Tag Info

Hot answers tagged

21

There are several uses of cryptographic algorithms in the protocol. Accounts/Transactions To move money from one account to another, you need to collect some data (the previous transaction(s) which got you the money, the target account, the amount you want to transfer) and sign them, using the private key which belongs to your account. For this signature ...


18

For such a scheme to work, if I have some currency, I have to be able to give it to Abel and I have to be able to give it to Beth, but I have to be unable to give it to both Abel and Beth. This means that giving the currency to Abel has to somehow make me unable to give the currency to Beth even though I previously could do that. There are three mechanisms ...


15

I don't believe that there's any way to generate the vanity hashes without iterating. In base 58, there's $\log_2(58) \approx 5.858$ bits per letter, so fixing 8 letters would need in average $58^8/2 = 2^{\log_2(58)·8}/2 \approx 2^{46}$ iterations. Note that Bitcoin addresses always start with a 1 by convention (this comes from the version field), and the ...


12

I have a list of Bitcoin-related publications here: Bitcoin Bibliography (Crypto & Security) They are all the academic papers (as opposed to whitepapers) that I know about, relating to security or cryptographic aspects (as opposed to economic or implementation aspects) of Bitcoin. Most are published.


11

Here's the Research article on the Bitcoin wiki: http://en.bitcoin.it/wiki/Research You might find some of the authors in the list have related research that is not directly related to Bitcoin so is absent from that list.


8

SHA-256 uses an internal compression function $f$ which takes two inputs, of size 512 and 256 bits respectively, and outputs 256 bits. Hashing works like this: Input message $M$ is first padded by appending between 129 and 640 bits (inclusive), resulting into a padded message $M'$ whose length (in bits) is a multiple of 512. $M'$ is split into $n$ ...


7

The Bitcoin mining algorithm can not be simplified by exploiting any weakness in the SHA-2 hashing algorithm with the current state of the art. The problem is manyfold. From the SHA-256 point of view, there is no (partial) preimage search algorithm that applies to the full hash function. Even worse, the attacks that penetrate a fewer number of rounds have ...


7

Uniformity is a tricky one. SHA-256 (as well as SHA-3 for that matter) follows a heuristic approach. That is, the design is not based on a hardness assumption (for example, the factoring or discrete-log assumption) but on criteria that have only been verified empirically. As such, also the study of uniformity is an empirical study. The development of ...


5

Most of what the bitcoin system does consists of using well-known algorithms for their intended purposes. It is unlikely that there will be a fundamental or algorithmic problem in these parts of the system. There may be a software bug in the reference client, of course. There once was such a bug -- an overflow bug that allowed people to create transactions ...


5

The classic way to do this is to have all parties commit to individual random values by publishing a secure hash of a suitably random-nonce-padded number. Once the commitments have been distributed, the parties open the commitments by publishing the nonce and the number. The numbers are combined in some previously agreed suitable fashion such as adding them ...


5

The SHA-256 algorithm works by applying an encryption function in Davies-Meyer mode and Merkle-Damgård chaining. Merkle-Damgård works by first dividing the message to-be-hashed into chunks. In the case of SHA-256 these chunks are 64 octets long. Because Merkle-Damgård chaining is used, the internal state after processing the first 64 octet chunk depends only ...


4

This would hopefully eliminate the worry that somebody could reverse-engineer the process by which I generate the brain wallets. By Kerckhoffs's principle, you should assume that the adversary already knows the algorithm, and the only thing unknown are the secret keys – in your case, the passphrases. Therefore, the adversary by definition knows that ...


4

A service that provides such numbers is called a random beacon. Since everyone has to agree on what a beacon's value is and peers may not have a complete view of the network, it is very difficult to construct a universally verifiable value using only internal network data. Since data only becomes canonical when it is included in a block (a block that is ...


4

You appear to be testing a DER-encoded integer. DER-encoded integers are defined so that they can encode both positive and negative values (in cryptography, we don't need to encode negative integers all that often; however ASN.1 isn't specific to cryptography). DER-encoded integers are defined this way: Positive values are represented by the minimal ...


