Topic: Nonce talk (Read 212 times)

r = 0xA0006BD73C2E587208D8A2BFDD3E650DC0307C6B6AFBFADA5A8434FBDF7FB6BE
z = 0x262316F1036B81F49DD1CA1891F1511C413E979FE87228E16D7F92CFF1E2619F
s = 0x302F58A8EE90236BE885CA8599666CA901097B7CAF1BF5D035B38EC06EB63AB8

The following are k and private keys, which can match the same group of rsz above

pvk = 0x0000000000000000000000000000000000011111111111111111111111111111
k = 0x6F66F604CDDE541F77A221AD403624084DCFED9D4E207CDDA1936511E1556933

pvk = 0000000000000000000000000000000000011111111111111111111111111112
k = 0xAFEDFACCD5489DBE4CDEA4BFEECAEC51D472169F5F86E59100B4182664BB584E

pvk = 0000000000000000000000000000000000011111111111111111111111111113
k = 0xF074FF94DCB2E75D221B27D29D5FB49B5B143FA170ED4E445FD4CB3AE8214769

r = 0xA0006BD73C2E587208D8A2BFDD3E650DC0307C6B6AFBFADA5A8434FBDF7FB6BE
z = 0x262316F1036B81F49DD1CA1891F1511C413E979FE87228E16D7F92CFF1E2619F
s = 0x302F58A8EE90236BE885CA8599666CA901097B7CAF1BF5D035B38EC06EB63AB8

The following are k and private keys, which can match the same group of r s z above

pvk = 0x0000000000000000000000000000000000011111111111111111111111111111
k = 0x6F66F604CDDE541F77A221AD403624084DCFED9D4E207CDDA1936511E1556933

pvk = 0000000000000000000000000000000000011111111111111111111111111112
k = 0xAFEDFACCD5489DBE4CDEA4BFEECAEC51D472169F5F86E59100B4182664BB584E

pvk = 0000000000000000000000000000000000011111111111111111111111111113
k = 0xF074FF94DCB2E75D221B27D29D5FB49B5B143FA170ED4E445FD4CB3AE8214769

...
...
...
There are 2^256 * 2^256  possibilities

def extended_gcd(aa, bb):
    lastremainder, remainder = abs(aa), abs(bb)
    x, lastx, y, lasty = 0, 1, 1, 0
    while remainder:
        lastremainder, (quotient, remainder) = remainder, divmod(lastremainder, remainder)
        x, lastx = lastx - quotient*x, x
        y, lasty = lasty - quotient*y, y
    return lastremainder, lastx * (-1 if aa < 0 else 1), lasty * (-1 if bb < 0 else 1)


def modinv(a, m):
    g, x, y = extended_gcd(a, m)
    if g != 1:
        raise ValueError
    return x % m


N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
# Control
# R = 0x00d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
# S = 0x0044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e
# Z = 0x00c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e
# X = 0x00c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96
# K = 0x007a1a7e52797fc8caaa435d2a4dace39158504bf204fbe19f14dbb427faee50ae

R = 0x007e6a9ba2cb33641246c5eb873d4ac35c6c9b0e24414789197e7ab7a1755c03e3
S = 0x00f5e5d215c56968f04f950044f89e056d8f7d637af698671d003e5be5f36c80c8
Z = 0x00a9327aba1cbc6180ef2ccd7263f9cccee589c6470c9bd0be27775e4339917daa

X = 0x00b468ebc8d97677f6fa98a2c5c1b55d5249632b655f1a9ac46736f4cfa7b7c12f
K = 0x0023f930da5ee9fd50a92fbb690803f799819647c800d173ffae062699fe59ae22

# proving R = (((S * K) - Z) / X) % N
print('R ' + hex((((S * K) - Z) * modinv(X, N)) % N))

# proving S = ((Z + (X * R)) / K) % N
print('S ' + hex(((Z + (X * R)) * modinv(K, N)) % N))

# proving Z = ((S * K) - (X * R)) % N
print('Z ' + hex(((S * K) - (X * R)) % N) + '\n')

# proving X = (((S * K) - Z) / R) % N
print('X ' + hex((((S * K) - Z) * modinv(R, N)) % N))

# proving K = ((Z + (X * R)) / S) % N
print('K ' + hex(((Z + (X * R)) * modinv(S, N)) % N) + '\n')