I've seen many peoples are actually recovering their private keys using signatures pub key r s z values etc , anyway , I've found a way to recover it but using transaction hex i can't found the identical R value , is there any other way to recover it from r s z ? or is it possible to recover any private key using random R values ? I have tried this method , In my case the values of R are different , this method is just for example having same/identical R value. ;

def inverse_mod( a, m ):
    """Inverse of a mod m."""
    if a < 0 or m <= a: a = a % m
    # From Ferguson and Schneier, roughly:
    c, d = a, m
    uc, vc, ud, vd = 1, 0, 0, 1
    while c != 0:
        q, c, d = divmod( d, c ) + ( c, )
        uc, vc, ud, vd = ud - q*uc, vd - q*vc, uc, vc

    # At this point, d is the GCD, and ud*a+vd*m = d.
    # If d == 1, this means that ud is a inverse.
    assert d == 1
    if ud > 0: return ud
    else: return ud + m

def derivate_privkey(p, r, s1, s2, hash1, hash2):
    z = hash1 - hash2
    s = s1 - s2
    r_inv = inverse_mod(r, p)
    s_inv = inverse_mod(s, p)
    k = (z * s_inv) % p
    d = (r_inv * (s1 * k - hash1)) % p
    return d, k


# this case is right
r =0xd47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2)

# this case can be wrong
r =0x0861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d

print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2) 

1 Answer 1


is there any other way to recover it from r s z ?

What is the purpose of private key, if anyone would be able to recover it from other data?

is it possible to recover any private key using random R values ?

the probability is the same as trying random values for guessing private key itself

  • as you can see on that example , the output of that example is actually a private key of an existing bitcoin address . so I am asking if there's any other method/code which can calculate private key just like example but without having an identical R value . Mar 21, 2018 at 15:36
  • @DionWinbush And the answer perfectly answered that. If there was such a way, the private key would no longer be private and so the entire design would be fundamentally broken. Of course there is no known reason to think the design if fundamentally broken or people wouldn't be using it! Mar 22, 2018 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.