5 ms·

He's saying you can derive the private key from a single signature made using a known nonce value (the "bad random"). You can also derive the private key from t

He's saying you can derive the private key from a single signature made using a known nonce value (the "bad random"). You can also derive the private key from two signatures made using the same nonce value. In both cases the solution just requires trivial algebra. That's what we did to get the PS3 signing keys. Accidentally became a bit of a citation in the ECDSA world for that one too; who knew Sony would unwittingly earn the title of "canonical example of how to screw up ECDSA in a consumer product"? :-) It's also how lots of Bitcoin have been taken away when transactions are signed using broken random number generators. These days people are running bots to spot those keypairs and automatically take the bitcoin.

tombeak 5y ago
Craig was Wright then, you can't derive the private key from a single transaction. Bitcoin would be broken if you could.
- marcan_42 5y ago
  Rather, Craig had no idea what the conversation was even about.
  - tombeak 5y ago
    Dr Nicolas Courtois - "You can get a private key from one single transaction or from one single digital signature." That's false.
    - marcan_42 5y ago
      That's missing context. It's true if the nonce is predictable.
      - tombeak 5y ago
        Craig Wright - "The nonces I used are non-standard." Dr Nicolas Courtois - "Well, uhhhum that's the question." Craig Wright told him that he used non-standard nonces, not predictable ones.