3

Assumption: the normal user can read the message, which is displayed on his screen. Generic attack: the user uses a camera to take a snapshot of the screen when the message is displayed. And voila! What you seek is demonstrated to be impossible.


3

The access codes were recently leaked (by whom, I don't know). My Yubikey is listed and I can confirm that the access codes were necessary and sufficient to reprogram it. You can change or remove the access code as part of reprogramming too. The leak doesn't make the Yubikeys useless in the extremely unlikely event of Gox rising from the flames — no ...


3

I would assume that all the operations are to be done in the elliptic curve group (viewed as a module over $\mathbb Z/k\mathbb Z$, where $k$ is the order of the group), so that addition is the group operation and multiplication is elliptic curve point multiplication. That is to say, assume we have an elliptic curve $E$, equipped with the point addition ...


3

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 ...


2

At the core of your question is a concept called entropy, which is the amount of uncertainty or unpredictability in a set of data. In cryptography, entropy is related to probabilities, expressed in terms of powers of 2 (bits.) For example, a fair coin flip has one bit of entropy: it can be either heads (1) or tails (0). Flipping four coins gives you ...


2

A good hash doesn't give you any information about password length or anything else. The only attack against such a hash is guessing the password, and then using the hash to verify if it was correct. Depending on the hashing scheme, the cost per guess can vary widely. For example with plain MD5 a single graphics card can try several billion guesses per ...


2

About the best you can do is have a master public/private key pair where the public key is stored on your server and the private key is stored offline. When you generate a new private key, encrypt it with the master public key and store that in the database. That way, if a password is ever lost, you can recover the user's private key by using the master ...


2

Bitcoin doesn't use RSA, it uses ECDSA. Every 256-bit value is a valid private key. (Though a very small fraction of them have to be folded.) But even if the numbers had to be special, it still wouldn't matter. You could use every 256-bit value as a seed to a pseudo-random number generator which you could use to deterministically generate numbers that had ...


2

This is a well-known problem from the secure multi-party computation literature, known as the coin-tossing problem. Several people want to get together and jointly generate an unbiased coin toss, where the security property is that no one can influence the bias of the coin. The problem is impossible if adversaries are allowed to be computationally ...


2

You can do it with two machines. https://www.iacr.org/archive/crypto2001/21390136.pdf (this paper is for DSA; it's easy to adapt for ECDSA). Here's an open-source JavaScript implementation of two-party ECDSA signing, using Bitcoin parameters: http://www.jpaulgossip.com/demo/split-key.html Unfortunately the protocol requires at least three rounds of ...


2

If you wait a bit, then you can point her to the papers that will appear here Workshop on Bitcoin Research which is going to be held during Financial Crypto 2014.


2

If what you want is some kind of algorithm that takes a public key $Q = aP$ on one curve and converts it into $Q' = a P'$ on the other curve, then the answer is almost certainly no. There are no "interesting" maps between curves with different group structures. If you just want to use the same secret key for both curves, so $Q = aP$ on one curve and $Q' = ...


1

Your diagram is not very clear, but XOR is not a good combiner function to use for timestamping, as it may allow backdating in some circumstances. For instance, see the "time travel" attacks in Section 3.3 of the following paper (e.g., pp.179-180): Cryptanalytic Attacks on Pseudorandom Number Generators. Depending upon how many inputs you have to the XOR ...


1

The current status as of the time I write this is: There are no known attacks on second pre-images for truncated SHA-256 that are faster than brute force.


1

There are a number of known attacks that can occur right at the point of block formation. The most recent one, transaction malleability, wasn't really the reason for Mt Gox's demise, but it surely created some problems (and for the most part has been fixed). Unfortunately there is a theoretical, but pretty convincing theory, about what has been called cartel ...



Only top voted, non community-wiki answers of a minimum length are eligible