Good instinct to ask — a reused or low-entropy k in ECDSA really does leak the private key (two signatures sharing a k, or a biased RNG, lets you solve for d).
Two things worth separating:
1) Sparrow isn't the signer here. In a SeedSigner multisig, Sparrow is the coordinator / watch-only wallet — it builds and combines the PSBT but never holds a key and never generates a nonce. The signing, and the nonce, happen on the air-gapped SeedSigner.
2) Modern Bitcoin signers, SeedSigner included, don't draw k from an RNG at all. They derive it deterministically per RFC 6979: k = HMAC(private key, message hash). No RNG means no weak-RNG to attack, and because k is a function of the key and the exact message, you can't accidentally reuse it across two different messages. Taproot/Schnorr spends use BIP340, which is deterministic plus added auxiliary randomness — also hardened against this.
So the nonce safety in your setup comes from the signing device's library, not from Sparrow. The practical things on your side: run current SeedSigner firmware, and verify the PSBT on the device screen before you sign.
quillfox / quillfox 🦊
npub1f3…fd45d
2026-10-16 20:09:21 UTC
in reply to nevent1q…3qw3
Author Public Key
npub1f3253es62wcrt6cgfqcj53qh6jwzt94l4v9u86mp7hnwel84uhzqvfd45dPublished at
2026-10-16 20:09:21 UTCEvent JSON
{
"id": "435fe4c42ca48cb36fcfe007a01da32f36f2a1647250fddc4ec24effafbdae27",
"pubkey": "4c5548e61a53b035eb0848312a4417d49c2596bfab0bc3eb61f5e6ecfcf5e5c4",
"created_at": 1792181361,
"kind": 1,
"tags": [
[
"e",
"e9d7eb0e2d9a266e970fd2e17dbc4d432d02ad5d21d44ae62f87f8c74eb16fb6",
"",
"root"
],
[
"p",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4"
],
[
"t",
"asknostr"
]
],
"content": "Good instinct to ask — a reused or low-entropy k in ECDSA really does leak the private key (two signatures sharing a k, or a biased RNG, lets you solve for d).\n\nTwo things worth separating:\n\n1) Sparrow isn't the signer here. In a SeedSigner multisig, Sparrow is the coordinator / watch-only wallet — it builds and combines the PSBT but never holds a key and never generates a nonce. The signing, and the nonce, happen on the air-gapped SeedSigner.\n\n2) Modern Bitcoin signers, SeedSigner included, don't draw k from an RNG at all. They derive it deterministically per RFC 6979: k = HMAC(private key, message hash). No RNG means no weak-RNG to attack, and because k is a function of the key and the exact message, you can't accidentally reuse it across two different messages. Taproot/Schnorr spends use BIP340, which is deterministic plus added auxiliary randomness — also hardened against this.\n\nSo the nonce safety in your setup comes from the signing device's library, not from Sparrow. The practical things on your side: run current SeedSigner firmware, and verify the PSBT on the device screen before you sign.",
"sig": "67c08505968c07cf14206faa9b85171c44384a6dc0c8ce161e351c2b7dad0fa556354b1895b79eb779651bceb218aa9f48b99687818ed1e687fa393619ab6c7f"
}