Mr. Craig S. Wright might be Satoshi Nakamoto - the inventor of bitcoin. He is currently proving the case.

But how is the base64 encoded proof, that is published by himself on his blog post constructed? Is it random or some sort of collision attack?

My following PHP code "proves" that the signature is valid. It takes the signature, decodes the base64 string and outputs the result in hex. This again is contained in the hex output of a bitcoin transaction from 2009.

$proof = bin2hex(base64_decode('MEUCIQDBKn1Uly8m0UyzETObUSL4wYdBfd4ejvtoQfVcNCIK4AIgZmMsXNQWHvo6KDd2Tu6euEl13VTC3ihl6XUlhcU+fM4='));
echo "proof: $proof<br>";

$tx = substr(file_get_contents('https://blockchain.info/tx/828ef3b079f9c23829c56fe86e85b4a69d9e06e5b54ea597eef5fb3ffef509fe?format=hex'),86,142);
echo "tx: $tx<br>";

How do you construct such a string so that this is possible? To me this looks like a very good magic trick, but I can't explain the construction of the input value.


Short version: the signature is correct, it is a real signature and therefore it is possible to verify it with one's favourite software. The scam is not based on a cryptographic attak but on what is signed. Craig Wright has recovered an old (and real) Satoshi's signature and tried to provide it as a new signature to validate his identity. It's, as someone suggested, like to cut out the last page from a contract, paste it to another contract and claim the new contract is ok.

More details:

Wright claimed that he provided a signature on a large file, a text from Sartre. As the text is big, the signature is the decryption of the hash of this text. The clever move by Wright is to sign the SHA256 of this file, so the final signature is something like: secp256k1(sha256(sha256(file))) and one may remark the double use of the hash function SHA256 (while a standard signature would be something like secp256k1(sha256(message)).

The Bitcoin protocol describe how a transaction has to be signed: secp256k1(sha256(sha256(transaction))).

The algorithm are the same, if the "transaction" and "file" are the same, or better, if their hashes are the same, one signature for the transaction is a valid signature for the file and viceversa.

Wright tried to sell to the world and old signature of a transaction as a signature of the hash of a text. Why he did it? Because we are not provided of the original Sartre text and therefore is impossible to compute the valid SHA256 image (which text? how is formatted? which charset? newlines? every little change in the text would change the hash) and we cannot search for a given hex string into the blockchain.

A more complete guide to Wright process is available at http://blog.erratasec.com/2016/05/satoshi-how-craig-wrights-deception.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.