secp256k1: is it theoretically possible to generate same signature with different key, message hash and k? For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
We want $(r,s)$ same for two different set of $d,k,h$
In ECDSA

$r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$
$s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left  most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again).

Now we want same $(r,s)$ for $d,k,h$ and $d',k',h'$

$r = x_0([k]G) = x_0([k']G)$ although this may indicate that $k=k'$ it is not. The reason is that the coordinate field $p$ is smaller than the order $n$ of the base point. Therefore we can have solutions other than the trivial.

$s = k^{-1}\cdot (h+r\cdot d) = k'^{-1}\cdot (h'+r\cdot d')$,
then with $k'=k$ we have;
\begin{align}
   (d'-d)\cdot r &amp;= (h-h') \\
  \end{align}
then with $k'\neq k$ with $c = k^{-1}$ and $c' = k'^{-1}$ ( for our eyes) we have;
\begin{align}
   c'\cdot h + c' \cdot r \cdot d &amp;= c\cdot h' + c \cdot r \cdot d' \\
   c'\cdot h -c\cdot h'  &amp;=  c \cdot c \cdot d' -c' \cdot r \cdot d \\
   c'\cdot h -c\cdot h'  &amp;=  r \cdot ( c \cdot d' -c' \cdot d) \\
  \end{align}


As we can see by knowing $r$;
Either

we need to find a proper $d'$ for a given $d$ for given different hash values. This is free since we found the private key by just arithmetics.
OR, we need to find a message that produces desired hash value $h'$ so that we have equality. This is hard since we need to break pre-image resistance of SHA256.

As we can see it is possible but hard.
For the case $k'\neq k$ the calculations are similar.