Pages:
Author

Topic: Bitcoin puzzle (3,350.00 BTC's ) (Read 2792 times)

hero member
Activity: 862
Merit: 662
October 31, 2021, 04:21:00 PM
#54
Hello albert0bsd,
So, may i ask if this is a real legit puzzle that is solvable then?
or is this a fake puzzle?
and if this puzzle is solvable, what is the chances that actually someone unlock that 3350 BTC Address?
Regards!

Well i don't believe that this puzzle is real, but that is what i believe based in what i know about the Elliptic Curve Signatures. The OP don't want to make a message signed with that publickey, that is a strong sign that is not real. but who knows.

Regards!
jr. member
Activity: 37
Merit: 1
October 31, 2021, 01:20:20 PM
#53
Hello albert0bsd,
So, may i ask if this is a real legit puzzle that is solvable then?
or is this a fake puzzle?
and if this puzzle is solvable, what is the chances that actually someone unlock that 3350 BTC Address?
Regards!
hero member
Activity: 862
Merit: 662
October 30, 2021, 12:41:00 AM
#52
Well i just calculate some values for k1, k2 and the privatekey but the generated private key don't generate your publickey

Quote
k1: 0xbe404cba76f7018e965637f859560b59701ea7b2b50c3ba2d9899bc14e451032
k2: 0x7c809974edee031d2cac6ff0b2ac16b4258e727ebacfd709f340d8f5cc53df23
pvk: 0x8bfc718f4753611d61d043b499a2af787590cfb220959734c9c8c28406588ee

With any of the values k1 or k2 we can calculate the pvk with the next equation:

pvk = ( k*s - z)/r  (Mod N)

Using your rsz values and my values k1 and k2, both substitutions in equation always give me the same privatekey and well this obvious the equations assume that K2 = 2 * K1 and all the subsequent substitutions come from that supposition.

I heard from other people trying to solving this example in the testnet, that they also solved some privatekey but also they doesn't generate your publickey.



For those who wanna to know how or where the numbers come from, please read ECDSA: Elliptic Curve Signatures there are one equation, that we can use to solve some elements.


(1) :  s = k-1 * (z + r * d) (mod n)

That is the equation that generate the s value. d is the privatekey from that equation we can derive the private key with all the other values s,r,z and k

(2) :  d = ksr-1 - zr-1 (mod n)

We have 2 TX values (s,r,z) with an unknow k, but we "know" the relationship between the two k values

(3) : k2 = 2*K1

Since the equation (2) solve the same private key with the 2 distinct values of r,s,z and k of our transaction we can  use it in the next way

(4) : k1s1r1-1 - z1r1-1 = k2s2r2-1 - z2r2-1 (mod n)

if we substitute (3) in (4) and and then we can solve for k1

(5) : k1 = (z1r1-1 - z2r2-1) / (s1r1-1 - 2r2-1s2) (mod n)

Once that you have the value of k1 you can use it to solve k2 using the equation (3) and use the complete set of values r,s,z and k to solve the private key in the equation (2)



A little code in C using gmp to show this example:

Code:
/*
  gcc -o k1_solver k1_solver.c -lgmp
*/

#include
#include
#include
#include
#include
#include

struct Point {
mpz_t x;
mpz_t y;
};

struct Elliptic_Curve {
mpz_t p;
mpz_t n;
};

struct Elliptic_Curve EC;
const char *EC_constant_N = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141";

void calculate_pvk(mpz_t pvk,mpz_t r_inv,mpz_t s,mpz_t z,mpz_t k);

int main()  {
mpz_t z1,z2,r2,r1,s1,s2,k1,k2;
mpz_t a,b,c,d,e,f,r1_inv,r2_inv,f_inv;
mpz_t pvk_calulated;

