ECDSA: Is it possible to generate from known signature (Key, message) valid signature (-Key, message)?

Let Alice has private key $R_1$ and known to Bob public key $P_1$. She generates signature for some message $M$ and shows it to Bob.

Could Bob generate signature for the same message $M$, but for different key-pair, exactly $R_2$ and $P_2$, such as

$R_1+R_2=N$, where N is order.

($P_1=-P_2$)

• I think your question is missing some point. As $R_2$ and $P_2$ are a valid key pair, of course you can generate any signature. – user27950 May 5 '18 at 15:16
• @Cryptostase $R_2$ (required for usual signing) is known only by Alice (but not Bob). The question is: could Bob from $P_2$ (as $-P_1$), $M$ and Signature($M$, $P_1$) generate Signature($M$, $P_2$)? – Karl Wagner May 5 '18 at 18:27
• This seems unlikely—the task is, given $(r, s)$ with $$r \equiv x([H(m) s^{-1}]B + [r s^{-1}]A) \pmod p,$$ to find $(r', s')$ such that $$r' \equiv x([H(m) s'^{-1}]B - [r' s'^{-1}]A) \pmod p,$$ which doesn't leave much room for possible values of $r'$ and $s'$ without knowing the secret scalar $a$ for which $A = [a]B$—but the standard notions of signature security don't rule it out, because even in the multi-user setting they say nothing about related keys. How do you find yourself in this scenario? What would the consequences of such a signature be for your application and why? – Squeamish Ossifrage May 7 '18 at 20:14