If we repeat k, I think there is little chance for s to repeat since user's private key x is random which is also used to calculate s.

  • 1
    $\begingroup$ As for repeated $k$ (not merely biased $k$), you learn two linear equations $s_1 = (h_1 + r_1 x) k^{-1}$ and $s_2 = (h_2 + r_2 x) k^{-1}$ in two unknowns $k^{-1}$ and $x$; I'll leave solving for $x$ as an exercise for the reader. $\endgroup$ – Squeamish Ossifrage Nov 26 '19 at 6:08
  • $\begingroup$ @SqueamishOssifrage I know how to calculate, but mod q is also a part of s. How can attacker know the left part without mod q? $\endgroup$ – cscisgqr Nov 29 '19 at 4:55
  • $\begingroup$ @SqueamishOssifrage Does attacks need to guess what is before mod q? $\endgroup$ – cscisgqr Nov 29 '19 at 5:07
  • $\begingroup$ I don't understand your followup questions. Can you be more specific? $\endgroup$ – Squeamish Ossifrage Nov 29 '19 at 6:10
  • $\begingroup$ @SqueamishOssifrage Your formula for s isn't correct because there is also mod q! Not sure if you ignored that intentionally. So you are assuming attackers know the left part, which isn't the case. $\endgroup$ – cscisgqr Nov 29 '19 at 6:13