Quote from: Yves Cuicui on September 09, 2013, 03:41:24 PM

If k is equal to d, the private key can be calculated by d = z(s-r)^-1 (z is the reduced message hash)!

Quote from: Yves Cuicui on September 09, 2013, 04:51:18 PM

The subject is not that RNG are broken or bugged or ... I just want to draw attention to a situation on which nobody thinks

That is all true what you say, but generating a really random random k that would be equal to d... hmm, good luck with it!
And even if you do it, the way for the attacker to check if you actually did the mistake, is by computing: d = z(s-r)^-1
Such a computation does not seem to by much more resource friendly then a regular private to public key conversion.
So if you want to test each k value whether it might be (by a chance) the d, you might as well start testing k-1, k+1, k-2, k+2, k-3, k+3, and so on... because each of these values, a potential attacker can try to test as the private key.
And then, if you get paranoid enough, you will essentially end up with a solution in which any k value is not safe Wink