Watcher
An off-chip monitor that only sees r, s, timestamps and counts. It scores risk and tells the signer when to rotate.
Risk score
rotate_nowfalse
Rule checklist
- Repeated r (nonce reuse)0 signatures, all r unique.Pass
- Signature capNo active keys.Pass
- s/r bias (χ²)Need 10 signatures, have 0.Not enough data
- Timing varianceNeed at least 6 signatures.Not enough data
- Public key exposure timeNo active key has an exposed public key.Pass
Risk score over time
Sign at least two messages to plot a trend.
Signature stream
| Key | r | s | Time | Sigs on key |
|---|---|---|---|---|
| No signatures yet. | ||||
Attack demo: nonce reuse
Education only. This uses a throwaway demo key that never touches your keys. The real Roto signer uses RFC 6979 or a health-checked hardware RNG and can never reuse k.
Nonce reuse is a classical bug, not a quantum attack, but the result is the same: one leaked d drains every coin on that key.
