1
$\begingroup$

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?

$\endgroup$
5
  • 3
    $\begingroup$ Hi Topolino, please edit the question and explain what you mean with "trace". Do you mean "expose", "track" or something different? $\endgroup$
    – Maarten Bodewes
    Nov 17 '21 at 21:12
  • $\begingroup$ And, what is the origin of this question, what have you tried? $\endgroup$
    – kelalaka
    Nov 17 '21 at 21:47
  • 1
    $\begingroup$ Hint, two-equation more than one unknowns. $\endgroup$
    – kelalaka
    Nov 17 '21 at 21:59
  • 3
    $\begingroup$ What do you mean by “private key trace”? Do you mean allowing to recover the private key? Or do you mean revealing that the same private key was used each time? Or something else? $\endgroup$ Nov 17 '21 at 23:28
  • 1
    $\begingroup$ Yes I mean recover the private key, sorry $\endgroup$
    – Topolino
    Nov 18 '21 at 18:16
3
$\begingroup$

In case leak was meant where the question has “trace”: in ECDSA, signing the same message twice with different nonces does not leak the private key or otherwise jeopardize security, including when message and public key are available to adversaries.

The same holds for any signature system secure under EF-CMA or stronger definitions of security.


From the description of signing operation in ECDSA, we see that changing the nonce $k$ changes $R$, $x_R$, $y_R$, $r$, $s$ (not $H$, $e$); thus including both components of the signature $S=(r,s)$.

$\endgroup$
3
  • $\begingroup$ Thank you, I’m only a newbie trying to understand the theory: so which other parameter changes from one sign to the next except the nonce? $\endgroup$
    – Topolino
    Nov 18 '21 at 18:22
  • $\begingroup$ but in the description of signing operation in ECDSA 3 k seems to be the private key... where can I find the exact definitions in that document? it seems to me they change notation in every chapter... $\endgroup$
    – Topolino
    Nov 19 '21 at 18:39
  • $\begingroup$ @Topolino: $k$ is not the private key. The private key is $d_U$. $k$ is a secret random integer in $[1,n)$, and can be called an ephemeral private key. As far as I can tell the notation in the whole of sec1v2 is consistent, and for sure things do not change arbitrarily within the section on ECDSA. Wikipedia's ECDSA article uses $d_A$ and $Q_A$ where sec1 uses $d_U$ and $Q_U$, and assimilates integers to bitstrings, but is close. $\endgroup$
    – fgrieu
    Nov 19 '21 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.