mcdouglasx, Bob, the code you provided does not allow me to recover D1 in this case. D2 used R = 729debfti99 first. Then, D1 used the same R = 729debfti99 twice.

I have the nonce k of D2 and its private key, but I can’t find D1.