# ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $$r$$ is the same in the two signatures. I am trying to recover the plaintext messages and stumbled upon the Wikipedia : Elliptic Curve DSA page that explains that one can recover the private key given two cleartext messages, and their corresponding signatures where r is the same in both signatures. The problem is I don't have the cleartext messages, so I am wondering if it is possible to derive the private key and subsequently decrypt the messages from the givens that I currently have.

• I presume you mean trying to find the input for the raw ECDSA operation, correct? Usually ECDSA operates on a hash, which is a one way function. In that case the best you can do is to iterate over all the input messages, something you can already do with just the public key. – Maarten Bodewes Dec 23 '18 at 17:30
• @MaartenBodewes I do lack some cryptography knowledge, but if I am reading the problem correctly, I see that ECDSA here is being used to encrypt messages, instead of only providing signatures. I also see that the two message samples I have are not the hashed messages, but actually an encrypted format. – user3490561 Dec 23 '18 at 18:11
• The steps are starting with $e = Hash(m)$ and $m$ never used again. It is the digital signature of the message as mentioned Maarten it is the hash of the message. And, the message, with high probability, is encrypted with a symmetric algorithm, if any. The attack described in Wikipedia, also mentioned in the security part, fail0verflow announced recovery of the ECDSA **private key** – kelalaka Dec 23 '18 at 18:26
• Revisiting this question: are you sure that the signature is over the plaintext - not the ciphertext - of the messages? – Maarten Bodewes Dec 31 '18 at 9:40
• @MaartenBodewes I didn't manage to solve the problem yet. However, I am almost certain now that the signature is over the ciphertext. Both the samples of the resulting ciphertexts and their signature are base64 encoded. I tried to use some sample signature validation code using different formats of the signature, but I still couldn't get it to work. – user3490561 Dec 31 '18 at 23:31