Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created).

I would like to create an iOS-based wallet app that offers reasonable security.

  • OpenSSL is not available on iOS, and is quite a large dependency. What I'm looking for are specialized libraries that mainly focus on the Bitcoin algorithms. The OpenSSL code also is very hard to understand, making me wonder if there is really no better way.

    • libbitcoin and the official Bitcoin-Qt client both use OpenSSL.
    • OpenSSL generally has a mixed reception.
    • OpenSSL also added to the transaction malleability problem that recently made its round in the news, as OpenSSL has more relaxed criteria to accept a signature than strictly necessary.
  • bitcoinj uses Spongy Castle, also a large collection of algorithms.

  • Another option of an algorithm collection is Crypto++ which I haven't seen in existing Bitcoin clients so far.

  • Apple's Security framework only supports RSA on iOS.

  • Chromium includes Go-sources for ECDSA.

  • There is sipa's implementation for Sep256k1 that has a reputation of being very efficient. It is also listed under gh/bitcoin.

Many recent attacks in publications used side-channel attacks, making it necessary to have algorithms with constant-time execution (to avoid timing-related attacks) and additional protections against cache-based attacks and recently even audio-related attacks where noise that the hardware itself produces can be used to gain knowledge of the private key.

Even though many attacks require gathering of multiple signatures, one cannot know how the app will be used by the end-user. I do not want to rely on the assumption that the users doing transactions only a few times per day in different shops and exchange their Bitcoin addresses frequently.

My questions are:

  • Is there a "sane" implementation of the algorithms used by bitcoin? e.g. are there high-quality implementations available that incorporate defenses against side channel attacks?

  • Does OpenSSL already protects against side-channel attacks?

    • A mobile app is more open to side-channel attacks than the desktop PC standing at home, so what's reasonably secure on a desktop machine may not be secure enough for a mobile app.
    • As OpenSSL is probably the most used cryptographic library, it's probably also the most attacked one, and therefore, ahead when looking at general security. However, specialized libraries may have a higher quality for the few algorithms they implement, as the code base is much smaller and easier to understand.
  • How can I train myself to evaluate whether an existing implementation is vulnerable to certain types of attacks?

    • Cryptographic algorithm implementations are often only poorly documented and optimized to a point where the code consists of magic numbers chained together with arbitrarily seeming operators.
    • One aspect I already mentioned is the concept of constant execution time, which counters timing-related attacks.
  • Are there good resources that explain how to implement those algorithms myself? I do not intend to use my own implementation for the app, but I am interested in understanding how the stuff works I'm using. Entry-bar seems quite high. Can the "Guide to Elliptic Curve Cryptography" book be recommended?

PS: I know that Apple doesn't favorably treat Bitcoin-related apps in their store. However, this discussion is out of scope of this question.

PS2: Base58Check is only used as a special encoding to make Bitcoin addresses and keys more readable to the enduser. There is no cryptography involved there, and it's easy to implement - I only included it here for completeness.

share|improve this question
Most operations don't need side channel resistance - they operate on public data. ECDSA signing is the major one, but even it is relatively hard to attack since you can't easily get high precision timing information. –  CodesInChaos Mar 10 at 19:33
In Bitcoin, only the address RIPEMD(SHA256(public-key) and its Base58Check encoding are public. The public key is only revealed when a transaction is created that spends coins that were previously sent to the address. I agree with you, that ECDSA signing is the major operation to protect, but ECDSA scalar multiplication is also important as a Bitcoin wallet usually generates a new keypair for every transaction to receive the change. Regarding ECDSA side channels: a second app in background could perform a cache-based attack: eprint.iacr.org/2014/161.pdf –  Etan Mar 10 at 21:22
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.