the same r and the same s but another xpubkey

[Sansa_Stark]

yes, but we are not talking about r , but about diff in 2 pubkeys with the same r:)

[garlonicon]

It does not matter, because you have the same linear relation between your private key "d" and your signature nonce "k".

Code:

s=(z+rd)/k
sk=z+rd
sk-z=rd
d=(sk-z)/r
d=(s/r)k-(z/r)
d+(z/r)=(s/r)k
Q=d*G
R=k*G
Q+(z/r)=(s/r)R

If you have "d=(s/r)k-(z/r)", then you can have the same "d", so that "d1=d2", so:

Code:

d=(s1/r1)k1-(z1/r1)
d=(s2/r2)k2-(z2/r2)

Here, "(s/r)" and "(z/r)" are known, so:

Code:

d=const1*k1-const2
d=const3*k2-const4

You can also have the same signature nonce "k" and different private keys "d", it does not matter at all:

Code:

sk=z+rd
k=(z+rd)/s
k=(z/s)+(r/s)d
k=const1+const2*d1
k=const3+const4*d2

See? You have two new variables for each equation, so you always have one more variable than equation. That means, from algebraic point of view, it has many solutions. For example, assign k=1, you will get some solutions for d1 and d2. Assign k=2, you will get completely different solutions. The same for assigning d-values above.

[albert0bsd]

yes, but we are not talking about r , but about diff in 2 pubkeys with the same r:)

I think that you have NO idea of what are you doing.

Well is not the same thing yes I agree with that, but the mathmatics behind what are you trying to do is exactly the same.

The things that I wrote still apply because you have new different variables that is why you can't mix those equations. if you do it, any results that you get will be wrong.

See? You have two new variables for each equation, so you always have one more variable than equation. That means, from algebraic point of view, it has many solutions. For example, assign k=1, you will get some solutions for d1 and d2. Assign k=2, you will get completely different solutions. The same for assigning d-values above.

Exactly