# Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?

For non-deterministic ECDSA:

Given message $$m$$ and private key $$p$$, produce a series of signatures $$s_i = signature(p,m)$$, $$i=[1,n]$$.

Does there exist some function $$f$$ such that $$j_i=f(s_i)$$ and $$j_1=j_2=...=j_n$$ ?

An ECDSA signature can't be verified unless the associated public key $$P$$ is known. If that public key is part of what is communicated as part of $$s_i$$, then the answer is simply $$f(s_i) = P$$.

If $$P$$ isn't known, but you know the secret random nonce $$k_i$$ used for each signature, then $$f(s_i) = \frac{k_i\cdot r_i-m}{c_i}$$, where $$c_i$$ is the x-coordinate of $$k_iG$$ and $$r_i$$ is the signature response calculated as $$r_i= \frac{m+c_i\cdot p}{k_i}$$. Anyone with knowledge of $$k_i$$ for a signature will be able to determine the private key $$p$$.

If neither $$k_i$$ nor $$P$$ are known, then there is no $$f$$ which can identify any signatures as belonging to the same signer. This is because using the x-coordinate of $$kG$$ as the challenge $$c$$ acts as a one-way function, similar in effect to the hash function used Schnorr signatures.

• I did not translated my intentions to the correct question, so let's me try to rephrase. Is there a way to generate some hash of uknown private key from a signature? So, let's say I have a private key that I don't know and I have a known message and its signature by the private key. Can I derive some non-variable hash from any of the generated signatures that is unique to private key?
– rlib
Sep 8 at 15:20
• @rlib It's not possible to generate any kind of hash of the private key by looking at a signature. It's also not possible to know if any two signatures must have been signed using the same private key. This is what I meant above when I said "there is no $f$ which can identify any signatures as belonging to the same signer". But, if the signature is provided along with the corresponding public key that it will verify against, then that public key will act as a kind of fingerprint of the private key that signed, since the public key is deterministically generated by the private key. Sep 8 at 15:56
• Yes, I understood your answer. What I actually need is a some kind of substitute for unknown private key generated from signature of a known message. Public key does not fit that because it's public. I want to take some random message X, sign it with unknown private key and get some value from the signature which is used as entropy to generate a new private key Y. Every time I use X I get the same private key Y.
– rlib
Sep 8 at 16:51
• @rlib If all you need to do is generate a private key deterministically from another private key, you can do that with HKDF. Since the signature scheme is not deterministic and since the signature will blind the private key, there is no way to use a signature for deterministic key derivation. I don't understand how you can sign a message with a private key you don't know. Perhaps there is a fuller explanation of your use case that could lead to alternative means to achieve your goal. Sep 8 at 18:12
• @rlib Ah, I see what you are trying to do now. You may get an interesting answer on the Information Security stackexchange site if you ask there if there is a way to get a secondary private key from your Trezor, which is linked to your primary seed. Sep 9 at 4:52