BurtW
Legendary
Offline
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 17, 2021, 11:31:58 PM |
|
This is the data that works: p = 115792089237316195423570985008687907852837564279074904382605163141518161494337 h1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s1 = 14810718830809274529170993651437030466460552688297005873719201854608653306524
h2 = 711922952377524543467576566144169816136170490747613227449590530659320692002 r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s2 = 56412229366601912356674994073152925730313351483910294670205660420888695151902
This is the data that does not work: p = 115792089237316195423570985008687907852837564279074904382605163141518161494337 h1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s1 = 14810718830809274529170993651437030466460552688297005873719201854608653306524
h2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922 r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s2 = 75792077109774170129890375817094910949609540422199126584222852124036872408123
p, h1, r1, s1 and r2 are identical in both data sets. This means you used the same private/public key pair and the same starting value for k in both cases. However the values of h2 and s2 are different between the two cases. What exactly did you change between the working and the not working case? Just the message? For sure you started with the same k value. Since both cases use k for the first value and you are claiming that the second k value in both cases is k + 1 then it looks like maybe all you did was change the message?
|
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated!
|
|
|
gmaxwell
Moderator
Legendary
Offline
Activity: 4228
Merit: 8644
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 18, 2021, 08:23:37 AM |
|
The point of my last reply is that I assume there is no 'message' in these cases, instead of some material hashed the values were just chosen in order to result in the singularity.
|
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 18, 2021, 12:15:51 PM Last edit: February 18, 2021, 01:14:36 PM by bytcoin |
|
@BurtW I would like to thank you for trying to help me!I value and try to learn from all the comments from the bitcoin community. Answering your question ... is k and k + 1.The private key is the same for all signatures.
sig = 1
h = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s = 14810718830809274529170993651437030466460552688297005873719201854608653306524 k = 87244814473377946459021394573120624638544621973526661110335002719552586402926 x = 74071287274168731384314914382498140270634658281328726941106265589917762050271
sig = 2
h = 27086795414784162292297506376302057554366609881154614249233399373002336547922 r = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s = 75792077109774170129890375817094910949609540422199126584222852124036872408123 k = 87244814473377946459021394573120624638544621973526661110335002719552586402927 x = 74071287274168731384314914382498140270634658281328726941106265589917762050271
The purpose of this thread is to find some method that calculates this type of signatures...to find k or x.
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7171
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 18, 2021, 04:19:16 PM Last edit: February 18, 2021, 06:34:48 PM by NotATether |
|
Have you by any chance read this? https://eprint.iacr.org/2019/023.pdfIt describes methods which let us compute private keys if we have multiple signatures but using the same nonce. So maybe we can take the stuff there and apply it to the case we have a bunch of signatures with k and k+1 nonces. And by extension, k + constant M nonces. First off it says if we know k then we can just get the private key with d A = (sk - h)r -1 mod n. But here we have two signature that use k and k+1. I suppose we can do some sort of attack with this by discovering the k of one signature and then "assuming" that for a large list of (r,s) signatures, that some of them have k+1, k+2, ... or k+M nonces. It also gives the case of two signatures having the same nonce, where you can recover the private key by doing d A = (h 1 - h 2)(s 1 - s 2) -1 mod -n. Now we have s 1 = k 1-1(h 1 + d Ar 1) mod n and s 2 = k 2-1(h 2 + d Ar 2) mod n. That means d A = (s 1k 1 - h 1)r 1-1 mod n = (s 2k 2 - h 2)r 2-1 mod n. We have r 1 = r 2 because k is not used to calculate it. This simplifies things further to (s 1k 1 - h 1) mod n = (s 2(k 1 + M) - h 2) mod n (s 1k 1 - h 1) mod n = (s 2k 1 + s 2M - h 2) mod n. Let's take this last equation and use algebra to move k 1 to the left. (s 1k 1 - s 2k 1) mod n = (s 2M - h 2 + h 1) mod n k 1(s 1 - s 2) mod n = (s 2M - h 2 + h 1) mod n k1 = (s2M + h1 - h2)(s1 - s2)-1 mod n (I just reordered h1 in front of h2 which doesn't change the equation) Where M =1 if you are using k,k+1 and M=2 if you have k,k+2, etc. and it works for M=0 and negative M as well (which you'd use for k,k-1, k,k-2, and so on.
