Timeline for Can the difference be determined between two nonces k1, k2, having a linear relationship if the nonce and private key are unknown, i.e., k2 - k1 = n?
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 17, 2022 at 16:03 | comment | added | Alfhilðr ínn Seiðkona | Sent the email to the address posted on github just now. Thank you. | |
| Jun 17, 2022 at 15:12 | comment | added | Pieter Wuille | You can email me. | |
| Jun 17, 2022 at 15:12 | comment | added | Alfhilðr ínn Seiðkona | Mr. Wuille, is there a way to ask a question that is private between two parties, so that a malicious actor cannot take advantage of the Q&A here on stackexchange? If so, will you direct me to the help section as to how? I cannot seem to find it. If not, is there any way I can ask you a question outside of the public forum? Thank you. | |
| Jun 12, 2022 at 22:38 | vote | accept | Alfhilðr ínn Seiðkona | ||
| Jun 12, 2022 at 22:18 | vote | accept | Alfhilðr ínn Seiðkona | ||
| Jun 12, 2022 at 22:26 | |||||
| Jun 12, 2022 at 20:15 | comment | added | Alfhilðr ínn Seiðkona | Thank you, that cleared up a lot of confusion on my end. :-). I sent you an email on your github email. My apologies for not getting permission from your first. | |
| Jun 12, 2022 at 16:32 | comment | added | Pieter Wuille |
It appears stackexchange butchered my earlier URL. Retry: tinyurl.com/429ye2ye gives the solution for k2 = a*k1 + b*d + c, with known constants a, b, c.
|
|
| Jun 11, 2022 at 21:00 | comment | added | Alfhilðr ínn Seiðkona | I can generate secure random nonces without any issues. That is not the problem. I am trying to generate a decent honeypot for my employer so that potential employees can demonstrate their abilities. Thus, I am playing around with signature equations and I have honestly noticed and developed a lot of different patterns (granted, using the small curve) and equations to match. Back to your answer, I generate nonces using randomness on secp256k1 calculator, and then sign per protocols. This question is simply for my further education. Thank you so very much, I really appreciate you. | |
| Jun 11, 2022 at 20:20 | comment | added | Pieter Wuille | You cannot fix this. If your nonce values satisfy a simple polynomial expression, it will either be trivial to break, or at least be impossible to prove it is secure. If you want a provably secure technique, your nonces need to be actually unpredictable (e.g. computed using hashes with secret input, or randomly). | |
| Jun 11, 2022 at 19:58 | comment | added | Alfhilðr ínn Seiðkona | Would solution (7) still hold true for k2=k1+d+1, if (7) were modified to: d=(z2*s1-z1*s2)/(s2*(r1+S1) - 1-r2*s1-1) mod N? I am manipulating the parameters on the small curve [N=79, P=67,G=(2,22), d=7, k1=19, r1=38, s1=36, z1=23 | k2=27, r2=17, s2=4, z2= 68]. | |
| Jun 9, 2022 at 19:18 | comment | added | Alfhilðr ínn Seiðkona | You are correct, there was a 45 on the end of the hex string, but the secp256k1 calculator would produce the incorrect result when running through the Generator Point while that was appended. I don't know the particular reason for this, but, deleting the 45 in the calculator produced the correct R(x,y) values. Thank you for your answer, I can see where my error was in my equations. | |
| Jun 9, 2022 at 16:24 | history | edited | Pieter Wuille | CC BY-SA 4.0 |
added 11 characters in body
|
| Jun 9, 2022 at 16:17 | history | edited | Pieter Wuille | CC BY-SA 4.0 |
added 127 characters in body
|
| Jun 9, 2022 at 16:11 | history | edited | Pieter Wuille | CC BY-SA 4.0 |
edited body
|
| Jun 9, 2022 at 16:06 | history | answered | Pieter Wuille | CC BY-SA 4.0 |