so let's me try to rephrase. Is there a way to generate some hash of uknown private key from a signature? So, let's say I have a private key that I don't know and I have a known message and its signature by the private key. Can I derive some non-variable hash from any of the generated signatures that is unique to private key? $\endgroup$
    – rlib
    Sep 8 at 15:20
  • $\begingroup$ @rlib It's not possible to generate any kind of hash of the private key by looking at a signature. It's also not possible to know if any two signatures must have been signed using the same private key. This is what I meant above when I said "there is no $f$ which can identify any signatures as belonging to the same signer". But, if the signature is provided along with the corresponding public key that it will verify against, then that public key will act as a kind of fingerprint of the private key that signed, since the public key is deterministically generated by the private key. $\endgroup$
    – knaccc
    Sep 8 at 15:56
  • $\begingroup$ Yes, I understood your answer. What I actually need is a some kind of substitute for unknown private key generated from signature of a known message. Public key does not fit that because it's public. I want to take some random message X, sign it with unknown private key and get some value from the signature which is used as entropy to generate a new private key Y. Every time I use X I get the same private key Y. $\endgroup$
    – rlib
    Sep 8 at 16:51
  • $\begingroup$ @rlib If all you need to do is generate a private key deterministically from another private key, you can do that with HKDF. Since the signature scheme is not deterministic and since the signature will blind the private key, there is no way to use a signature for deterministic key derivation. I don't understand how you can sign a message with a private key you don't know. Perhaps there is a fuller explanation of your use case that could lead to alternative means to achieve your goal. $\endgroup$
    – knaccc
    Sep 8 at 18:12
  • 1
    $\begingroup$ @rlib Ah, I see what you are trying to do now. You may get an interesting answer on the Information Security stackexchange site if you ask there if there is a way to get a secondary private key from your Trezor, which is linked to your primary seed. $\endgroup$
    – knaccc
    Sep 9 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.