# Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a positive integer of finite size, so there aren't that many possibilities compared to trying to brute-force the private key directly. Actually, I read that in some cases knowing only one bit of nonce is enough to find it (lattice attacks). So is it possible with a powerful computer to brute-force the nonce in sensible time to get the private key?

Brute-forcing the nonce, on the other hand, is not possible for a classical attacker if you use a 256-bit curve since $$k$$ is chosen from $$[1,n-1]$$ uniform randomly where $$n$$ is the order of the base point $$G$$.
• Alright, I assume $n$ is the 256-bit private key here, so the nonce is as strong as the private key itself? Jan 29, 2022 at 19:01
• As usual, the $n$ is the order of the base point $G$. Jan 29, 2022 at 20:30