EDIT: If we plug Nk + M instead of just k + M, following the proof derivation above (which I can repost for this particular case if you want) gives us k 1 = (s 2M + h 1 - h 2)(s 1 - s 2N) -1 mod n. I'm sure there's a formula for k 2 being an arbitrary polynomial of k 1, I'm still trying to find one for that. EDIT2: for k,k 2+M we have k 1(s 1 - s 2) + s 2k 12 mod n = (s 2M - h 2 + h 1) mod n. So at this point it seems that you have to calculate terms of a series find the root of this polynomial if you want an solve for arbitrary k2 = a + bk1 + ck1^2 + ...
|
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 18, 2021, 07:30:12 PM |
|
@NotATether you did a great search! I liked your method.Do you need more signatures like these? Today I didn’t have much free time, but tomorrow I will have more time to try to find new methods. Today I only had time to analyze the formulas that worked for the other thread ... I modified the formulas to try to calculate here ... I had some advances!
p = 115792089237316195423570985008687907852837564279074904382605163141518161494337 h1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s1 = 14810718830809274529170993651437030466460552688297005873719201854608653306524 h2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922 r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s2 = 75792077109774170129890375817094910949609540422199126584222852124036872408123
Any method that results in one of these results ... will be a huge step forward to create some formula that calculates the private key of these types of signatures.
84116094074080348475330923628085381068004819051024688231235408808498228990658 115421525668746794300572425383651760936474682288376011738901581099735267291166 75779132765082272339365318603976127143129139578655065948953011818747694903968 32721048879590668468057403381344519604794634274281442143310950080100256809376 73945527799545926295868811396190775221755301413228649694146980038976859413881 83071040357725526955513581627343388248042930004793462239294213061417904684961 110900498335176639903790421791145116630753202651925129197353093911482849572115 100915994223500593859265530587355021827054480090260046643398682409155495014021 18772090316994453489815097488437362913349084079003363299774406415210330663724 47226580324836868909364298177641258714214836472397407238813848770680029086521 56529777543389028600359529180589793809150046410530956964827364144104464543696 68565508912479326514206686831046649138622727806677497143791314370838132407816 95614300240862244467441604468469811057219298200932829791855660913288043519424 91853994770595467928679085106674415264953937877422163279062103074479382308082 70340029117077187103609015206390689046236439143934658628690673731161038123272 56288579777741994839950743658321865276315378685235290603150428105356141792460 114077498629986369252568485796816272967465715858922414102041658195335049229411 59503509459574200583620241350366042576522185593839613779454735036162019701877 3157016186039629198989683176712727066004916479529634997551227882338456118091 113972727122455751122606348709450118426555794247055235259681988180640808438349 78050106958269618215705840346149000019834478654902500371716973685533534066650 34169847425881711646023480055546162114713522315602218622530542999194715662193 73621331483084656777597982069714150546901789628714569435738760993298398924203 81622241811434483777547504953141745738124041963472685760074620142323445832144 70340029117077187103609015206390689046236439143934658628690673731161038123272 44718176830454434898540719422248360645570272508025487909509951706716265490856 95614300240862244467441604468469811057219298200932829791855660913288043519424 103424397717883027870089109342747919895699044054631965972702579473119258609686 21101819692638526149317216481479108956505606170114713781324009606425162496681 12367691519433167553481875665939987957138520224442938409902583668398902884651 112635073051276566224581301831975180786832647799545269385053935259179705376246 34169847425881711646023480055546162114713522315602218622530542999194715662193 37741982279046577207865144662538907833003085624172404010888189455984627427687 113972727122455751122606348709450118426555794247055235259681988180640808438349 42170757754231538645973002938973757305935774650360334946866402148219762570134 1819362114860444300964636299237789426281770032019669122923174960877353055988
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10778
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 04:00:38 AM Merited by NotATether (1) |
|
We have r1 = r2 because k is not used to calculate it. This simplifies things further to (s1k1 - h1) mod n = (s2(k1 + M) - h2) mod n
I think you are mixing two different things here. If k 2==k 1 then r 2==r 1but If k 2!=k 1 then r 2!=r 1 (the case where k 2=k 1 + M) and you can't remove it. Keep in mind that k is also a private key (the ephemeral key) with public key R and r is the x coordinate of it mod n. In other words k is used to calculate r.
