Signature nonce reuse and scalar recovery

Mechanism

DSA-style signatures combine a message hash, a private scalar, and a per-signature nonce. Repeating the nonce can expose the private scalar through modular equations. Related or partially biased nonces require stronger assumptions and sometimes lattice techniques. Equal signature components are a useful clue but should be interpreted within the scheme and encoding.

Practical method

Parse the signature into integer components and identify the exact curve or subgroup order. Recompute the message hashes using the correct serialization. For a suspected repeated nonce, solve the pair of signature equations and verify the candidate public key. Distinguish deterministic nonce generation from unsafe nonce repetition across different messages.

s = k^(-1) (h + r*x) mod q
s1 - s2 = k^(-1) (h1 - h2) mod q
# Recover k, then x, when the required inverses exist.

Interpreting evidence

A candidate scalar must reproduce the known public key and verify both signatures. Handling low-s normalization may require testing the corresponding sign choices rather than using the displayed components blindly.

Pitfalls and limits

Hash truncation rules matter. Equal r values can have multiple causes. Modern deterministic nonce schemes avoid random-generator failure but still depend on correct implementation and domain separation.