# Would two related nonces cause the private key to leak?

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that `k1*u+f=k2` be sufficient to reveal the private key(d)?

• Could you please clarify whether both signatures are created with the same private key in your scenario?
– Murch
Sep 11, 2023 at 14:24
• Yes, both signatures are created with the same private key. Sep 11, 2023 at 15:21
• I've updated my question to add more context. Sep 11, 2023 at 20:58
• While your edit did clarify your question, I’m afraid that it disimproved the usefulness as well. The set of equations provided is obviously unsolvable, and that means that someone is probably having a laugh at your expense. See my answer.
– Murch
Sep 12, 2023 at 17:09

Generally, if someone produces two valid signatures for two different messages with the same private key and either the same nonce or two nonces with known arithmetic relationship, this produces a system with two unknowns in two equations that can be solved for the private key.

In this case, at least one of these two signatures is not a valid signature: a signature can only be valid in the context of the message that was signed. Here both the signature (r, s) and the commitment hash (z) for one of the signature are derived from the other. This means that at least one of the provided two commitment hashes does not have a known pre-image (the message). It is trivial to create such a mutation of a signature, but since this is just a variation of the same equation, this is insufficient to calculate the private key: you only have one equation and two unknowns.

## An illustration of your issue

Two equations {A, B} with two unknowns:

A: 2x + 3y = 17
B: x + 2y = 14

⇒ 2×B-A: 2x + 4y - (2x + 3y) = 28 - 17
⇒ y = 11
⇒ x = -8

One equation A, and a mutated variant of A called A' with two unknowns:

A: x + 2y = 14
A': 2x + 4y = 28

⇒ You cannot solve for x or y without the other also canceling out.