How to calculate PrivateKey from NONCE R and Z

[Nivison]

I know how to do it when we have R,S,Z and K
But i want to know how to calculate the private key When you have the R,Z and K but don't have the S value.

[achow101]

You can't. s is the part of the signature that actually "contains" all of the important components such as the private key. The formula for computing the private key requires s as none of the other components involves the private key in their calculation.

[BlackHatCoiner]

Signature is [r, s], with

• r being the x-coordinate of k*G, and
• s being equal with k^(-1) * (z + r * d)

Since you don't know d, and you neither know s, you can't work out the private key.

[NotATether]

It's an equation with four variables, you can't solve it if you only have two of them as BlackHatCoiner and achow pointed out, just how it works in any other kind of equation.


R is just a transformation of the nonce - if you know that, you can already compute R without knowing it.