Discussion on Nonce and k Calculation

Nonce r from rsz is a coordinate of public key with privkey = nonce(k), which is the privkey of nonce pubkey R. R = E.Lift_x(r) R / k = G Can anyone share the formula for r from rsz?

You're posting about nonce here.

Got some options for you. I bet there are more mathematically inclined folks who can suggest different methods.

It’s r from k, not the X coordinate of public key with private key. To find k, you need to know rsz + private key. pvk = (inv(r) * ((k*s)-z)) % N k = (inv(s) * (z + r * pvk)) % N s = (inv(k) * (z + r * pvk)) % N r = (inv(pvk) * ((k * s) z)) % N If r, s, z are the same, private key and k can be any random combo (2^256 * 2^256).

Your nonce data is incorrect. You’ve got different nonces for the same r. For the right nonce, k * G should equal P(r, y). Here’s a nonce example: I don’t even need d and z to find nonce. Try calculating nonce with s= 1 and z= 0. Do you get the same k result?

Next three messages will show my calculations. Read my first example, then the other two should be easier to digest.

nonce = 12345678 ('r', 91699739317935258627372771550459504326006289891191381848862551863464593478869, 'cabc3692f1f7ba75a8572dc5d270b35bcc00650534f6e5ecd6338e55355454d5') ('s', 22470372326531182916048759846739219230161803771746602100872838172795117428239, '31adc7b06b05e7d950c11e0c4e2f0cca182f72924d7fdea9fdff5c29ee7ede0f') ('z', 77933714094255861201447687678278381229091537417560707361169638023191559091456, 'ac4ceb44a4ae896158c14566b2523afbb0e257fd40af4fccddc95a922efb3500') ('r/ i', 7427679493822474442260098760915318245462605609120161877611140665054166L, 73926912313746221600422969923536397027686)

Now I not use original s and z , s= 1 because calcs of modular invercion give me error then modinv(0) and noot need edit all code for remove s and z from formulas: nonce = 6 ('r', 115780575977492633039504758427830329241728645270042306223540962614150928364886, 'fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556') ('s', 1, '1') ('z', 0, '0') ('r/ i', 19296762662915438839917459737971721540288107545007051037256827102358488060814L, 96491488821126235788964783077096993442179817064390320625660269196703929057039) ('G', (55066263022277343669578718895168534326250603453777594175500187360389116729240 : 32670510020758816978083085130507043184471273380659243275938904335757337482424 : 1)) ('R', (115780575977492633039504758427830329241728645270042306223540962614150928364886 : 78735063515800386211891312544505775871260717697865196436804966483607426560663 : 1)) ('R/ r', (64539638574909914201464920709490791805550015061929458491040650138133077991612 : 24843128135812653164374146652732983116575858545376386173522986212406802597247 : 1)) ('G * r', (35671562626417242553516379018837644888384153781026704107247909605250122925475 : 24854100414953353366925262716821661496591256177379627589485089065011822957733 : 1)) ('G * i', (115780575977492633039504758427830329241728645270042306223540962614150928364886 : 78735063515800386211891312544505775871260717697865196436804966483607426560663 : 1), 6) ('R / i = G !!!', (55066263022277343669578718895168534326250603453777594175500187360389116729240 : 32670510020758816978083085130507043184471273380659243275938904335757337482424 : 1)) ('G*r*i', (83713544949310621073111602184378347401653653711846647537453958918525557556 : 15567843838197501364772534451023699018524046327927424384426971674530257773251 : 1)) ('R*r', (83713544949310621073111602184378347401653653711846647537453958918525557556 : 15567843838197501364772534451023699018524046327927424384426971674530257773251 : 1)) ('PUBKEY', (83713544949310621073111602184378347401653653711846647537453958918525557556 : 15567843838197501364772534451023699018524046327927424384426971674530257773251 : 1)) ('K(pubkey)', (83713544949310621073111602184378347401653653711846647537453958918525557556 : 15567843838197501364772534451023699018524046327927424384426971674530257773251 : 1)) ('BP', (35671562626417242553516379018837644888384153781026704107247909605250122925475 : 24854100414953353366925262716821661496591256177379627589485089065011822957733 : 1)) ('BP*i', (83713544949310621073111602184378347401653653711846647537453958918525557556 : 15567843838197501364772534451023699018524046327927424384426971674530257773251 : 1)) ('stride', 115780575977492633039504758427830329241728645270042306223540962614150928364886, 'hex r', 'fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556', 'r %n:', 'fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556') ('start range', 0) yes!!! ('Found real k:', 6, 'i', 'i%n', 6, 'hex i%n', '6') ('i / stride', 92881243615770048638449299342474665533833408430538685617041630338404606509534)

Then @Krashfire find his nonce in 6 month, looks like he find I like in my calcs, but then he put small finded i to firmukas with z,s, modinv of s,z yes he get a nonce 256 bit, maybe I not right but finding 256 bit in 6 monts is imposible... Tank you all for yours formulas, I think formulas of k without point is , maybe interesting if replace x to 1 and see what's is going on.... Any more ideas  ?

This dcrypt calcs incorrect for your rsz in code and for my rsz too ...

Try it Example, find signing secret. https://rawcdn.githack.com/nlitsme/bitcoinexplainer/aa50e86e8c72c04a7986f5f7c43bc2f98df94107/ecdsacrack.html My RSZ,  K  , Private Key is correct