Post
Topic
Board Development & Technical Discussion
Re: [CHALLENGE] 5 BTC Reward – ECDSA Structured Nonce k Puzzle (1M Signatures)
by
jvaimamu
on 11/06/2025, 07:20:33 UTC
I’m releasing a cryptographic challenge designed for experts in Bitcoin ECDSA internals, elliptic curve analysis, and nonce pattern vulnerabilities. There is a 5 BTC reward for the first person who solves it. Read the structure carefully.

The Puzzle Overview:
I have posted a file containing 1,000,000 valid signatures for one fixed public key.
Each signature is given as (sig_num, r, s, z, A, rx, ry)  where:
r, s, and z are standard ECDSA signature parameters (z is the hashed message)
A is added to the private key to produce the nonce k used for that signature
k = d + A (mod n)
rx, ry are the elliptic curve point coordinates of r

PUBLIC KEY:
04c1c1e912c51061424286bdea075e0a19a96be1869566f4ebc9ea3e565f9c334d1779371fd313e dc2955b14f3eaabf8af027f77a7b3e1e908839d4f7ee81aef28
X = 87638989873003743107580407194345607023493955367007042197569832403610862629709
Y = 10617364466289823353593438673072375587688363537404447133738278709366498193192

Important Details
The nonce values for signatures increase incrementally:
1st signature: k = d + 2
2nd signature: k = d + 3
3rd signature: k = d + 4
... and so forth, continuing this pattern for all 1,000,000 signatures.
In every signature, r == s
Apply for only this dataset,
CSV file download (1 million signatures): https://is.gd/1million_rsz


Edit :  Additional 2,000,000 ECDSA Signatures Released for Making this puzzle Solvable
Data Access: https://is.gd/Another1M_RSZ
Data Access: https://is.gd/Another1M_RSZ2
Important: All signatures satisfy r ≠ s.
Each line contains: r, s, z, ry
where r and s are the ECDSA signature components, z is the message hash, and ry is the y-coordinate of the curve point corresponding to r.


Bounty:
Recover any valid k and post it here with the corresponding signature index.
Or recover the private key directly from any subset of signatures.
Post your result here along with your Bitcoin address to receive the bounty.
💰 Prize: 5 BTC
⏱ Paid within 24 hours of verified result.

If you successfully recover any nonce k or the private key d, post your result here along with your BTC address to receive the 5 BTC reward.


Rewards & Rules
5 BTC payout within 24 hours after proof of valid nonce or private key recovery.

Puzzle Purpose:
This cryptographic challenge is an integral step in advancing the development of a novel cryptocurrency protocol inspired by Bitcoin’s UTXO model, yet architected with quantum-resistant cryptographic primitives. By analyzing structured ECDSA nonce patterns and their vulnerabilities, the goal is to rigorously test classical elliptic curve assumptions, improve nonce generation schemes, and inform the design of next-generation signature algorithms resilient against quantum adversaries.


To the person who created this problem...
Please solve this problem first.
There are 13.5 bits.
It is exactly the same, R == S, and Z is created by me.
I can create millions of them, but it's a waste of time, so I will only present two problems in the same format.
Here is the public key:
02145d2611c823a396ef6712ce0f712f09b9b4f3135e3e0aa3230fb9b6d08d1e16

R                = 0x4806fcc582332d33610d925fc06afcbb8b141cb4d87fa401effdfb59d4011f99
S                = 0x4806fcc582332d33610d925fc06afcbb8b141cb4d87fa401effdfb59d4011f99
Z                = 0xa5f9777f19c3d9d3443e09e0a8120b413da3a78bc8b182791bf14cd4a33466a3

R                = 0xe12ec23c6d7ee189c248807bac60206a5cf8ea7f899214ca9d0a2a8ddc44d7cf
S                = 0xe12ec23c6d7ee189c248807bac60206a5cf8ea7f899214ca9d0a2a8ddc44d7cf
Z                = 0x6d17d3bc1305497d13b0bc8f7abe94ccd448a1377ea79d5e7f57da8d4ede8f1



so, you say it is possible to create z by only rs and pub key. how?
It can be made with just elementary school-level knowledge.

To explain a simple formula:

Private Key: 120

Public Key:
(0xdd5ba67cfb807824bd3ff25e9d1667fa89e7020e8e0becb79caa00f574adc826,
0xd6b837116fa89fa1d0d6e193aaaf5a5642425d84290545f294a0753a915b644c)

Now, let’s say we are using a formula where we add the private key like this:

Public Key 120 + (Private Key 56457)

Then we get:

R = 56,577 → (which is just 56457 + 120)

S = 1

Z = 56457

This is the most basic relationship among R, S, and Z.

So, for example:
Public Key 120 = 56577 - 56457

This kind of thing used to be difficult to understand or build, but over time, many people studied cryptography and math concepts, and now it’s much more approachable.

In fact, I created this kind of concept on YouTube three years ago:

📺 https://youtu.be/G3veKAXGyFo

And I even made a calculator that can perform these kinds of operations three years ago too:

📺 https://youtu.be/9i6cQOTYAkU




Nice & Simple Logic.