ECDSA nonce reuse private key recovery

ECDSA requires a fresh random nonce k for every signature. Reuse it once and the private key is recoverable by algebra - not by brute force, not probabilistically, but exactly, from two signatures.

The two-equation solve

Two signatures with the same k share the same r, since r depends only on k. That shared r is how you spot the flaw in a signature dump. From s1 = k^-1 (h1 + r*d) and s2 = k^-1 (h2 + r*d), subtract to eliminate d, solve for k, then substitute back for d.

k = (h1 - h2) * pow(s1 - s2, -1, n) % n
d = (s1 * k - h1) * pow(r, -1, n) % n     # the private key

If the nonces are merely biased rather than repeated - a few known top bits, say - the algebra does not apply, but lattice reduction does. See the biased nonce attack.