# In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is random which is also used to calculate s.

• As for repeated $k$ (not merely biased $k$), you learn two linear equations $s_1 = (h_1 + r_1 x) k^{-1}$ and $s_2 = (h_2 + r_2 x) k^{-1}$ in two unknowns $k^{-1}$ and $x$; I'll leave solving for $x$ as an exercise for the reader. – Squeamish Ossifrage Nov 26 '19 at 6:08
• @SqueamishOssifrage I know how to calculate, but mod q is also a part of s. How can attacker know the left part without mod q? – cscisgqr Nov 29 '19 at 4:55
• @SqueamishOssifrage Does attacks need to guess what is before mod q? – cscisgqr Nov 29 '19 at 5:07
• I don't understand your followup questions. Can you be more specific? – Squeamish Ossifrage Nov 29 '19 at 6:10
• @SqueamishOssifrage Your formula for s isn't correct because there is also mod q! Not sure if you ignored that intentionally. So you are assuming attackers know the left part, which isn't the case. – cscisgqr Nov 29 '19 at 6:13