ECDSA: reuse a nonce, lose the key
Two signatures with the same k share the same r. Four lines of algebra later, the private key falls out.
1 / 6
The signer has a private key d and publishes Q = d·G. Red values are secret.
What to notice
- The giveaway is visible to anyone: both signatures have the same r.
- Subtracting the two signing equations cancels d·r and leaves k. Once k is known, d follows from either signature.
- This is how the PlayStation 3 signing key was recovered in 2010. Modern libraries derive k deterministically (RFC 6979).