Is it possible to recover nonces from ecdsa signatures if the private key is known ? If yes, how?

Question

Simple question, given a signed message and signature, if a nonce is known, then it’s possible to recover the private key. But what about doing the reverse ? I’m meaning using the private key to recover the nonce ?

Given :

 R: 00df359e57f5e14b8dccf09daf6ec634f48cfc105658e0fc1bf53926af5494498a
 S: 392816fdecd0122f306b96b68a863f338abb0e874657adf22bb685b2e38826ce
 message hash: 6c44185598b9fd22ac7c8bd8349f5a5894c4e02da9bbd672fd59cd67ce2cfb8f

I tried Mod(0x392816fdecd0122f306b96b68a863f338abb0e874657adf22bb685b2e38826ce,0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141)^-1*(0x6c44185598b9fd22ac7c8bd8349f5a5894c4e02da9bbd672fd59cd67ce2cfb8f+0x527a792b183c7f64a0e8b1f4*0xdf359e57f5e14b8dccf09daf6ec634f48cfc105658e0fc1bf53926af5494498a) which gives an incorrect result in Pari/ɢᴘ while the pubkey recovered from the signature match the $527a792b183c7f64a0e8b1f4$ private key (since $r$ contains the x part of $nonce×Generator\_point$).

Answer 1

Sure. The equation that connects the private key, the nonce, the message representative and the signature is a simple one, and knowing any three of the four values gives you the fourth. The equation is $$ s = k^{-1} (h + r d) \mod n $$ where

• $n$ is the group order;
• $d$ is the private key;
• $k$ is the nonce;
• $h$ is the message representative (hash of the message, projected onto the curve);
• $(r,s)$ is the signature.

Thus the nonce can be calculated as $k = s^{-1} (h + r d) \bmod n$.

To analyze an ECDSA implementation, first check if it always outputs the same signature when the key and the message are the same. That is deterministic ECDSA and it's secure. You don't need to calculate the nonce to validate an ECDSA implementation functionally: just check that its output is the same as another implementation that you trust, for the same curve, hash function, key and message.

If the implementation is non-deterministic, then it's vital that the nonce $k$ must be uniformly random. If an adversary can guess some bits of the nonce, it tends to add up across signatures. For example, if an adversary have access to a set of secp256k1 signatures and they can tell for each signature whether the top bit is 0 or 1, then they can recover the private key with a large enough number of signatures. (As of early 2025, as far as I know, the number of signatures is still impractical, but attacks have been improving steadily, so I expect practical attacks with a single bit of leakage within the next few years.) This can happen if the implementation chooses $k$ badly with the top bit always set to $0$, or if adversary can see how long the signature operation takes and the timing depends on the top bit. With multiple bits of leakage, the leakage does add up, for example 9 known bits on a 521-bit curve allows private key recovery at a high probability with 60 signatures, compared to a theoretical 56 if you just add up the number of leaked bits.