0
$\begingroup$

I have two ETH transactions (both belonging to the same address) that both have the same r value in the transaction signature, is it possible to extract the private key from it? Details of both transactions below:

address: 0xF55f348c48bd2811a34105899db5fF7C2EBD9934

transaction hash(1): 0x374180005946ef3b1906ee1677f85fa62eb5a834aa0241b4c9c74174bca26a07

r: 0x41d43fd626c24e449ac54257eeff271edb438bbabbc9bee3d60a5bd78dc39d6d

s: 0x0f8062db22b4f8b654c01d6114616c1a7972453ab509a5fe5192a8ae28d7f351 —————————————————————- transaction hash(2): 0x670f66ff71882ae35436cd399adf57805745177b465fdb44a60b31b7c32e4d16

r: 0x41d43fd626c24e449ac54257eeff271edb438bbabbc9bee3d60a5bd78dc39d6d

s: 0x796fd3c7e31cb6f799d00d5a4c63185baa70e2ba10a7104a3a48d43d82738ef9

$\endgroup$
1
  • $\begingroup$ "I have two ETH transactions (both belonging to the same address) that both have the same r value in the transaction signature, is it possible to extract the private key from it?" is directly about an on-topic cryptographic problem; but it's a duplicate. The values of the hashes and signatures are off-topic, per policy on questions consisting mostly of ciphertext/values. $\endgroup$
    – fgrieu
    Oct 20, 2022 at 6:40

1 Answer 1

0
$\begingroup$

To quote directly from the wikipedia page on ECDSA:

As the standard notes, it is not only required for $k$ to be secret, but it is also crucial to select different $k$ for different signatures, otherwise the equation in step 6. can be solved for $d_A$, the private key: given two signatures $(r,s)$ and $(r, s')$, employing the same unknown $k$ for different known messages $m$ and $m'$, an attacker can calculate $z$ and $z'$, and since $s-s' = k^{-1}(z-z')$ (all operations in this paragraph are done modulo $n$) the attacker can find $k = \frac{z-z'}{s-s'}$. Since $s = k^{-1}(z + rd_A)$, the attacker can now calculate the private key $d_A = \frac{sk - z}{r}$.

$\endgroup$
4
  • $\begingroup$ For the two transactions that I gave as an example, is it possible to extract the private key??? $\endgroup$ Oct 20, 2022 at 5:58
  • $\begingroup$ Yes, using exactly the method described - assuming it is ECDSA which seems to be the case. Is there any particular parts of the process you would like clarifying? $\endgroup$
    – Lev
    Oct 20, 2022 at 11:25
  • $\begingroup$ Ok, but I have a problem in calculating k and d according to the formulas you mentioned, if you can tell me how to calculate k and d with these formulas. thank you $\endgroup$ Oct 20, 2022 at 12:44
  • $\begingroup$ On the crypto stackexchange we encourage question askers to give a clear indication where they are stuck. It would be good if you could provide some calculations and clarify what you don't follow. See crypto.stackexchange.com/help/on-topic $\endgroup$
    – Lev
    Oct 20, 2022 at 21:41

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .