# Tag Info

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again). Now we want same $(r,s)$ for $d,k,h$ and $d',... 5 Is it possible for Carol to find Bobs key in$S_{pks}$This is a decisional Diffie-Hellman problem. We can summary this problem as: "we're given the values$G, aG, abG$, and a series of values$c_1G, c_2G, ... c_nG$, can we recognize$c_iG = bG$" We can reword the problem as "assuming$H = aG$, we're given the values$H, (a^{-1})H, bH$, can ... 4 For a given private key$d$, random$k$and message hash$h$: is it possible that there exists a different set of$d$,$k$and$h$which produces the same ECDSA signature using the$\text{secp256k1}$curve? Yes, and further it's easy to explicitly compute an alternate$(d',k',h')$that matches all reasonable meanings of "different set of$d$,$k$and$...