mpz_init_set_str(EC.n, EC_constant_N, 16);
/* Set the R S Z values of the first TX */
mpz_init_set_str(r1,"42c995eb98c38a8f3de7dde0f5ac63a67441a7e96b821f53931495bc6ea64cb0",16);
mpz_init_set_str(s1,"35a526e609d7022249d46d2392ff7e66b11a303d137204eb909867ae272c24b1",16);
mpz_init_set_str(z1,"c8d3c14a3b190b6ea53ce4317fdd51ca1cf1a235dffbc3ce566507061f901a5a",16);
/* Set the R S Z values of the second TX */
mpz_init_set_str(r2,"4f8bfa709c788b2ed59dd44a16e0c7b22ca7dece56d27144d418577a38b1d0d2",16);
mpz_init_set_str(s2,"096f65fa2a2c6c054b12981c42b0aece4ac861632a2900ced39070f0dd2e86e1",16);
mpz_init_set_str(z2,"57b1d4f6111f1dd7b87db91931682bad285aa2587c6239f7d3beb319ff2e0834",16);

/*Init variables GMP stuff */
mpz_init(pvk_calulated);
mpz_init(r1_inv);
mpz_init(r2_inv);
mpz_init(a);
mpz_init(b);
mpz_init(c);
mpz_init(d);
mpz_init(e);
mpz_init(f);
mpz_init(k1);
mpz_init(k2);

/*This Operations are based in the suposition that k2 = 2 * k1 mod n   */
/* calcualte the r1 and r2 Invert*/
mpz_invert(r1_inv,r1,EC.n); // r1_inv = 1/r1
mpz_invert(r2_inv,r2,EC.n); // r2_inv = 1/r2

mpz_mul(a,z1,r1_inv); // a = z1 * r1_inv
mpz_mul(b,z2,r2_inv); // b = z2 * r2_inv
mpz_sub(c,a,b); // c = a - b


mpz_mul(d,r1_inv,s1); // d = r1_inv * s1

mpz_mul(e,r2_inv,s2); // e = r2_inv * s2
mpz_mul_ui(e,e,2); // e = 2 * e

mpz_sub(f,d,e); // f = d - f

mpz_invert(f_inv,f,EC.n); // f_inv = 1/f

mpz_mul(k1,f_inv,c); // k1 = f_inv * c
mpz_mod(k1,k1,EC.n); // k1 = k1 mod n

gmp_printf("k1: %Zx\n",k1);
mpz_mul_ui(k2,k1,2); // k2 = 2 * k1
mpz_mod(k2,k2,EC.n); // k2 = k2 mod n
gmp_printf("k2: %Zx\n",k2);

/* Calculate the pvk with the set of values of the first TX */
calculate_pvk(pvk_calulated,r1_inv,s1,z1,k1);
gmp_printf("pvk_calulated: %Zx\n",pvk_calulated);

/* Calculate the pvk with the set of values of the second TX */
calculate_pvk(pvk_calulated,r2_inv,s2,z2,k2);
gmp_printf("pvk_calulated: %Zx\n",pvk_calulated);
}

void calculate_pvk(mpz_t pvk,mpz_t r_inv,mpz_t s,mpz_t z,mpz_t k) {
mpz_t a,b;
mpz_init(a);
mpz_init(b);
mpz_set(a,k);
mpz_mul(a,a,s);
mpz_mul(a,a,r_inv);
mpz_set(b,r_inv);
mpz_mul(b,b,z);
mpz_sub(a,a,b);
mpz_mod(a,a,EC.n);
mpz_set(pvk,a);
mpz_clear(a);
mpz_clear(b);
}

Regards!
newbie
Activity: 12
Merit: 5
October 04, 2021, 06:36:29 PM
#51
You state that you're giving away 3,350 BTC and yet, you haven't provide us a signed message. What's your excuse for not providing a signed message?

If I understood OP correctly, this is not a puzzle or challenge created by them, instead they're trying to crack a key and thinking they're very close & encouraging others to find the solution.
However wrong assumptions were made and it turned out that it's not so easy to crack a Bitcoin private key  Roll Eyes Grin
Almost that... although I think it's considered a puzzle
its been 6 months.  Do you have any plans on sharing educational material with results which can be reproduced to prove the theory?
member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
September 05, 2021, 12:09:49 PM
#50
I do have a custom ECC library in JS, it'll be straightforward to add r,s,z calculations and make a browser app that can compute these automatically, to remove manual errors.
Great. I usually calculate manually, sometimes due to lack of attention it results in some errors
member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
September 05, 2021, 11:49:07 AM
#49
You state that you're giving away 3,350 BTC and yet, you haven't provide us a signed message. What's your excuse for not providing a signed message?

