Quote from: lontivero on December 16, 2014, 07:57:45 PM

Quote from: itod on December 16, 2014, 07:16:05 PM

Quote from: bcearl on December 16, 2014, 02:01:44 PM

https://www2.informatik.hu-berlin.de/~verbuech/klepto-ecdsa/

Interesting observation from that paper I don't remember ever seeing before:

Quote

Another slightly related security issue also arose from the fact that k has to be chosen by the signature algorithm. If two values k₁, k₂ in two different signatures have a known linear relationship k₂ = ak₁ + b with a, b ∈ Z, the private key d can be extracted from the two signatures without the knowledge of the values k₁, k₂, since it results in two linear equations with only d and k₁ unknown.

It means that two R values don't have to be identical (reused) for their private keys to be breakable, it's enough for them to be "close" to each other, so that R₂ can be found adding G to R₁ relatively small number of times, few million for instance so it would be implementable in practice to check the neighborhood of every R value ever used against the complete set of R's. I know that two R values in theory should not ever be close to each other if RNG is decent, but we see in practice that not only they are close but often identical.

That is what I was talking about all the day, they don't have to be identical at all and that why nobody will realise about the "bug" except the developer who introduced it.

Yes, I agree with you to a certain extent if the developer kept the application as closed source. However, in this case, it appears to be an honest mistake.

Please see:
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c