For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify?

Can we also generate the private key $d$ matching $Q$?

Can we do this for given $Q$ and matching $d$?

For two signatures, that's trivial: $s_2=n-s_1$ will do (where $n$ is the group order).

For three (then trivially four) signatures and a curve with $p>n$, which includes secp256k1, secp256r1, secp384r1, there mathematically exist solutions sharing a common $r$ matching two different X coordinates for the ephemeral points. But I don't see how we could exhibit a solution without solving a DLP.

The question is motivated by this other question.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.