Timeline for Why did repeated "R" values occur in Bitcoin transactions before?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 8, 2019 at 18:21 | comment | added | Pieter Wuille |
If you reuse the same k for two signatures with private keys that are derived using a common BIP32 ancestor, and the attacker knows the xpub, they can compute the xprv. Really, never ever reuse k.
|
|
| May 30, 2019 at 20:36 | comment | added | Claris | As long as you never sign the same message twice, yes, but you’d be a complete clown to make systems that worked on that assumption. Storing a single nonce and using it over multiple messages would be lunacy. | |
| May 30, 2019 at 13:48 | comment | added | MCCCS | (Sorry for forgetting about the first two) but I don't see a risk caused by reusing nonce for different private keys. | |
| May 30, 2019 at 13:18 | comment | added | Claris | The nonce must also be perfectly random, as well as not known by anybody else, and also not reused. | |
| May 30, 2019 at 12:59 | comment | added | MCCCS | K is the random number that is used when signing, whose only requirement is not to be reused for the same private key (bitcoin.stackexchange.com/questions/35848 otherwise) but for a long time it has been generated deterministically using RFC6979. K is not the key. | |
| May 30, 2019 at 12:49 | history | answered | MCCCS | CC BY-SA 4.0 |