How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same secret key and with the same nonce k (and thus the same value r), the following holds:

s1 = (m1 + rx)/k s2 = (m2 + rx)/k

From that we can derive:

s1 * k = m1 + rx s2 * k = m2 + rx (s1 - s2) * k = m1 - m2 k = (m1 - m2) / (s1 - s2) x = (s1 * (m1 - m2) / (s1 - s2) - m1) / r x = (m1s2 - m2s1) / (r*(s1 - s2)) (all mod n)

So not only did you make it trivial to detect signatures with the same nonce (they have a recognizable r value), there is a trivial formula to compute the private key once someone sees two signatures. This kind of attack has been known and actively exploited on the Bitcoin network since at least 2013: https://bitcointalk.org/index.php?topic=271486.0 . Don't reuse k values. Use RFC6979 to deterministically but securely generate them. Also note that it's not sufficient that the nonces are different. They also can't be related in a known way. For example, you can't use k for one signature, and k+1 for the next work.