user32546: I have 2 transactions.
0100000001494d40d44b9ea0d652fca9258ab7caa42551eb52975887f96fb50cd632c8b497000000008c493046022100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e022100b973d6c776f1a8db2b7bc654c7e55384422677f41928ec4c30643f383d587bfd014104cb5035b2d8fc1019146a7e4fba751a9a9bfafa2d1e35528a9397051c6e630513694ab925adc4083dcafc86c92796a2b6ae977adfc0bb47df9106a6a9263d35f6ffffffff0120030000000000001976a91468979da3812f340e577fc379c20a8f8a505f02dd88ac00000000



0100000001494d40d44b9ea0d652fca9258ab7caa42551eb52975887f96fb50cd632c8b427000000008c493046022100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e022100be1c50365d8ed4e269cb7350dee3b5fcc9f81856726a590dcdd3f538dafcd045014104cb5035b2d8fc1019146a7e4fba751a9a9bfafa2d1e35528a9397051c6e630513694ab925adc4083dcafc86c92796a2b6ae977adfc0bb47df9106a6a9263d35f6ffffffff0120030000000000001976a91468979da3812f340e577fc379c20a8f8a505f02dd88ac00000000

I know that the k values and hence the R values of both these transactions are the same.
So now how do I recover the private key from these two transactions in hex?
A detailed step by step procedure on how to arrive at the answer will be appreciated.

user26873: Hopefully most web wallets and wallet services are not re-using R values to sign transactions since this has been a known vulnerability for a while now. On a very low level you are turning an equation like x + y = 10 into x + 2 = 10 making it easy to find x. 
First find the reused R values, in your case it's:
2100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e
Then find the signature coordinates in the two transactions:    
tx1 coordinate(S1):
00b973d6c776f1a8db2b7bc654c7e55384422677f41928ec4c30643f383d587bfd
tx2 coordinate(S2):
00be1c50365d8ed4e269cb7350dee3b5fcc9f81856726a590dcdd3f538dafcd045
Now the tricky part, you can use the bitcoin secp256k1 curve to reverse calculate the private key, but you'll need also need to use a bitcoin transaction library to use op_checksig() for the missing sig hashes to find SOP1 and SOP2. I'll let one of the more advanced users explain finding the above two values, as I don't fully understand it myself. Link
p = parameter for secp256k1
Limit the secp256k1 field:
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
K = GF(p)
In the end it's:
K = (sop1*s2 - sop2*s1)/(r*(s1-s2))
This will output an integer, will need to be hexcoded, and then converted to WIF. 
Source:
https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517
https://bitcointalk.org/index.php?topic=977070.msg11161149#msg11161149 

32546: <p>I have 2 transactions.</p>

<pre><code>0100000001494d40d44b9ea0d652fca9258ab7caa42551eb52975887f96fb50cd632c8b497000000008c493046022100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e022100b973d6c776f1a8db2b7bc654c7e55384422677f41928ec4c30643f383d587bfd014104cb5035b2d8fc1019146a7e4fba751a9a9bfafa2d1e35528a9397051c6e630513694ab925adc4083dcafc86c92796a2b6ae977adfc0bb47df9106a6a9263d35f6ffffffff0120030000000000001976a91468979da3812f340e577fc379c20a8f8a505f02dd88ac00000000



0100000001494d40d44b9ea0d652fca9258ab7caa42551eb52975887f96fb50cd632c8b427000000008c493046022100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e022100be1c50365d8ed4e269cb7350dee3b5fcc9f81856726a590dcdd3f538dafcd045014104cb5035b2d8fc1019146a7e4fba751a9a9bfafa2d1e35528a9397051c6e630513694ab925adc4083dcafc86c92796a2b6ae977adfc0bb47df9106a6a9263d35f6ffffffff0120030000000000001976a91468979da3812f340e577fc379c20a8f8a505f02dd88ac00000000
</code></pre>

<p>I know that the k values and hence the R values of both these transactions are the same.</p>

<p>So now how do I recover the private key from these two transactions in hex?</p>

<p>A detailed step by step procedure on how to arrive at the answer will be appreciated.</p>
 26873: <p>Hopefully most web wallets and wallet services are not re-using R values to sign transactions since this has been a known vulnerability for a while now. On a very low level you are turning an equation like x + y = 10 into x + 2 = 10 making it easy to find x. </p>

<p>First find the reused R values, in your case it's:
<code>2100bdc4132fbd2d9334b54531babdd1f8ecc0a37e75b04c9521684490da25e5938e</code></p>

<p>Then find the signature coordinates in the two transactions:    </p>

<p>tx1 coordinate(S1):<br>
<code>00b973d6c776f1a8db2b7bc654c7e55384422677f41928ec4c30643f383d587bfd</code><br>
tx2 coordinate(S2):<br>
<code>00be1c50365d8ed4e269cb7350dee3b5fcc9f81856726a590dcdd3f538dafcd045</code></p>

<p>Now the tricky part, you can use the bitcoin secp256k1 curve to reverse calculate the private key, but you'll need also need to use a bitcoin transaction library to use <code>op_checksig()</code> for the missing sig hashes to find SOP1 and SOP2. I'll let one of the more advanced users explain finding the above two values, as I don't fully understand it myself. <a href="https://bitcointalk.org/index.php?topic=977070.msg11160403#msg11160403" rel="nofollow" title="link">Link</a></p>

<p>p = parameter for secp256k1<br>
Limit the secp256k1 field:<br>
<code>p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141</code><br>
<code>K = GF(p)</code></p>

<p>In the end it's:</p>

<p><code>K = (sop1*s2 - sop2*s1)/(r*(s1-s2))</code></p>

<p>This will output an integer, will need to be hexcoded, and then converted to WIF. </p>

<p>Source:<br>
<a href="https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517" rel="nofollow">https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517</a><br>
<a href="https://bitcointalk.org/index.php?topic=977070.msg11161149#msg11161149" rel="nofollow">https://bitcointalk.org/index.php?topic=977070.msg11161149#msg11161149</a>     </p>
