Calculating ECDSA m or k (k or d) when s1 = s2 I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$.
I've been using the well-publicised information about how the Sony PS3 private key was leaked, where:
$$m = \frac{e_1 - e_2}{s_1 - s_2}$$
$$k = \frac{e_1s_2 - e_2s_1}{R(s_1 - s_2)}$$
This has worked well and I've managed to use it to calculate $k$ (private key) in a few situations successfully.
However, I'm confused by what I should do with two different signatures ($e_1 \neq e_2$) with the same $s_1$ and $s_2$, because when I calculate $m$ or $k$ I get:
$$m = \frac{e_1 - e_2}{0}$$
$$k = \frac{e_1s_2 - e_2s_1}{R(0)}$$
Is there a way to calculate $m$ or $k$ in the situation where $s_1 - s_2 = 0$?
However, I'm confused by what I should do with two different messages ($e_1 \ne e_2$) with the same $s_1$ and $s_2$

Well, if we consider how $s$ is computed:
$$s_i = m^{-1} ( \text{hash}(e_i) + r \cdot k )$$
If $s_1 = s_2$, then (because the private key $k$ is the same in both cases, and $m$ (the secret nonce) and $r$ are assumed to be the same, we have $\text{hash}(e_1) = \text{hash}(e_2)$
If $e_1 \ne e_2$, that means that we have a hash collision on our hands; because the signature depends on the hash of the message (and nothing else about the message), that means that (as far as ECDSA is concerned) we're signing the same message twice, and so the attack isn't possible.