If I understood OP correctly, this is not a puzzle or challenge created by them, instead they're trying to crack a key and thinking they're very close & encouraging others to find the solution.
However wrong assumptions were made and it turned out that it's not so easy to crack a Bitcoin private key  Roll Eyes Grin
Almost that... although I think it's considered a puzzle
member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
September 05, 2021, 11:45:57 AM
#48
yes
Here it is!

(((TESTNET)))

I sent two transactions to this address:muFPtSuYmYpaqdrNFtwNfm5j2fK2WMtRoz

Transaction 1: https://tbtc.bitaps.com/0faeffb396eebecdade89ef0f66aa002893c3dcb2787283f2d2e6a38edd1da1c/mmjRyw4Zgn7QQVuqTe4YLQmcn82b8aD2L6

z = 0xc8d3c14a3b190b6ea53ce4317fdd51ca1cf1a235dffbc3ce566507061f901a5a
r = 0x42c995eb98c38a8f3de7dde0f5ac63a67441a7e96b821f53931495bc6ea64cb0
s = 0x35a526e609d7022249d46d2392ff7e66b11a303d137204eb909867ae272c24b1

------------------------------------------------------------------------------------------------------------------------------------------------------------------

Transaction 2: https://tbtc.bitaps.com/4728a81966ae288b3c4d9ef781acd9cefe51b7869876abf8796f52940603014e/mmjRyw4Zgn7QQVuqTe4YLQmcn82b8aD2L6

z = 0x57b1d4f6111f1dd7b87db91931682bad285aa2587c6239f7d3beb319ff2e0834
r = 0x4f8bfa709c788b2ed59dd44a16e0c7b22ca7dece56d27144d418577a38b1d0d2
s = 0x096f65fa2a2c6c054b12981c42b0aece4ac861632a2900ced39070f0dd2e86e1

My address : mmjRyw4Zgn7QQVuqTe4YLQmcn82b8aD2L6

My public key : 028ce829db535d42389defbf9ba58731f56ddb1cc7a189e5e30a85d63eb225b5d2

The k value of the second transaction is double the first: k1 * 2 = k2
legendary
Activity: 1568
Merit: 6660
bitcoincleanup.com / bitmixlist.org
September 01, 2021, 12:12:43 PM
#47
I do have a custom ECC library in JS, it'll be straightforward to add r,s,z calculations and make a browser app that can compute these automatically, to remove manual errors.
newbie
Activity: 5
Merit: 1
September 01, 2021, 11:19:36 AM
#46
hi everyone..!
I am not clever in crypto, but I do understand the maths. I started reading discussion from the beginning. some people they pretended like einstein..doing lot of mathematics until I though they cracked the private key...just wasted my time reading and trying to understand this shit mathematics...finally the fund is there.... Grin Grin Grin Grin Grin...no body cracked till now.? Huh why all these symbols and mathematics..? even my grand mum can write these symbols..

sr. member
Activity: 333
Merit: 506
August 31, 2021, 02:14:09 PM
#45
Yup for sure, if it really is a puzzle, maybe there are some more details that could help to actually solve it which they lacked to mention in the initial post here.
Puzzles are exciting man but this thread is very confusing; first everyone thought that OP created a puzzle, then it turned out they have no private keys, now it's unsure if a puzzle even exists lol.

hero member
Activity: 882
Merit: 5834
not your keys, not your coins!
August 31, 2021, 09:25:40 AM
#44
Someone managed to solve this puzzle, did I miss something?
Doesn't seem so, funds never moved.
hero member
Activity: 882
Merit: 5834
not your keys, not your coins!
August 30, 2021, 02:59:50 PM
#43
I don't think that interiawp tries to find the supposedly hidden 3,350 BTC; he/she just experiments with the maths of ECC as I've noticed from other threads.
Riiight I see. The thread should be renamed though if there is no puzzle  Cheesy