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7171
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 04:35:36 AM |
|
I think you are mixing two different things here. If k2==k1 then r2==r1 but If k2!=k1 then r2!=r1 (the case where k2=k1 + M) and you can't remove it. Keep in mind that k is also a private key (the ephemeral key) with public key R and r is the x coordinate of it mod n. In other words k is used to calculate r.
Good catch. Fortunately this doesn't change the solution much, only r 2-1r 1 has to be added at the right hand side of all the solutions and to simplify things further they aren't multiplied by k. @NotATether you did a great search! I liked your method.Do you need more signatures like these? Today I didn’t have much free time, but tomorrow I will have more time to try to find new methods. Today I only had time to analyze the formulas that worked for the other thread ... I modified the formulas to try to calculate here ... I had some advances!
The good thing about this is that I only need two signatures, one is for a known k, the other from an unknown k which is related to the first k somehow. By changing the value of the other k (ie trying different formulas to calculate it), I can brute force the unknown k by using Taylor series to expand any complex terms in the equation for unknown k like exp(x) or log(x), and then take the resulting polynomial of k and find it's root. I'll try to find a method for it today. p = 115792089237316195423570985008687907852837564279074904382605163141518161494337 h1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s1 = 14810718830809274529170993651437030466460552688297005873719201854608653306524 h2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922 r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s2 = 75792077109774170129890375817094910949609540422199126584222852124036872408123
Any method that results in one of these results ... will be a huge step forward to create some formula that calculates the private key of these types of signatures. ~
What are all those numbers you posted at the bottom, one of the ECDSA variables?
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10778
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 04:57:20 AM |
|
Good catch. Fortunately this doesn't change the solution much, only r2-1r1 has to be added at the right hand side of all the solutions and to simplify things further they aren't multiplied by k.
It does change everything. You can't just ignore the multiplied value in here (s1k1 - s2k1) mod n = (s2M - h2 + h1) mod n
The correct thing is: (s 1k 1 - s 2k 1r 2-1r 1) mod n = (s 2Mr 2-1r 1 - h 2r 2-1r 1 + h 1) mod n
|
|
|
|
mamuu
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 73
Merit: 19
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 09:12:59 AM |
|
I would like to remember The denominator value in mod N with the numbers you gave is 0 sage: s1*r2-s2*r1 -5870565115156863143967205950922086098709780287420322365789905571260282461016136233055572663350029552122182409141177952688017925412898993949944021339758863
sage: (s1*r2-s2*r1)%N 0
|
1DWA3Sa8i6eHVWV4AG4UP2SBhYB2XrfiHW
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 01:52:58 PM |
|
@NotATether Sometimes, my comments are confusing. My English is not good. I'm sorry. I created a spreadsheet here on my computer. If the calculation of the two signatures, result in one of these results:
84116094074080348475330923628085381068004819051024688231235408808498228990658 115421525668746794300572425383651760936474682288376011738901581099735267291166 75779132765082272339365318603976127143129139578655065948953011818747694903968 32721048879590668468057403381344519604794634274281442143310950080100256809376 73945527799545926295868811396190775221755301413228649694146980038976859413881 83071040357725526955513581627343388248042930004793462239294213061417904684961 110900498335176639903790421791145116630753202651925129197353093911482849572115 100915994223500593859265530587355021827054480090260046643398682409155495014021 18772090316994453489815097488437362913349084079003363299774406415210330663724 47226580324836868909364298177641258714214836472397407238813848770680029086521 56529777543389028600359529180589793809150046410530956964827364144104464543696 68565508912479326514206686831046649138622727806677497143791314370838132407816 95614300240862244467441604468469811057219298200932829791855660913288043519424 91853994770595467928679085106674415264953937877422163279062103074479382308082 70340029117077187103609015206390689046236439143934658628690673731161038123272 56288579777741994839950743658321865276315378685235290603150428105356141792460 