Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is:

s = k-1(z + qr)

k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)

I am interested in why do we need two secret values (k and q) in a formula for calculating ECDSA signature? In other words, why we need one additional secret value k (and its public key - point on a curve) in additional to already existing one secret value q (and its public key)? Couldn't it be realized with only one unknown value (q)?

I found some answer here.

The reason nonce is used is because you need to create two unknowns so that people cannot reverse engineer the private key from the public key.

It seems to me that this is so that we have one equation with two unknowns (which is unsolvable). If only the original private key q is present in the equation, i.e. if it is the only unknown (without the additional secret k), we would have one equation with one unknown, which is solvable. However, I'm not sure. Is that the reason or something else/additional?

Also, why is it used as k-1 in equation and not just k? Some special security reason or just a "design detail" of the algorithm creators?



from Recent Questions - Bitcoin Stack Exchange https://ift.tt/zB4Ubnl
via IFTTT

Comments

Popular posts from this blog

Do Kwon’s Detention Prolonged Until 2024 As Montenegro Responds To Extradition Requests

Sam Bankman-Fried Trial Begins Tomorrow: 3 Reasons Ex-SEC Official Foresees Conviction

Ethereum Price Plummets 9% As Fed Chair Passes Hawkish Remarks