If I understood OP correctly, this is not a puzzle or challenge created by them, instead they're trying to crack a key and thinking they're very close & encouraging others to find the solution.
OP should at least provide the source of the puzzle, where did he find it, by whom etc.
Yup for sure, if it really is a puzzle, maybe there are some more details that could help to actually solve it which they lacked to mention in the initial post here.
Puzzles are exciting man but this thread is very confusing; first everyone thought that OP created a puzzle, then it turned out they have no private keys, now it's unsure if a puzzle even exists lol.
legendary
Activity: 1512
Merit: 7340
Farewell, Leo
August 30, 2021, 02:33:25 PM
#42
PS. BlackHatCoiner I think you don't understand the curve. it is not receipt , it is math and you can do what you want with curve.
Look, I'm not an expert on the elliptic curves. I'm just interested and learn whenever I'm able to. Your way, indeed, works now that I've rethought about k2 being replaced by k1*2. The whole problem occurs when you know nothing for both k and r, but in this case you can find d given that you have one unknown value k and two unknown values r.

(Didn't actually try your equation, but the steps seem fine by me)

I'm gonna be honest, I'm right now not 100% what you are trying to do and what your result tells us, but if you were able to crack the key, you should just show us by moving the funds  Smiley
I don't think that interiawp tries to find the supposedly hidden 3,350 BTC; he/she just experiments with the maths of ECC as I've noticed from other threads.

If I understood OP correctly, this is not a puzzle or challenge created by them, instead they're trying to crack a key and thinking they're very close & encouraging others to find the solution.
OP should at least provide the source of the puzzle, where did he find it, by whom etc.
hero member
Activity: 882
Merit: 5834
not your keys, not your coins!
August 30, 2021, 01:17:42 PM
#41
WORKED!
RESULT: 2000

PS. BlackHatCoiner I think you don't understand the curve. it is not receipt , it is math and you can do what you want with curve.

I'm gonna be honest, I'm right now not 100% what you are trying to do and what your result tells us, but if you were able to crack the key, you should just show us by moving the funds  Smiley
hero member
Activity: 882
Merit: 5834
not your keys, not your coins!
August 30, 2021, 01:14:59 PM
#40
You state that you're giving away 3,350 BTC and yet, you haven't provide us a signed message. What's your excuse for not providing a signed message?

If I understood OP correctly, this is not a puzzle or challenge created by them, instead they're trying to crack a key and thinking they're very close & encouraging others to find the solution.
However wrong assumptions were made and it turned out that it's not so easy to crack a Bitcoin private key  Roll Eyes Grin
legendary
Activity: 1512
Merit: 7340
Farewell, Leo
August 30, 2021, 12:58:28 PM
#39
one of this h (hash of message) is wrong! this is why it cannot  nonce be calculated.
Why would the hash of the message matter? The fact that k1 = k2 * 2 doesn't mean that h1 = h2 * 2. Please, elaborate.

@interiawp If I create 2 real transactions... same private key X and with the value k1 * 2 = k2. Would you be able to calculate the value of X?
No, because you can't divide in ECC and what you're asking is, essentially, if elliptic curve division is possible. In order for someone to work out your private key from two signatures he needs to somehow calculate k. Only if k is the same in both signatures (and so does r), you can find out d.

It's the same thing as saying that there's a private key α and a private key β which is 2*α. You can't calculate any of the private keys if I just give you αG and βG.



You state that you're giving away 3,350 BTC and yet, you haven't provide us a signed message. What's your excuse for not providing a signed message?
member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
August 30, 2021, 11:08:56 AM
#38
According to question from bytcoin (first page):

@bytcoin:

calculate k2 when k2 is 2xk1 with the same private key is trivial.

but in your example:

Nonce k1
r = 385570073629551546729230374184391439442417095537024350206131291065055332733
s = 76130260662571134678372154009160868461537800596554110575850229341703072615102
h = 42268864623620244998249895290537358742158169262361846431272029622156081203721

