0

Original: Can a signer recover their own signature's nonce `k`?

Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have been used in the first place, or the nonce was shared between the two signers. In what way, if any, can all of the signing parties verify that the nonce is both random and not shared? Is this completely up to the signature implementation to do in the signature setup or is it bitcoin protocol specific?

1 Answer 1

3

In what way, if any, can all of the signing parties verify that the nonce is both random

By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce.

Even better, use a deterministic random nonce algorithm like RFC6979, which computes the nonce as a hash of the message and the private key. Since nobody else knows your private key (otherwise there is nothing left for them to learn...), this means the attacker can't get the nonce either.

and not shared?

Well by not sharing it with anyone, like you don't share your private key.

Is this completely up to the signature implementation

Yes, every (decent) ECDSA/Schnorr implementation does all of this internally.

in the signature setup

It happens at signing time, not at setup time.

or is it bitcoin protocol specific?

No.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.