114077498629986369252568485796816272967465715858922414102041658195335049229411 59503509459574200583620241350366042576522185593839613779454735036162019701877 3157016186039629198989683176712727066004916479529634997551227882338456118091 113972727122455751122606348709450118426555794247055235259681988180640808438349 78050106958269618215705840346149000019834478654902500371716973685533534066650 34169847425881711646023480055546162114713522315602218622530542999194715662193 73621331483084656777597982069714150546901789628714569435738760993298398924203 81622241811434483777547504953141745738124041963472685760074620142323445832144 70340029117077187103609015206390689046236439143934658628690673731161038123272 44718176830454434898540719422248360645570272508025487909509951706716265490856 95614300240862244467441604468469811057219298200932829791855660913288043519424 103424397717883027870089109342747919895699044054631965972702579473119258609686 21101819692638526149317216481479108956505606170114713781324009606425162496681 12367691519433167553481875665939987957138520224442938409902583668398902884651 112635073051276566224581301831975180786832647799545269385053935259179705376246 34169847425881711646023480055546162114713522315602218622530542999194715662193 37741982279046577207865144662538907833003085624172404010888189455984627427687 113972727122455751122606348709450118426555794247055235259681988180640808438349 42170757754231538645973002938973757305935774650360334946866402148219762570134 1819362114860444300964636299237789426281770032019669122923174960877353055988
My spreadsheet will find the private key and it will also be possible to create a formula that solves all the signatures we are trying to calculate.
For example: p = 115792089237316195423570985008687907852837564279074904382605163141518161494337 h1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259 r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829 s1 = 14810718830809274529170993651437030466460552688297005873719201854608653306524 h2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922 r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296 s2 = 75792077109774170129890375817094910949609540422199126584222852124036872408123
w = (h1*h2 -r1+r2/s1*s2) if the result was: 1819362114860444300964636299237789426281770032019669122923174960877353055988 or any of those others ... my spreadsheet finds the value x and it will also be possible to create a method that solves all types of signatures.
I'll use your equation ... it looks very efficient! If it works, you will enter the history of bitcoin. I think this thread will yield a lot of comments
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7171
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 03:03:22 PM |
|
Good catch. Fortunately this doesn't change the solution much, only r2-1r1 has to be added at the right hand side of all the solutions and to simplify things further they aren't multiplied by k.
It does change everything. You can't just ignore the multiplied value in here (s1k1 - s2k1) mod n = (s2M - h2 + h1) mod n
The correct thing is: (s 1k 1 - s 2k 1r 2-1r 1) mod n = (s 2Mr 2-1r 1 - h 2r 2-1r 1 + h 1) mod n So let me see if I understand this correctly, and for brevity all sides of each equation are mod n. (s 1k 1 - h 1)r 1-1 mod n = (s 2(Nk 1 + M) - h 2)r 2-1 mod n (s 1k 1 - h 1) mod n = (s 2(Nk 1 + M) - h 2)r 2-1r 1 mod n (s 1k 1 - h 1) mod n = (Ns 2k 1 + s 2M - h 2)r 2-1r 1 mod n (s 1k 1 - h 1) mod n = Ns 2k 1r 2-1r 1 + s 2Mr 2-1r 1 - h 2r 2-1r 1 mod n s 1k 1 - Ns 2k 1r 2-1r 1 mod n = s 2Mr 2-1r 1 - h 2r 2-1r 1 + s 1h 1 mod n (this is the one you corrected, all I did differently is I injected an N term. You missed an s 1 at the end) k 1(s 1 - Ns 2r 2-1r 1) mod n = s 2Mr 2-1r 1 - h 2r 2-1r 1 + s 1h 1 mod n k 1 = (s 2Mr 2-1r 1 - h 2r 2-1r 1 + s 1h 1)(s 1 - Ns 2r 2-1r 1) -1 mod n While this is correct, I could expand the right hand side to remove all those parentheses but it would look like a hairy mess and I will leave it as an exercise for the reader I'm a sucker for finishing what I started so the final result is: k 1 = s 1s 2Mr 2-1r 1 - s 1h 2r 2-1r 1 + s 1s 1h 1 - s 2Mr 2-1r 1N -1s 2-1r 2r 1-1 + h 2r 2-1r 1N -1s 2-1r 2r 1-1 - s 1h 1N -1s 2-1r 2r 1-1 mod n which can naturally be simplified to k 1 = s 1s 2Mr 2-1r 1 - s 1h 2r 2-1r 1 + 2s 1h 1 - MN -1 + h 2N -1s 2-1 - s 1h 1N -1s 2-1r 2r 1-1 mod n The terms without an M or N can be cached if you code this which'll save a some runtime, assuming signatures and message hashes are constant (which means we're just brute-forcing k by assuming the other k is different from k by a linear term, Nk + M).
