My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is increased by private key 'd' to create k2, such that: k2 = k1+d.
I have searched the stack exchanges and various articles and research papers and have not found a workable solution to this problem. My own linear algebra is not as strong as I would like it (it's been a number of years), and my attempts have not been successful. I have used the k2 = k1+1 equations but they do not specifically produce the necessary solution of k2-k1 = d. Other solutions for solving for k did not work, either.
Is there a way to find the difference of k2-k1 = d, where k1, k2, and d are unknown, where k2 = k1+d, but all other values (r, s, z) are known?
(I have provided the values of d, k1, and k2 for verification of possible solutions, but for the purposes of the question, assume an attacker does not know the values but can spot a relationship).
N: Finite field of the secp256k1
d: Private key
B(x,y): Public key coordinates
k: Private key of ECDSA nonce
R(x,y): Public key coordinates of nonce
r: R.x integer
s: signature integer
z: Hash value of message
Basic signature equations:
d= (k * s - z) * r^-1 mod N
k= (d * r + z) * s^-1 mod N - or- (d * a + b) mod N
s= (d * r + z) * k^-1 mod N
r= (k * s - z) * d^-1 mod N
z= (k * s) - (d * r) mod N
a= r * s^-1 mod N
b= z * s^-1 mod N
Is there a way to solve this to obtain the value k2-k1=d (k1+d-k1=d) given the equations above, or to solve either k1 or k2, or would the k generation scheme be relatively secure from attack?