user124346: My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is designed  by private key 'd' to message hash z , such that: k = 128 MSB bit of z + 128 bit MSB of d (privatekey)
example:
d= private key in hex
z= message hash
k= nonce; where nonce is equal first 128 bit of z + 128 bit of d
d= 0x036ed4f5f383049827edc4fe337f46f83a240b124242620b02b97552b2fc11a4
z= f55ab477c48f9afaf1a72ab448bf96b4a05f336f7a1e27e08993308dfaa783b5
k = f55ab477c48f9afaf1a72ab448bf96b4 + 036ed4f5f383049827edc4fe337f46f8
k= 0xf55ab477c48f9afaf1a72ab448bf96b4036ed4f5f383049827edc4fe337f46f8
signature:
r= 62326678398279634483781267842729177896577268934832461436294590773005653623297
s= 78373122694400608572761948114834235891083358005495335895684705221713649603747
z= 110976909682006680432155795488402189554785886863009729379902726621537291961269
I have searched the stack exchanges and various articles and research papers and have not found a workable solution to this problem. My own linear algebra is not as strong as I would like it (it's been a number of years), and my attempts have not been successful.
Is there any way to calculate k or privatekey?
N: Finite field of the secp256k1

user208: I believe this would be trivial to break.
Let's say that:

z = z0 + 2128z1, with 128-bit z0, z1.
d = d0 + 2128d1, with 128-bit d0, d1.

In that case, according to your construction, k = d1 + 2128z1.
For ECDSA signatures (r,s):

We know s = k-1(z + rd) (mod n) (the signing equation)
Put otherwise: sk = z + rd (mod n)
Substituting the above: s(d1 + 2128z1) = z0 + 2128z1 + r(d0 + 2128d1) (mod n).
Grouping: rd0 + (2128r - s)d1 = 2128z1(s - 1) - z0 (mod n).

All variables in the last equation above except for d0 and d1 are known. Finding solutions for those restricted to range [0,2128) is a simple lattice reduction, which likely has at most a few solutions. Those can be tested exhaustively.

124346: <p>My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is designed  by private key 'd' to message hash z , such that: k = 128 MSB bit of z + 128 bit MSB of d (privatekey)
example:</p>
<p>d= private key in hex<br />
z= message hash<br />
k= nonce; where nonce is equal first 128 bit of z + 128 bit of d</p>
<p>d= 0x<strong>036ed4f5f383049827edc4fe337f46f8</strong>3a240b124242620b02b97552b2fc11a4<br />
z= <strong>f55ab477c48f9afaf1a72ab448bf96b4</strong>a05f336f7a1e27e08993308dfaa783b5<br />
k = f55ab477c48f9afaf1a72ab448bf96b4 + 036ed4f5f383049827edc4fe337f46f8<br />
k= 0xf55ab477c48f9afaf1a72ab448bf96b4036ed4f5f383049827edc4fe337f46f8</p>
<p>signature:<br />
r= 62326678398279634483781267842729177896577268934832461436294590773005653623297<br />
s= 78373122694400608572761948114834235891083358005495335895684705221713649603747<br />
z= 110976909682006680432155795488402189554785886863009729379902726621537291961269</p>
<p>I have searched the stack exchanges and various articles and research papers and have not found a workable solution to this problem. My own linear algebra is not as strong as I would like it (it's been a number of years), and my attempts have not been successful.</p>
<p>Is there any way to calculate k or privatekey?</p>
<p>N: Finite field of the secp256k1</p>
 208: <p>I believe this would be trivial to break.</p>
<p>Let's say that:</p>
<ul>
<li><em>z = z<sub>0</sub> + 2<sup>128</sup>z<sub>1</sub></em>, with 128-bit <em>z<sub>0</sub>, z<sub>1</sub></em>.</li>
<li><em>d = d<sub>0</sub> + 2<sup>128</sup>d<sub>1</sub></em>, with 128-bit <em>d<sub>0</sub>, d<sub>1</sub></em>.</li>
</ul>
<p>In that case, according to your construction, <em>k = d<sub>1</sub> + 2<sup>128</sup>z<sub>1</sub></em>.</p>
<p>For ECDSA signatures <em>(r,s)</em>:</p>
<ul>
<li>We know <em>s = k<sup>-1</sup>(z + rd) (mod n)</em> (the signing equation)</li>
<li>Put otherwise: <em>sk = z + rd (mod n)</em></li>
<li>Substituting the above: <em>s(d<sub>1</sub> + 2<sup>128</sup>z<sub>1</sub>) = z<sub>0</sub> + 2<sup>128</sup>z<sub>1</sub> + r(d<sub>0</sub> + 2<sup>128</sup>d<sub>1</sub>) (mod n)</em>.</li>
<li>Grouping: <em>rd<sub>0</sub> + (2<sup>128</sup>r - s)d<sub>1</sub> = 2<sup>128</sup>z<sub>1</sub>(s - 1) - z<sub>0</sub> (mod n)</em>.</li>
</ul>
<p>All variables in the last equation above except for <em>d<sub>0</sub></em> and <em>d<sub>1</sub></em> are known. Finding solutions for those restricted to range <em>[0,2<sup>128</sup>)</em> is a simple lattice reduction, which likely has at most a few solutions. Those can be tested exhaustively.</p>
