Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
Original: Can a signer recover their own signature's nonce `k`?
Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers. In what way, if any, can all of the signing parties verify that the nonce is both random and not shared? Is this completely up to the signature implementation to do in the signature setup or is it bitcoin protocol specific?
In what way, if any, can all of the signing parties verify that the nonce is both random
By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce.
Even better, use a deterministic random nonce algorithm like RFC6979, which computes the nonce as a hash of the message and the private key. Since nobody else knows your private key (otherwise there is nothing left for them to learn...), this means the attacker can't get the nonce either.
and not shared?
Well by not sharing it with anyone, like you don't share your private key.
Is this completely up to the signature implementation
Yes, every (decent) ECDSA/Schnorr implementation does all of this internally.
in the signature setup
It happens at signing time, not at setup time.
or is it bitcoin protocol specific?
No.
