I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$.
Can $x_1$ & $x_2$ be computed?
Asked
Active
Viewed 158 times
0
-
1Seem duplicate of this question; Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different? – kelalaka Jul 10 '19 at 13:34
-
@kelalaka It seems that this is a request to indicate how the assumption in the last sentence of that question can be computed. Slendep 1922 seems to have asked the same question in an answer to that question first. He converted it into a question when it was shown to him that you should not put questions in the answer field. That said, I've got a feel that answering this question will also solve the other one. – Maarten Bodewes Jul 11 '19 at 10:13
-
1@MaartenBodewes I've come to this rfc6979 written by Thomas and he gave an answer to a similar question Can ECDSA signatures be safely made “deterministic”?, years ago – kelalaka Jul 11 '19 at 10:17
-
1And I'd close this question down for that reason, but it doesn't seem to directly answer the rather mathematical questions why the deterministic ECDSA is secure. – Maarten Bodewes Jul 11 '19 at 10:32