ECDSA vulnerability related to recovering private key using same r I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2.
where:


I get it that any attacker who have s1 and s2 can recover its private key x.
But the question is can the signer use a different private key x1 for instance to generate s2..in such a way even if he uses same k but still its private key will be safe.??(cryptocurrency like bitcoin allows multiple public private key pair of a user)
Am i getting something wrong otherwise this would have been not a well known ECDSA vulnerability in bitcoin.
Please explain the contradiction. Thanks in advance
You are positing that the signer signs two messages $m_1$ and $m_2$ under different private keys $x_1$ and $x_2$, but the same per-signature secret $k$.

\begin{align*}
  s_1 &amp;= (h(m_1) + x_1 r)/k, \\
  s_2 &amp;= (h(m_2) + x_2 r)/k.
\end{align*}

Note that $r = x([k]B)$ where $B$ is the standard base point.  Even if you are given $s_1$, $s_2$, $m_1$, $m_2$, and $r$, this is a system of two equations in three unknowns.  This doesn't even constrain you to a unique solution: for any nonzero value of $x_1$, there is a corresponding value of $(x_2, k)$; likewise $x_2$ and $(x_1, k)$, and $k$ and $(x_1, x_2)$.  Indeed, for, e.g., secp256k1, there are approximately $2^{256}$ possible solutions for $(x_1, x_2, k)$.