# Can a signer recover their own signature's nonce `k`?

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was unclear whether the signer can recover the k from their own signature. Is that possible? And if it is, can they recover the other signer's private key?

Yes, a signer can recover their own nonce.

Be z a hash of a message to sign, d a private key, G the generator point of secp256k1, n the integer order of G. An ECDSA signature {r, s} is generated as follows:

1. Pick a random integer nonce k from [1, n-1]
2. Calculate its curve point (x1, y1) = k × G
3. r = x1 mod n
4. s = k-1(z + rd)

Since the {z, r, d, s} are known to the signer, the signer can recover the k from their own signature.

1. k = s-1(d × r + z)

The signer is now presented with a foreign signature {r,s2} for the hash of a second message z2 that uses the same r as their own signature. Since r derives directly from k, the other signature must have been created using the same nonce k as the signer used.

Using this, they can calculate the private key used in the other signature, given the public information {r, s2, z2} and their private knowledge of k:

1. s2 = k-1(z2 + rd2)
2. ks2 = z2 + rd2
3. rd2 = ks2 - z2
4. d2 = r-1(ks2 - z2)

Using a nonce another user has used before, leaks your private key to the other signer. Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers.

• Note that in order to be be able to use the same nonce that another user has used before in a valid signature, you must know their k, and therefore, by the same reasoning as you give above, you'd already know their private key too. Jan 18 at 20:53
• Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers. In what way, if any, can all of the signing parties verify that the nonce is both random and not shared? Jan 19 at 19:58
• Hi Poseidon, I think that's sufficiently removed from the original topic that you might better ask a new question.
– Murch
Jan 20 at 15:02