Key Recovery from Nonce Reuse

The PS3 / Sony attack, in algebra

ECDSA signing publishes (r, s) where s = k^{-1}(z + r*d) mod n. Suppose two signatures share the same nonce k:

s1 = k^{-1}(z1 + r*d)   (same r — same k means same R)
s2 = k^{-1}(z2 + r*d)

Subtract:

s1 - s2 = k^{-1} (z1 - z2)
k = (z1 - z2) *