0
$\begingroup$

I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$.

Can $x_1$ & $x_2$ be computed?

$\endgroup$
4
  • 1
    $\begingroup$ Seem duplicate of this question; Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different? $\endgroup$
    – kelalaka
    Jul 10, 2019 at 13:34
  • $\begingroup$ @kelalaka It seems that this is a request to indicate how the assumption in the last sentence of that question can be computed. Slendep 1922 seems to have asked the same question in an answer to that question first. He converted it into a question when it was shown to him that you should not put questions in the answer field. That said, I've got a feel that answering this question will also solve the other one. $\endgroup$
    – Maarten Bodewes
    Jul 11, 2019 at 10:13
  • 1
    $\begingroup$ @MaartenBodewes I've come to this rfc6979 written by Thomas and he gave an answer to a similar question Can ECDSA signatures be safely made “deterministic”?, years ago $\endgroup$
    – kelalaka
    Jul 11, 2019 at 10:17
  • 1
    $\begingroup$ And I'd close this question down for that reason, but it doesn't seem to directly answer the rather mathematical questions why the deterministic ECDSA is secure. $\endgroup$
    – Maarten Bodewes
    Jul 11, 2019 at 10:32

0

Browse other questions tagged or ask your own question.