Nonce k2 (k1 / 2 = k2)
r = 79948557280043978274449002532600374620672215928697101734828211284733327158664
s = 56368220214898939855776145385640746541620815395185097101215290078962069907292
h = 87726031595873281985439431891132599611815665254308710544703498112157039462043

one of this h (hash of message) is wrong! this is why it cannot  nonce be calculated.

it cannot be calculated, becouse: you have divide by application real (r,s,h) to get 1/2 of k.

your program cannot calculate 1/2 h > "hash of message" properly.
and this is why others calculation(result) are wrong.

if you give me real values( 2 transaction ) with information that k1 = 2 x k2 or k1 = 10x k2 or whatever
I will give you the nonce k1 and k2 and key.

If you want just pm.
I am back!

I chose a real signature on the blockchain and forged the second signature without knowing the private key. The forged signature has passed all validations and is valid...but it's still virtually impossible to calculate with the first one! I need to improve my calculations

@interiawp If I create 2 real transactions... same private key X and with the value k1 * 2 = k2. Would you be able to calculate the value of X?

newbie
Activity: 7
Merit: 0
April 17, 2021, 08:49:25 AM
#37
Hello! @NotATether Great to have you here in this thread... you are very welcome. I have some interesting news from the other thread. And I also have a method that almost solved this one. And more other interesting things. I will send the link of this tool that you asked for.
The other day we will talk in private

I am newbie
how to run code with sage and python
can you provide sage and python code

off topic post below

r1: 99935505760319748698811422354322418311203851828465328908708024011195996180829
                s1: 14810718830809274529170993651437030466460552688297005873719201854608653306524
                e1: 84635513758865831094131084311208775267495704821994249663954751780286420288259
                r2: 115035229747891778996889965749694763606205313739267493174821202115705061416296
                s2: 56412229366601912356674994073152925730313351483910294670205660420888695151902
                e2: 711922952377524543467576566144169816136170490747613227449590530659320692002
              s1-1: 49589235156255394867995584868850296899036724345858375131186053009052960413985
              s2-1: 75860710922369590624024015031955497020040967297713867268831531011990818769063
            s2-1e2: 24319896032458654235859288439366790171987421552616806414321622974227628294346
            s1-1e1: 33373073398809441106621025265904429856170478887328914010434069704980389675914
            s2-1r2: 102756882304321902845902604711749179835279156262963247575454606290129811589248
            s1-1r1: 109263722787838616791900575947640359553086907200677310074463510255775504782173
1 - s2-1e2 + s1-1e1: 9053177366350786870761736826537639684183057334712107596112446730752761381569
    s2-1r2 - s1-1r1: 109285248753799481477573013772796728135029813341360841883596259175872468301412
 (s2-1r2 - s1-1r1)-1: 88597492899895469960154264896435952736065060080234931949365434864574123803941
                dU: 74071287274168731384314914382498140270634658281328726941106265589917762050271


thanks in advance...


Hello! @NotATether Great to have you here in this thread... you are very welcome. I have some interesting news from the other thread. And I also have a method that almost solved this one. And more other interesting things. I will send the link of this tool that you asked for.
The other day we will talk in private

I am newbie
how to run code with sage and python
can you provide sage and python code

off topic post below

r1: 99935505760319748698811422354322418311203851828465328908708024011195996180829
                s1: 14810718830809274529170993651437030466460552688297005873719201854608653306524
                e1: 84635513758865831094131084311208775267495704821994249663954751780286420288259
                r2: 115035229747891778996889965749694763606205313739267493174821202115705061416296
                s2: 56412229366601912356674994073152925730313351483910294670205660420888695151902
                e2: 711922952377524543467576566144169816136170490747613227449590530659320692002
              s1-1: 49589235156255394867995584868850296899036724345858375131186053009052960413985
              s2-1: 75860710922369590624024015031955497020040967297713867268831531011990818769063
            s2-1e2: 24319896032458654235859288439366790171987421552616806414321622974227628294346
            s1-1e1: 33373073398809441106621025265904429856170478887328914010434069704980389675914
            s2-1r2: 102756882304321902845902604711749179835279156262963247575454606290129811589248
            s1-1r1: 109263722787838616791900575947640359553086907200677310074463510255775504782173
1 - s2-1e2 + s1-1e1: 9053177366350786870761736826537639684183057334712107596112446730752761381569
    s2-1r2 - s1-1r1: 109285248753799481477573013772796728135029813341360841883596259175872468301412
 (s2-1r2 - s1-1r1)-1: 88597492899895469960154264896435952736065060080234931949365434864574123803941
                dU: 74071287274168731384314914382498140270634658281328726941106265589917762050271


thanks in advance...


