# Tag Info

22

There are several uses of cryptographic algorithms in the protocol. Accounts/Transactions To move money from one account to another, you need to collect some data (the previous transaction(s) which got you the money, the target account, the amount you want to transfer) and sign them, using the private key which belongs to your account. For this signature ...

20

For such a scheme to work, if I have some currency, I have to be able to give it to Abel and I have to be able to give it to Beth, but I have to be unable to give it to both Abel and Beth. This means that giving the currency to Abel has to somehow make me unable to give the currency to Beth even though I previously could do that. There are three mechanisms ...

17

I don't believe that there's any way to generate the vanity hashes without iterating. In base 58, there's $\log_2(58) \approx 5.858$ bits per letter, so fixing 8 letters would need in average $58^8/2 = 2^{\log_2(58)·8}/2 \approx 2^{46}$ iterations. Note that Bitcoin addresses always start with a 1 by convention (this comes from the version field), and the ...

12

The main difference is that secp256r1 is a prime field curve, while secp256k1 is a Koblitz curve. Koblitz curves are known to be a few bits weaker than prime field curves, but since we are talking about 256-bit curves, neither is broken in "5-10 years" unless there's a breakthrough. The other difference is how the parameters have been chosen. In secp256r1 ...

12

I have a list of Bitcoin-related publications here: Bitcoin Bibliography (Crypto & Security) They are all the academic papers (as opposed to whitepapers) that I know about, relating to security or cryptographic aspects (as opposed to economic or implementation aspects) of Bitcoin. Most are published.

11

Here's the Research article on the Bitcoin wiki: http://en.bitcoin.it/wiki/Research You might find some of the authors in the list have related research that is not directly related to Bitcoin so is absent from that list.

8

The Bitcoin mining algorithm can not be simplified by exploiting any weakness in the SHA-2 hashing algorithm with the current state of the art. The problem is manyfold. From the SHA-256 point of view, there is no (partial) preimage search algorithm that applies to the full hash function. Even worse, the attacks that penetrate a fewer number of rounds have ...

7

Uniformity is a tricky one. SHA-256 (as well as SHA-3 for that matter) follows a heuristic approach. That is, the design is not based on a hardness assumption (for example, the factoring or discrete-log assumption) but on criteria that have only been verified empirically. As such, also the study of uniformity is an empirical study. The development of ...

5

Is this (cryptographically) secure? That is hard to say without knowing the exact details of the bitcoin protocol (which I would like to understand better, but don't have the time at the moment). Looking at the document you linked to, the public child key is created as $\text{HMAC-SHA512}(Key = c_{par}, Data = ser_P(K_{par}) || ser_{32}(i))$. This ...

5

This would hopefully eliminate the worry that somebody could reverse-engineer the process by which I generate the brain wallets. By Kerckhoffs's principle, you should assume that the adversary already knows the algorithm, and the only thing unknown are the secret keys – in your case, the passphrases. Therefore, the adversary by definition knows that ...

5

Most of what the bitcoin system does consists of using well-known algorithms for their intended purposes. It is unlikely that there will be a fundamental or algorithmic problem in these parts of the system. There may be a software bug in the reference client, of course. There once was such a bug -- an overflow bug that allowed people to create transactions ...

4

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 ...

4

First secp256r1 is a random and secp256k1 is a Koblitz curve. So according to this article: Koblitz curves should be avoided, [...] as they does not have enough warranty on crypto analytic activity and effectively they are: Not part of NSA Suite-B cryptography selection Not part of ECC Brainpool selection Not part of ANSI X9.62 selection ...

4

The access codes were recently leaked (by whom, I don't know). My Yubikey is listed and I can confirm that the access codes were necessary and sufficient to reprogram it. You can change or remove the access code as part of reprogramming too. The leak doesn't make the Yubikeys useless in the extremely unlikely event of Gox rising from the flames — no ...

3

At the core of your question is a concept called entropy, which is the amount of uncertainty or unpredictability in a set of data. In cryptography, entropy is related to probabilities, expressed in terms of powers of 2 (bits.) For example, a fair coin flip has one bit of entropy: it can be either heads (1) or tails (0). Flipping four coins gives you ...

2

Bitcoin doesn't use RSA, it uses ECDSA. Every 256-bit value is a valid private key. (Though a very small fraction of them have to be folded.) But even if the numbers had to be special, it still wouldn't matter. You could use every 256-bit value as a seed to a pseudo-random number generator which you could use to deterministically generate numbers that had ...

2

A good hash doesn't give you any information about password length or anything else. The only attack against such a hash is guessing the password, and then using the hash to verify if it was correct. Depending on the hashing scheme, the cost per guess can vary widely. For example with plain MD5 a single graphics card can try several billion guesses per ...

2

If you wait a bit, then you can point her to the papers that will appear here Workshop on Bitcoin Research which is going to be held during Financial Crypto 2014.

2

In ECDSA, the message is never encoded as a point in the elliptic curve. Signing in ECDSA loosely works like this: \begin{align*} k &= \text{random}(0, n) \\ (x, \_) &= k \cdot G \\ r &= x \bmod n \\ s &= k^{-1}(H(m) + r \alpha) \bmod n \end{align*} $r$ and $s$ are the signature, and as you can see $H(m)$ is only ever used as an ...

1

Bitcoin was designed to be decentralized, but was not designed to be anonymous. How you use (earn or spend) Bitcoin cannot (in general) be made anonymous because the protocol was not designed to support that. In fact, the design of Bitcoin, being decentralized, requires all participants to be able to confirm all transactions. You can use Tor to add to ...

1

Yes, it could be done. However, it would work a little different from what you imagine. The government can create a new blockchain operating under zerocoin rules. The government could then distributed one satoshi per citizen. This distribution could happen for example by letting each citizen visit a government office to present their passport and receive ...

1

lm = nm; low = nw; hm = lm; high = low; You're setting hm = nm since lm = nm. Correct is: hm = lm; lm = nm; high = low; low = nw;

1

I recently came across a paper that may interest you that I think answers your question. To quote from the abstract: Unfortunately, in all existing HD wallets---including BIP32 wallets---an attacker can easily recover the master private key given the master public key and any child private key. This vulnerability precludes use cases such as a combined ...

1

The current status as of the time I write this is: There are no known attacks on second pre-images for truncated SHA-256 that are faster than brute force.

1

There are a number of known attacks that can occur right at the point of block formation. The most recent one, transaction malleability, wasn't really the reason for Mt Gox's demise, but it surely created some problems (and for the most part has been fixed). Unfortunately there is a theoretical, but pretty convincing theory, about what has been called cartel ...

Only top voted, non community-wiki answers of a minimum length are eligible