Most public key systems fail catastrophically if you ignore any
of their requirements. You can decrypt RSA messages if the
padding is not random, for example. With DSA, many
implementation mistakes expose the signer’s private key. Many
crypto protocols use a nonce. The traditional requirements of a
nonce is that it never be repeated. So a simple counter can
suffice, as long as it is safely persisted. Using a timestamp is
problematic if the clock ever goes backwards (say, NTP) or you
need to generate two messages in a short interval. In DSA, the k
value is not a nonce. In addition to being unique, the value
must be unpredictable and secret. This makes it more like a
random session key than a nonce. When an implementer gets this
wrong, they expose the private key, often with only one or two
signatures. If k is predictable, there is a way to recover the
private key from a single signature with straightforward
algebra. Since a past weakness in the Debian PRNG resulted in
only 32767 possible outputs, an attacker c