Nonce Reuse

Every ECDSA signature needs a fresh secret number, used once and never again. It shares its name with the block-header nonce that miners vary, and means the same thing: a number used once. The number produces the r value on the chain. Sign two messages with the same private key and the same number, and the two signatures share an r; a few lines of algebra on their s values then recover the key.

Nils Schneider showed it on the live chain on 28 January 2013: a transaction with two inputs whose signatures shared r. He derived the key and, with the owner's permission, spent the funds. His explanation: "This transaction was generated by a hardware bitcoin wallet using a pseudo-random number generator that was returning the same 'random' number every time."

In August 2013 the problem went wide: Android's random number generator was badly seeded, putting every wallet that made keys on an Android device at risk. The bitcoin.org alert of 11 August 2013 said "key rotation is necessary": move everything to new addresses and do not send coins back to the old ones. Mike Hearn told bitcoin-dev the same day that "some signatures have been observed to have colliding R values"; Google confirmed the flaw on its Android Developers Blog on 14 August 2013.

The fix that made the class rare is to stop trusting the random number generator for this job. RFC 6979 derives the number from the private key and the message, and libsecp256k1, Bitcoin Core's signing library, uses it. BIP-340 gives Schnorr signatures a synthetic nonce, a deterministic derivation mixed with fresh randomness, and warns that a copied derivation could leave a nonce "accidentally reused in the other scheme leaking the secret key".

The link to address reuse needs care. Nonce reuse is a signing bug; address reuse is a habit. The bug needs two signatures from the same key, and a key that signs once cannot leak this way. Reuse is what gives one key a second, third and hundredth signature. It cuts the other way too: a never-reused address can still sign twice, holding two coins spent together or re-signing under RBF. Bitcoin Optech, on Breitner and Heninger's lattice attacks, January 2019: "The fast analysis method employed by the authors of the paper took advantage of users who engaged in address reuse, but even keys for addresses that have not been reused are vulnerable to attack if the nonce generation is biased or too small."

Reusing an address with a wallet that derives its nonces does not expose you to the 2013 attack. It does put every coin you receive there behind one key, which is reason enough.