Exploring the Shift in R Signature for Different S and Z

so, valid signatures are made like this: a = random, b = random, r = aG + bQ, and then s = r * modinv(b, N) % N and z = a * s (b, N)% N. but how do we achieve the same r while getting different s and z? I've been trying a couple of methods where I shift aG and bQ to land on the same r without knowing a and b. in the first method, I just threw in a random t value for shifting points.

if you wanna double R, you gotta consider the original k and add z into the mix. so s_add can be whatever you want. like, k = your_k, then z_add = k * s_add. the equations would look like this: r2 = r1, s2 = s1 + s_add, z2 = z1 + z_add. but good luck solving for that unknown K. if we’re thinking about today’s tech, lattice and polynomial attacks might help... but brute force? no thanks.

looking at that formula again, once you have different a and b, you still land on the same r with different s and z. usually when using the same K nonce, r stays the same but you end up with different u1 and U2 values too. I’m starting from u1 and U2 first. take a regular method, get u1 and U2 from two signatures with matching r but different s and z, compute them and you’ll see u1=a and U2=b gives identical signatures. it’s tricky without the private key or K nonce.

I checked out your method a bit more, and it looks like you’re hitting that same r with random pubkey Q and yeah, without d or k, recreating it is a no-go. my code works for u1 known and method 2 with u2 known. honestly, it’s all the same deal even if u1 and u2 are randomized, as long as R stays intact but with different Q. this just shows how impressive secp256k1 security is.

you do realize that r = aG + bQ gives a valid signature for the right public key, right? if it’s not valid, like if the pubkey doesn’t match, then the signature could be valid according to ecdsa secp256k1 but totally invalid if the signatures don’t align with the same pubkey. lol, seriously? and quit bringing AI into this. it’s limited and only deals with what it knows, not new formulas.

yeah, AI has its limits. I’m comparing AI’s code results with mine that doesn’t require d or k, and guess what? they match. but solving that equation "doubler = ((z2*s1 z1*s2) * modinv(r2*(s2-s1),n) % n)" is still a challenge. AI sticks to that equation for the doubler, but I’m looking into various equations that AI hasn’t found yet. so far, the doubler methods haven’t worked out.