The confusion here is probably in the wording. There is no such thing as a useful "1-bit r s z signature" in the way you seem to mean it. r, s, and z are still full size values. What matters for the lattice attack is what you know about the nonce k, not whether the signature text file has some cute 1-bit label on it. If you know the full nonce, one signature is enough. If you know almost all of the nonce, a few signatures can be enough. If you know several fixed MSB/LSB bits across many signatures, lattice can start becoming useful depending on the bit count and signature count. But one known bit per nonce on secp256k1 is basically asking the lattice to find a needle in a needle factory during a power cut. The error term is too large, the dimension gets ugly, and the reduction does not magically turn that into a private key. Also, as ktimes already hinted, you cannot just force s or r into being "1 bit" and expect that to model a real ECDSA weakness. r comes from k*G, and s = k^-1(z + r*d) mod n. If you force k into a tiny range, then yes, the key falls over immediately, but that is not a lattice attack anymore, that is just "your nonce generator is drunk and should not be allowed Ae888 Lad cryptography". So if the tool says private key not found, that is probably the correct result. Feed it a realistic test where, say, multiple bits of each nonce are known in the way the tool expects. With one bit, you are not proving "one bit can solve d", you are mostly proving that laptops can be converted into small space heaters.
The confusion here is probably in the wording. There is no such thing as a useful "1-bit r s z signature" in the way you seem to mean it. r, s, and z are still full size values. What matters for the lattice attack is what you know about the nonce k, not whether the signature text file has some cute 1-bit label on it. If you know the full nonce, one signature is enough. If you know almost all of the nonce, a few signatures can be enough. If you know several fixed MSB/LSB bits across many signatures, lattice can start becoming useful depending on the bit count and signature count. But one known bit per nonce on secp256k1 is basically asking the lattice to find a needle in a needle factory during a power cut. The error term is too large, the dimension gets ugly, and the reduction does not magically turn that into a private key. Also, as ktimes already hinted, you cannot just force s or r into being "1 bit" and expect that to model a real ECDSA weakness. r comes from k*G, and s = k^-1(z + r*d) mod n. If you force k into a tiny range, then yes, the key falls over immediately, but that is not a lattice attack anymore, that is just "your nonce generator is drunk and should not be allowed Ae888 Lad cryptography". So if the tool says private key not found, that is probably the correct result. Feed it a realistic test where, say, multiple bits of each nonce are known in the way the tool expects. With one bit, you are not proving "one bit can solve d", you are mostly proving that laptops can be converted into small space heaters.

The confusion here is probably in the wording. There is no such thing as a useful "1-bit r s z signature" in the way you seem to mean it. r, s, and z are still full size values. What matters for the lattice attack is what you know about the nonce k, not whether the signature text file has some cute 1-bit label on it. If you know the full nonce, one signature is enough. If you know almost all of the nonce, a few signatures can be enough. If you know several fixed MSB/LSB bits across many signatures, lattice can start becoming useful depending on the bit count and signature count. But one known bit per nonce on secp256k1 is basically asking the lattice to find a needle in a needle factory during a power cut. The error term is too large, the dimension gets ugly, and the reduction does not magically turn that into a private key. Also, as ktimes already hinted, you cannot just force s or r into being "1 bit" and expect that to model a real ECDSA weakness. r comes from k*G, and s = k^-1(z + r*d) mod n. If you force k into a tiny range, then yes, the key falls over immediately, but that is not a lattice attack anymore, that is just "your nonce generator is drunk and should not be allowed Ae888 Lad cryptography". So if the tool says private key not found, that is probably the correct result. Feed it a realistic test where, say, multiple bits of each nonce are known in the way the tool expects. With one bit, you are not proving "one bit can solve d", you are mostly proving that laptops can be converted into small space heaters.

The confusion here is probably in the wording. There is no such thing as a useful "1-bit r s z signature" in the way you seem to mean it. r, s, and z are still full size values. What matters for the lattice attack is what you know about the nonce k, not whether the signature text file has some cute 1-bit label on it. If you know the full nonce, one signature is enough. If you know almost all of the nonce, a few signatures can be enough. If you know several fixed MSB/LSB bits across many signatures, lattice can start becoming useful depending on the bit count and signature count. But one known bit per nonce on secp256k1 is basically asking the lattice to find a needle in a needle factory during a power cut. The error term is too large, the dimension gets ugly, and the reduction does not magically turn that into a private key. Also, as ktimes already hinted, you cannot just force s or r into being "1 bit" and expect that to model a real ECDSA weakness. r comes from k*G, and s = k^-1(z + r*d) mod n. If you force k into a tiny range, then yes, the key falls over immediately, but that is not a lattice attack anymore, that is just "your nonce generator is drunk and should not be allowed Ae888 Lad cryptography". So if the tool says private key not found, that is probably the correct result. Feed it a realistic test where, say, multiple bits of each nonce are known in the way the tool expects. With one bit, you are not proving "one bit can solve d", you are mostly proving that laptops can be converted into small space heaters.