|
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 03:59:26 PM |
|
Fried my brain ![Shocked](https://bitcointalk.org/Smileys/default/shocked.gif) k 1 = s 1s 2Mr 2-1r 1 - s 1h 2r 2-1r 1 + s 1s 1h 1 - s 2Mr 2-1r 1N -1s 2-1r 2r 1-1 + h 2r 2-1r 1N -1s 2-1r 2r 1-1 - s 1h 1N -1s 2-1r 2r 1-1 mod n I was thinking yesterday before I went to sleep and I think we can hardly resolve this. It must be related to the security and integrity of ECDSA. I think the degree of difficulty is the same as solving a discrete logarithm. Certainly, an obstacle has been placed in a way that cannot be solved. Will not give up! What do you all think?
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7171
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 06:45:15 PM Last edit: February 19, 2021, 07:06:20 PM by NotATether |
|
Fried my brain ![Shocked](https://bitcointalk.org/Smileys/default/shocked.gif) Just use the third-to-last one, it's condensed and easy to understand. k1 = (s2Mr2-1r1 - h2r2-1r1 + s1h1)(s1 - Ns2r2-1r1)-1 mod n
You're only interested in k,k+1 so just set N to 0 and M to 1 to get rid of at least one unnecessary term My mistake, you need to set N and M both to 1 to reduce it to k,k+1. ...
I was thinking yesterday before I went to sleep and I think we can hardly resolve this. It must be related to the security and integrity of ECDSA. I think the degree of difficulty is the same as solving a discrete logarithm. Certainly, an obstacle has been placed in a way that cannot be solved. Will not give up! What do you all think?
What do you mean? We already know s1 s2 r1 r2 h1 and h2, the constants M and N which I introduced can be removed by setting to the values at the top of this post, and n is the group order of secp256k1. That only leaves us with k as the unknown. The whole right-hand side becomes a constant which makes k solvable.
|
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 19, 2021, 07:43:39 PM |
|
@NotATether I just finished the tests ... I tried three more equations, including yours. I modified the equations, tried other methods but no progress for today. I know that we have only one unknown variant. That's what motivates me and gives me hope, but it's difficult! I may be talking nonsense, but for me this difficulty has to do with the security of ECDSA ... if we can really find some method that calculates these types of forged signatures it will be a great advance. Today is done! I think these calculations are driving me crazy
|
|
|
|
BurtW
Legendary
Offline
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 20, 2021, 03:47:37 PM |
|
@bytcoin Your question has been answered. Please very carefully read over these two posts: I really think this should work, unless I made a mistake in my math. Did you double check all my algebra?
