# ECDSA vulnerability related to recovering private key using same r

I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2. where:

I get it that any attacker who have s1 and s2 can recover its private key x. But the question is can the signer use a different private key x1 for instance to generate s2..in such a way even if he uses same k but still its private key will be safe.??(cryptocurrency like bitcoin allows multiple public private key pair of a user) Am i getting something wrong otherwise this would have been not a well known ECDSA vulnerability in bitcoin. Please explain the contradiction. Thanks in advance

• One may want to note that this question is equivalent to asking "assume that by chance two ECDSA signatures by two distinct private keys use the same k, given just the signatures produced, can we recover either private key?". – SEJPM Jun 5 '18 at 17:49

You are positing that the signer signs two messages $m_1$ and $m_2$ under different private keys $x_1$ and $x_2$, but the same per-signature secret $k$.
Note that $r = x([k]B)$ where $B$ is the standard base point. Even if you are given $s_1$, $s_2$, $m_1$, $m_2$, and $r$, this is a system of two equations in three unknowns. This doesn't even constrain you to a unique solution: for any nonzero value of $x_1$, there is a corresponding value of $(x_2, k)$; likewise $x_2$ and $(x_1, k)$, and $k$ and $(x_1, x_2)$. Indeed, for, e.g., secp256k1, there are approximately $2^{256}$ possible solutions for $(x_1, x_2, k)$.