I know it is well understood that it is not a good practice to use the same nuncio while generating the signatures, but I do not do the calculations correctly.
Suppose some UTXOs are controlled by my private key. Q. Let's say that I used two of the UTXOs with nuncio's N & # 39; to generate my signature. Now, the components (R, S) of the signature are public and the transactions are public so everyone has access to them.
S1 = N ^ (- 1) *[hash(m1) + Q*R] mod p
S2 = N ^ (- 1) *[hash(m2) + Q*R] mod p
S1 - S2 = N ^ (- 1) *[hash(m1) - hash(m2)] mod p
Even if we know S1, S2, m1 and m2, does not the resolution of N ^ (- 1), and hence of N, look for the solution to the discrete logarithm?