The math from the previous lesson never failed. What fails, with depressing regularity, is the drawing of the third line — and when it fails, the private key appears in four lines of algebra that any high school student can follow.
Suppose two signatures made with the same key and the same nonce k, on different messages. Since r is the x-coordinate of the point k times G, and k is the same, the r of both is identical — and this is visible on the blockchain, for free, to anyone looking.
Write down both: s1 is the inverse of k times the sum of z1 with r times d; s2 is the inverse of k times the sum of z2 with r times d. Subtract one from the other. The terms with r times d cancel out because they are identical, leaving s1 minus s2 as the inverse of k times z1 minus z2. Isolate: k is equal to z1 minus z2 divided by s1 minus s2. With k in hand, go back to the first equation and isolate d, which is s1 times k minus z1, divided by r.
That's it. Two subtractions, two divisions, and the private key is on the screen. There is no brute force, no table, no special hardware — and there is no defense after the fact, because the two signatures are already published and no one can erase them.
The first famous case was not in Bitcoin. On December 27, 2010, at the Chaos Computer Club congress in Berlin, the fail0verflow group showed that Sony signed PlayStation 3 software always using the same k — a constant value, written in the code. Any two signatures were enough. The key that authorized all the console's software was deduced publicly, on stage.
In Bitcoin, the equivalent disaster came in August 2013. A flaw in Android's random number generator caused applications to receive the same randomness seed, and wallets that signed more than one transaction repeated nonces without any indication of a problem. On August 11, the site bitcoin.org published the alert. Those scanning the blockchain for repeated r values had already emptied the affected addresses.
And the problem is not historical. Researchers who scan the entire blockchain for repeated r values continue to find occurrences, almost always from homemade wallets and improvised programs.
The defense is elegant and has been the standard since 2013: stop drawing. RFC 6979 describes how to derive k deterministically, applying HMAC over the private key and the message digest. The k remains unpredictable to outsiders because it depends on the private key, but it no longer depends on the machine's random generator quality. The same key signing the same message always produces the same signature — which, besides being secure, is convenient for testing.
There is also a more subtle version of the same problem, and it is beautiful enough to deserve the final paragraph. It is not necessary to repeat the entire nonce. It is enough for it to leak a little — for the first bits to be predictable, for example, because the generator is biased. Each signature then gives away a piece of information. Gathering a few hundred of them, a lattice reduction technique recovers the entire private key from these pieces, without any nonce ever being repeated.
Notice what all these breaches have in common: none of them attacked the curve. The secp256k1 remains intact, the discrete logarithm remains unsolved, and what fell was always a piece of poorly written code or a defective generator.
However, there is an entire family of attacks that goes straight to the mathematics — not because they believe it to be fragile, but because they choose intervals where the square root of the space ceases to be intimidating. This is what makes blockchain challenges possible, and it is the subject of the next module.