Can a signer recover their own signature's nonce `k`?

Question

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was unclear whether the signer can recover the k from their own signature. Is that possible? And if it is, can they recover the other signer's private key?

Answer 1

Yes, a signer can recover their own nonce.

Be z a hash of a message to sign, d a private key, G the generator point of secp256k1, n the integer order of G. An ECDSA signature {r, s} is generated as follows:

1. Pick a random integer nonce k from [1, n-1]
2. Calculate its curve point (x₁, y₁) = k × G
3. r = x₁ mod n
4. s = k^-1(z + rd)

Since the {z, r, d, s} are known to the signer, the signer can recover the k from their own signature.

1. k = s^-1(d × r + z)

---

The signer is now presented with a foreign signature {r,s₂} for the hash of a second message z₂ that uses the same r as their own signature. Since r derives directly from k, the other signature must have been created using the same nonce k as the signer used.

Using this, they can calculate the private key used in the other signature, given the public information {r, s₂, z₂} and their private knowledge of k:

1. s₂ = k^-1(z₂ + rd₂)
2. ks₂ = z₂ + rd₂
3. rd₂ = ks₂ - z₂
4. d₂ = r^-1(ks₂ - z₂)

Using a nonce another user has used before, leaks your private key to the other signer. Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.