The problem is that with these specific values given in OP it is not possible to compute this particular case. Whether you use my equation in that other topic to directly compute the private key ( du) or first compute k with your equation here then compute private key from there, you'll get 0 which you can't compute its modular multiplicative inverse ( ax ≡ 1 (mod m) where a=0 doesn't have an answer). To be specific: s2-1r2 - s1-1r1 = 0Also r's - rs' = 0It's not really an ecdsa signature if you're just handed a hash. ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) Performing the hashing is integral to the process and without it you can generate all sorts of degenerate examples. ... including 'forged' 'signatures' for pubkeys where no one knows the private key. @bytcoin, let me try to paraphrase these answers for you: If my formula to find k (and then find the private key) OR the formula in the other thread that finds the private key directly OR any of the other correct formulas in this thread or any other thread do not work to find the private key then the signature is not a valid signature.Do you understand now? Your question boils down to this: If I create a totally invalid signature why do these formulas not work? The answer is right there in your question: The reason it does not work is that you started with an invalid signature. I hope this help. BurtW
|
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated!
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 21, 2021, 02:41:22 PM |
|
@bytcoin Your question has been answered. Please very carefully read over these two posts: I really think this should work, unless I made a mistake in my math. Did you double check all my algebra?
The problem is that with these specific values given in OP it is not possible to compute this particular case. Whether you use my equation in that other topic to directly compute the private key ( du) or first compute k with your equation here then compute private key from there, you'll get 0 which you can't compute its modular multiplicative inverse ( ax ≡ 1 (mod m) where a=0 doesn't have an answer). To be specific: s2-1r2 - s1-1r1 = 0Also r's - rs' = 0It's not really an ecdsa signature if you're just handed a hash. ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) Performing the hashing is integral to the process and without it you can generate all sorts of degenerate examples. ... including 'forged' 'signatures' for pubkeys where no one knows the private key. @bytcoin, let me try to paraphrase these answers for you: If my formula to find k (and then find the private key) OR the formula in the other thread that finds the private key directly OR any of the other correct formulas in this thread or any other thread do not work to find the private key then the signature is not a valid signature.Do you understand now? Your question boils down to this: If I create a totally invalid signature why do these formulas not work? The answer is right there in your question: The reason it does not work is that you started with an invalid signature. I hope this help. BurtW I know that the concept of the signature is to prove data integrity, to prove that a person has a particular private key, to prove many other things. Now about these two signatures ... In theory, I prove that these two signatures on this topic are real and valid! Now in practice, it would even prove, but it would be totally impracticable and crazy to try brute force with pre image. If you think it's more correct ... I can change the title and description. k and k + 1 of signatures (theoretically real and valid) Is there any method for solving these types of theoretically signatures? Is it better this way?
|
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 21, 2021, 03:06:41 PM |
|
Fried my brain ![Shocked](https://bitcointalk.org/Smileys/default/shocked.gif) What do you mean? We already know s1 s2 r1 r2 h1 and h2, the constants M and N which I introduced can be removed by setting to the values at the top of this post, and n is the group order of secp256k1. That only leaves us with k as the unknown. The whole right-hand side becomes a constant which makes k solvable. Equation with only 1 variable and we were unable to solve it. I'm already getting agonized
|
|
|
|
COBRAS
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 896
Merit: 22
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 03, 2021, 11:46:19 AM |
|
So.... It is posible finde k with different s_1,b_1,z_1 and s_2,b_2,z_2 from one publick key transactions sign? Use a s_1,b_2, s_2=s_1,b_2 more easy I think... P.s. please, if you don know exact, do not post a messages about unrial find a k without s_1=s_2 P.s. all optimists are welcome ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
[
|
|
|
bytcoin (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 03, 2021, 06:24:35 PM |
|
I've been busy for the past few days ... I would like to show that the topic signature is real and valid (in theory) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FW7ESsdz.png&t=665&c=1s2qmojyPiq7GQ) x, k, r, h and s are in the order of the curve and are fully accepted by the bitcoin protocol! ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FPtp6wI6.png&t=665&c=TREmcUNyQSXJ_w) Satisfies all the math required of a valid signature This is not the objective of this thread . I am still trying to find some method to resolve these signatures. And I'm also creating other fun things ... this other thread is very interesting https://bitcointalk.org/index.php?topic=5321454.msg56483595#msg56483595
|
|
|
|
isarac3
Newbie
Offline
Activity: 8
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 24, 2021, 02:53:09 PM |
|
How can one calculate a message hash?
|
|
|
|
|