This works with standard signature. Mine are forged signatures or you can call them blind signatures. The calculation is much more complicated! I believe it is totally solvable ... If you can get some method that can merge the calculation of a standard signature vs forged signature it would be good.

I was using the other thread  to do some calculations. Remembering that the forged signatures that I recreate do not need to sign data or prove anything ... it just needs to be forged and that they have the values r, s and h that satisfy the calculation to find a private key. I know it's confusing. I will show some calculations related to my other thread .
PRIVADE KEY = 74071287274168731384314914382498140270634658281328726941106265589917762050271

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829
s1 = 49589235156255394867995584868850296899036724345858375131186053009052960413985
z2 = 0
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296
s2 = 38207519993275076423632821614369697864201677311262964726666122651535684123121
x  = GF(p)

x    (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

This one has the same parameters as the 3,350 BTC puzzle same private key and the nonce of the second signature (k1 / 2 = k2) the second nonce k is half the nonce of the first signature.The difference is that here I know the k

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84161583072841456669059952378962616999584763854943151345373830328904632908285
r1 = 94314914130653988673888770692000596437449719230712969855406611816122161753818      
s1 = 22494341240730831470571507988479127051360132620614139425560703058275568234720
z2 = 84635513758865831094131084311208775267495704821994249663954751780286420288259
r2 = 99935505760319748698811422354322418311203851828465328908708024011195996180829
s2 = 49589235156255394867995584868850296899036724345858375131186053009052960413985
x = GF(p)

x  (43622407236688973229510697286560312319272310986763330555167501359776293201463+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

I inverted the order and replaced s1 with its own inverse  modular and did the same with s2. Then replace 1+ with k +. It is already a way to try to find some method that solves it.

Look at this one ... it's getting fun!

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 0
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829      
s1 = 107074468996081319021460734830045966618222458319611877930291706090648733800102
z2 = 0
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296      
s2 = 38207519993275076423632821614369697864201677311262964726666122651535684123121
x = GF(p)

x   (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

Now this last one ...

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84635513758865831094131084311208775267495704821994249663954751780286420288258
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829      
s1 = 60641406722465826032271764495324651446430317390841265423474818277065347735949
z2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296
s2 = 5926985887680998340381673345353182670979487968029788012609647734652828070871
x = GF(p)

x   (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271


Blind and forged signatures are not useless! it is possible to calculate them with real signatures.
I am trying to improve these methods. I still have a lot of work to do


Good Try
I don't know coding , can Help me ...
why can't send private messages for other users???
I too give some article clues...
Thanks

member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
April 16, 2021, 11:16:33 AM
#36
Hello! @NotATether Great to have you here in this thread... you are very welcome. I have some interesting news from the other thread. And I also have a method that almost solved this one. And more other interesting things. I will send the link of this tool that you asked for.
The other day we will talk in private

I am newbie
how to run code with sage and python
can you provide sage and python code

