The wikipedia page on ECDSA signature explains how the signer's private key can be recovered if two signatures are produced with the same random (private key looking) element
k. In fact, it is claimed on the DSA page that a fault in the implementation of
SecureRandom class have led to such collision. I would like to confirm that in principle, it is possible to write code checking for such collisions in the blockchain in order to steal bitcoin private keys in the hope that some faulty wallet implementation has prevailed somewhere. Does the following algorithm outline make sense?
- Check every signature of every transaction input in the blockchain
- If two signatures correspond to the same public key, check if same
- If same
rassume there is a collision and derive private key
- Check if corresponding address is part of utxo set
Assuming this can be implemented, has it been done already?