same R value is used for two different addresses? finding z1 and z2 value and privatekey

Question

txid1

txid2

input script 1

304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 
0428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14

r = 6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a

s1 = a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6

input script 2

304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e01
04c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13

s2 = 75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e

Raw tx 1

010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000008b48304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601410428f3c7982219bf067d9723a54bef8e0ae7d970b4285a148685ce98819bd59c993da6945a85ba67249e96534f3cb93af144301e3ef03f848ebf17fedd55addd14ffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac00000000

calculating z1

replace the input with the corresponding output script

010000000169590a9c08ea4d2f4d1b5e3acb216b9cee78e8378a7a5b223aff7e85f70eab77000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88acffffffff0224aece00000000001976a914b4d245551501f7f443ea507494ef00b8ed739f6888ac9def0b0f000000001976a91460a1a3a20ac1023a8b6ce202190fbf75ec73a1bf88ac0000000001000000

then do sha256(sha256(modified transaction))

z1 = 9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64

Raw tx 2

0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000008a47304402206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022075e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e014104c69b120facc137ad7ecf7407b97f3e1bcecec27ed6617ad1e3bb4f5a265c2230dab461d8de9d194b9aae05cf3fc361e31b0cd172985720a9963a1fd9cb4dab13ffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac00000000

calculating z2

replace the input with the corresponding output script

0100000001cc41959d96ce6147b93fe00a8fca25ce99ec1a09dc175d27113db36f6e398d1c010000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88acffffffff02f4351000000000001976a91485ba872014004c8e4de29d94b4d7ad415297955f88acc0d06100000000001976a9149e26556775e88e000179ebe278a259cba1d7b43d88ac0000000001000000

then do sha256(sha256(modified transaction))

z2 = 539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

priv key calculation,it not given correct address and priv anything wrong

posting the r , s1 , s2 , z1 , z2 below

http://2coin.org/tx.asmx?op=GetPrivateKeyFromIdenticalRs

it given 18MRDftXYkGqzo9hvcdnUs7yaPXrD1DXsq address

but

trans 1 address = 19owWJcPbTEe1mVYer1ymnbduJDza9jpRH

trans 2 address = 1FRDgmxVrUUNiiB7GN3NNcJDEEXtFB22rm

what's wrong

Answer 1

Calculating the private key from a signature (r and s) requires that you know the message (to calculate the "z" value) and the "k" value (which is used by the signer to derive the r value via a trapdoor function).

Calculating the "k" value (needed above) requires two signatures (you need two s values) which sign two different messages (you need two z values) using the same private key and the same r (therefore the same k) value.

In your question, you reference two transactions signed by different private keys (which you know by noticing their public keys differ), and therefore you do not have enough information to correctly calculate the k value.

In the other similar question you recently asked, the two transactions were signed by the same private key (and they have the same r & k), so in that case it is possible to calculate the private key. (The service you linked to appears to calculate it correctly, however it doesn't display the uncompressed address.)

Answer 2

Answering your question: "what's wrong"?

For each transaction you can write down an equation:

x*r + m = s*k

where x is the private key, r and s the signature. m the message hash, k the signing secret. All calculations are modulus the group order.

You are looking at two transactions with the same 'r'. You could write equations for those two like this:

x1*R + M1 = S1*k
x2*R + M2 = S2*k

Here I use UPPER case letters to indicate the known values, and lower case to indicate the unknowns.

The problem is that you end up with two equations with three unknowns. This cannot be solved at this point.

There is however a solution for this particular case:

Here I created a graph where each node has the first 8 digits of the r-value and x-coord of the pubkey.

The red node indicates the r-value you are interested in. Square boxes indicates a public-key, round/oval nodes are the r-values. The Arrows indicate a signature using that pubkey.

You can see the green arrows form a loop in the diagram.

These form four transactions as follows:

t1: r1, pub1
t2: r1, pub2
t3: r2, pub2
t4: r2, pub1

from that you can derive four equations in four unknowns, which you can solve:

x1*R1+M1=S1*k1
x2*R1+M2=S2*k1
x2*R2+M3=S3*k2
x1*R2+M4=S4*k2

Then from there you can follow all the chains and find all the other keys.

Note that this is only a small part of this network, in total there are 1814 related transactions.

A side note, that 2coin.org link no longer works, but you can do the same calculations on this page ( by me ): https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html

Answer 3

same r value is used for two different bitcoin addresses? finding privatekey of both address? @amaclin can you explain briefly how did you get private key. Answer with formula and program

and @Christopher Gurnee

How you think he cheated. There is any way to finding privatekey of both address? When same r value is used for two different bitcoin addresses. Please answer with formula and program

Answer 4

I have found as bellow:

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
r = 0x6bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a
s1 = 0xa044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe6
s2 = 0x75e41da2596619e837af69cdf80933e519abd736210677970a6ac23a3709ee2e
z1 = 0x9ffb92bc05a398e3177b12fcdac5308d316b6bd6cc00365177711dc4e3f10e64
z2 = 0x539bcbcddc3fff95aa262d01b8a909504958b371b813cb71a457efebb41c398e

K = GF(p)

K((z1s2 - z2s1)/(r*(s1-s2)))

result dec: 8921113496817264148701652880922087877926656286340189747525982520215619494205

result hex: 13b92bda88a3f2dbac6032865bf56eed68eea22d4461c77404ad79c49697e13d