off topic post below

r1: 99935505760319748698811422354322418311203851828465328908708024011195996180829
                s1: 14810718830809274529170993651437030466460552688297005873719201854608653306524
                e1: 84635513758865831094131084311208775267495704821994249663954751780286420288259
                r2: 115035229747891778996889965749694763606205313739267493174821202115705061416296
                s2: 56412229366601912356674994073152925730313351483910294670205660420888695151902
                e2: 711922952377524543467576566144169816136170490747613227449590530659320692002
              s1-1: 49589235156255394867995584868850296899036724345858375131186053009052960413985
              s2-1: 75860710922369590624024015031955497020040967297713867268831531011990818769063
            s2-1e2: 24319896032458654235859288439366790171987421552616806414321622974227628294346
            s1-1e1: 33373073398809441106621025265904429856170478887328914010434069704980389675914
            s2-1r2: 102756882304321902845902604711749179835279156262963247575454606290129811589248
            s1-1r1: 109263722787838616791900575947640359553086907200677310074463510255775504782173
1 - s2-1e2 + s1-1e1: 9053177366350786870761736826537639684183057334712107596112446730752761381569
    s2-1r2 - s1-1r1: 109285248753799481477573013772796728135029813341360841883596259175872468301412
 (s2-1r2 - s1-1r1)-1: 88597492899895469960154264896435952736065060080234931949365434864574123803941
                dU: 74071287274168731384314914382498140270634658281328726941106265589917762050271


thanks in advance...


Hello! @NotATether Great to have you here in this thread... you are very welcome. I have some interesting news from the other thread. And I also have a method that almost solved this one. And more other interesting things. I will send the link of this tool that you asked for.
The other day we will talk in private

I am newbie
how to run code with sage and python
can you provide sage and python code

off topic post below

r1: 99935505760319748698811422354322418311203851828465328908708024011195996180829
                s1: 14810718830809274529170993651437030466460552688297005873719201854608653306524
                e1: 84635513758865831094131084311208775267495704821994249663954751780286420288259
                r2: 115035229747891778996889965749694763606205313739267493174821202115705061416296
                s2: 56412229366601912356674994073152925730313351483910294670205660420888695151902
                e2: 711922952377524543467576566144169816136170490747613227449590530659320692002
              s1-1: 49589235156255394867995584868850296899036724345858375131186053009052960413985
              s2-1: 75860710922369590624024015031955497020040967297713867268831531011990818769063
            s2-1e2: 24319896032458654235859288439366790171987421552616806414321622974227628294346
            s1-1e1: 33373073398809441106621025265904429856170478887328914010434069704980389675914
            s2-1r2: 102756882304321902845902604711749179835279156262963247575454606290129811589248
            s1-1r1: 109263722787838616791900575947640359553086907200677310074463510255775504782173
1 - s2-1e2 + s1-1e1: 9053177366350786870761736826537639684183057334712107596112446730752761381569
    s2-1r2 - s1-1r1: 109285248753799481477573013772796728135029813341360841883596259175872468301412
 (s2-1r2 - s1-1r1)-1: 88597492899895469960154264896435952736065060080234931949365434864574123803941
                dU: 74071287274168731384314914382498140270634658281328726941106265589917762050271


thanks in advance...


This works with standard signature. Mine are forged signatures or you can call them blind signatures. The calculation is much more complicated! I believe it is totally solvable ... If you can get some method that can merge the calculation of a standard signature vs forged signature it would be good.

I was using the other thread  to do some calculations. Remembering that the forged signatures that I recreate do not need to sign data or prove anything ... it just needs to be forged and that they have the values r, s and h that satisfy the calculation to find a private key. I know it's confusing. I will show some calculations related to my other thread .
PRIVADE KEY = 74071287274168731384314914382498140270634658281328726941106265589917762050271

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84635513758865831094131084311208775267495704821994249663954751780286420288259
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829
s1 = 49589235156255394867995584868850296899036724345858375131186053009052960413985
z2 = 0
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296
s2 = 38207519993275076423632821614369697864201677311262964726666122651535684123121
x  = GF(p)

x    (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

This one has the same parameters as the 3,350 BTC puzzle same private key and the nonce of the second signature (k1 / 2 = k2) the second nonce k is half the nonce of the first signature.The difference is that here I know the k

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84161583072841456669059952378962616999584763854943151345373830328904632908285
r1 = 94314914130653988673888770692000596437449719230712969855406611816122161753818      
s1 = 22494341240730831470571507988479127051360132620614139425560703058275568234720
z2 = 84635513758865831094131084311208775267495704821994249663954751780286420288259
r2 = 99935505760319748698811422354322418311203851828465328908708024011195996180829
s2 = 49589235156255394867995584868850296899036724345858375131186053009052960413985
x = GF(p)

x  (43622407236688973229510697286560312319272310986763330555167501359776293201463+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

I inverted the order and replaced s1 with its own inverse  modular and did the same with s2. Then replace 1+ with k +. It is already a way to try to find some method that solves it.

