0
$\begingroup$

I watched this video where somebody finds bitcoin wallet private keys using only the "sigR" value and the public key using a python script named "formula".
How does this work and does converting the values to decimal help somehow?

$\endgroup$
0
3
$\begingroup$

The short answer is that it doesn't work.

Bitcoin uses ECDSA signatures. An ECDSA signature is comprised of two numbers $r$ and $s$.

It is impossible to recover the private key given only a signature made with this private key and the public key.

The security of ECDSA hinges on a secret value used during the signature process, usually written $k$: this value must be fully random and must be kept secret (it's thrown away after calculating the signature). It is possible to recover the private key given two signatures and the public key if the two signatures were made in a buggy way that uses the same value of $k$. More generally, even if exactly the same value of $k$ is not repeated, if there are biases in the generation of $k$, it may be possible to recover the private key given enough signatures.

Another way to break the security of ECDSA can be to observe the signature process and exploits flaws in the implementation of ECDSA, such as side channels. Breaks of cryptographic algorithms are extremely rare, but breaks of cryptographic implementations are common.

None of this is happening in the video. This video does not show any kind of cryptographic or security flaw.

The video shows someone copy a bunch of values which they say is a “private key”, then take an ECDSA signature, pass it to a program that they don't understand, and get out a value which they claim is a “private key”. There is no information about what that program does.

Whoever made this video is taking a long time just to convert between hexadecimal and decimal notation, which is a trivial detail that can be handled in a fraction of a line in Python. They clearly don't know the first thing about Python, otherwise they'd be able to modify the script to use a more convenient input/output format.

This video has zero technical interest or novelty. Given that it's cryptocurrency-related, it's probably part of a scam. The author is presumably trying to convince naive people that they know something the audience doesn't, but given how incompetent the author is, they're really aiming for the bottom of the barrel. Which is the best target when you're trying to scam people.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.