Look at this one ... it's getting fun!

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 0
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829      
s1 = 107074468996081319021460734830045966618222458319611877930291706090648733800102
z2 = 0
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296      
s2 = 38207519993275076423632821614369697864201677311262964726666122651535684123121
x = GF(p)

x   (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271

Now this last one ...

p  = 115792089237316195423570985008687907852837564279074904382605163141518161494337
z1 = 84635513758865831094131084311208775267495704821994249663954751780286420288258
r1 = 99935505760319748698811422354322418311203851828465328908708024011195996180829      
s1 = 60641406722465826032271764495324651446430317390841265423474818277065347735949
z2 = 27086795414784162292297506376302057554366609881154614249233399373002336547922
r2 = 115035229747891778996889965749694763606205313739267493174821202115705061416296
s2 = 5926985887680998340381673345353182670979487968029788012609647734652828070871
x = GF(p)

x   (1+s1*z1-s2*z2)/(s2*r2-s1*r1)

x = 74071287274168731384314914382498140270634658281328726941106265589917762050271


Blind and forged signatures are not useless! it is possible to calculate them with real signatures.
I am trying to improve these methods. I still have a lot of work to do
member
Activity: 211
Merit: 20
$$$$$$$$$$$$$$$$$$$$$$$$$
April 16, 2021, 10:51:08 AM
#35
Hello! @NotATether Great to have you here in this thread... you are very welcome. I have some interesting news from the other thread. And I also have a method that almost solved this one. And more other interesting things. I will send the link of this tool that you asked for.
The other day we will talk in private

I am newbie
how to run code with sage and python
can you provide sage and python code

off topic post below

r1: 99935505760319748698811422354322418311203851828465328908708024011195996180829
                s1: 14810718830809274529170993651437030466460552688297005873719201854608653306524
                e1: 84635513758865831094131084311208775267495704821994249663954751780286420288259
                r2: 115035229747891778996889965749694763606205313739267493174821202115705061416296
                s2: 56412229366601912356674994073152925730313351483910294670205660420888695151902
                e2: 711922952377524543467576566144169816136170490747613227449590530659320692002
              s1-1: 49589235156255394867995584868850296899036724345858375131186053009052960413985
              s2-1: 75860710922369590624024015031955497020040967297713867268831531011990818769063
            s2-1e2: 24319896032458654235859288439366790171987421552616806414321622974227628294346
            s1-1e1: 33373073398809441106621025265904429856170478887328914010434069704980389675914
            s2-1r2: 102756882304321902845902604711749179835279156262963247575454606290129811589248
            s1-1r1: 109263722787838616791900575947640359553086907200677310074463510255775504782173
1 - s2-1e2 + s1-1e1: 9053177366350786870761736826537639684183057334712107596112446730752761381569
    s2-1r2 - s1-1r1: 109285248753799481477573013772796728135029813341360841883596259175872468301412
 (s2-1r2 - s1-1r1)-1: 88597492899895469960154264896435952736065060080234931949365434864574123803941
                dU: 74071287274168731384314914382498140270634658281328726941106265589917762050271


thanks in advance...


I tried to solve the first and the second signature respectively
dU = (1 - s2-1e2 + s1-1e1) * (s2-1r2 - s1-1r1)-1 (mod n)

Any one can help me please.....
The calculations are much more difficult than I imagined ... To try to solve this you need to have a very advanced knowledge of linear equations.
The only clue is that the nonce k of the second forged signature is half of the first signature. What remains for us is to try to find some method to explore this information. ANY INFORMATION on the private key or nonce is very valuable. I'll give you an example ... If anyone knows if the private key is even or odd or if the public key is from a private key above 57896044618658097711785492504343953926418782139537452191302581570759080747168, it is possible to factor ... and in approximately 10 minutes discover any private key.

Pages:
Jump to: