Questions tagged [cryptocurrency]

A cryptocurrency is a digital currency powered by cryptography. This tag is applicable only to Q&As about the cryptographic mechanisms used by a currency, not for questions about economy, usage, or acquisition of any particular currency. Please note that Stackexchange has dedicated websites for Bitcoin, Ethereum, Monero, etc.

Filter by
Sorted by
Tagged with
54
votes
3answers
9k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
41
votes
4answers
34k views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
38
votes
2answers
11k views

How does hashing twice protect against birthday attacks?

The bitcoin wiki says: Bitcoin is using two hash iterations (denoted SHA256^2 ie "SHA256 function squared") and the reason for this relates to a partial attack on the smaller but related SHA1 hash. ...
31
votes
2answers
3k views

Prevent double-spending with decentralized digital currencies without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
25
votes
1answer
7k views

Why hashing twice?

I'm trying to understand the Bitcoin protocol, and sometimes see instructions like this: The TransactionId is defined by SHA256(SHA256(txbytes)) or The hash of the public key is generated by ...
20
votes
4answers
2k views

How secure is the Bitcoin protocol?

Are there any evidence (other than not being cracked so far) that the Bitcoin protocol is secure? "How secure" is it? (I realize that this might not qualify as a meaningful question - feel free to ...
20
votes
1answer
787 views

How to provide secure “vanity” bitcoin address service?

Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
18
votes
2answers
6k views

SHA-256: (Probabilistic?) partial preimage possible?

Currently busying myself with the Bitcoin "mining" algorithm, I am wondering if the process really cannot be simplified. For reference, the algorithm is basically SHA-256d: $$\mathit{success} := \...
11
votes
1answer
181 views

A general definition for cryptocurrencies

I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into ...
10
votes
3answers
814 views

Bitcoin Research

I have recently been assigned to advise a student on a senior thesis in math. She has taken linear algebra, introductory real analysis, basic cryptography, and abstract algebra. Her interest is in ...
9
votes
2answers
525 views

Is there a guarantee that for each possible hash y there exists a number x such that with hash function H, H(x) = y?

Specifically talking about SHA-256 here and its involvement in Bitcoin, this was a question someone asked me which I didn't know the answer to. Yes, I am aware that SHA-256 can only have a hash from $...
9
votes
1answer
1k views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
9
votes
1answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
8
votes
2answers
1k views

Does secp256k1 have any known weaknesses?

I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size. I have heard that being a Koblitz curve, it ...
8
votes
2answers
2k views

Why don't crypto-currencies use the Lamport signature scheme?

The Lamport signature scheme is faster, less complex and considerably safer than ECDSA. It's only downside - being only usable once - isn't really a downside when signing transactions, since you could ...
8
votes
1answer
1k views

How can uniformity of hash functions (e.g. SHA-256) be proved?

In reading about the Bitcoin protocol I noticed how much its proofs-of-work apparently depend on uniformity of the SHA-256 hash function. And so presumably do many other applications. How do ...
8
votes
1answer
376 views

Is the 'nonce' in bitcoin really a nonce?

Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed ...
7
votes
3answers
4k views

How to deal with collisions in Bitcoin addresses?

When creating a Bitcoin account, you need to issue a couple of private/public ECDSA keys. Then, you derive your account address by taking a 160-bit hash (through SHA-256 and RIPEMD) of the public key ...
7
votes
1answer
1k views

Elliptic curve cryptography related key attacks [closed]

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
6
votes
2answers
147 views

Is there a signature scheme which doesn't rely on the difficulty of factoring/dlp which generates short signatures?

The Lamport signature scheme, for example, doesn't rely on the difficulty of any problem and it only depends on the existence of one-way functions. Is there an alternative scheme which also doesn't ...
6
votes
1answer
575 views

Can a digital money system exist, that's secure, anonymous and allows offline transactions?

I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
5
votes
2answers
274 views

Ways to make a “doomsday” cryptocurrency which becomes untradable

As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, ...
5
votes
1answer
963 views

Any use for now-defunct Mt Gox Yubikey? [closed]

As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the ...
5
votes
1answer
563 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
4
votes
3answers
207 views

Why won't a BFT protocol using simple signing/voting work?

PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
4
votes
1answer
669 views

SECP256K1 Jacobian algorithms

I am working on a bitcoin related project and I am trying to speedup the ecc calculation. I started with double-and-add and sliding window. I would like to go move over to the jacobian coordinates. ...
4
votes
1answer
121 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
4
votes
1answer
361 views

Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)? [closed]

To formulate this question precisely, I will define an idealized hypothetical "perfect" hash function $H(n)$ which has nice scalability properties, and will formulate a problem PERFECT HASHCASH in ...
3
votes
1answer
358 views

Is it possible to combine digital signature to provide message addition?

Let's assume we are using the textbook RSA where $Sig(x)=x^d$. Alice has public key $(e,N)$, and private key $(d,p,q)$. Now, if Alice sends $Sig(5)$ and $Sig(10)$ to Bob, where $5$ and $10$ is just ...
3
votes
1answer
777 views

ECC partially blind signature scheme verification

Continued from Is there a flaw in this ECC blind signature scheme? The problem I needed a partially blind signature scheme for one of my projects, but couldn't find one on the internet, so I've made ...
3
votes
1answer
199 views

Do I need to provide entropy to secp256k1_ecdsa_sign() ?

using secp256k1_ecdsa_sign() I noticed the same data signed multiple times, coming back with the same signature. I always thought that signatures are different because random data is somehow involved....
3
votes
1answer
265 views

Cryptocurrency for quantum computers that is physically impossible to double-spend?

Could a cryptocurrency running (at least partially) on a quantum computer (and/or on a quantum network) be developed in which it is physically impossible to double-spend? In other words, a coin in ...
3
votes
1answer
474 views

Brute forcing an elliptic curve encrypted key

I've been reading about ECC, and what I've established so far (correct me if I'm wrong) is that: pubKey = privKey * G where G is some special point on the secp256k1 curve. Doesn't this mean we ...
3
votes
1answer
1k views

How is the base64 encoded signature in Craig Wright's proof constructed?

Mr. Craig S. Wright might be Satoshi Nakamoto - the inventor of bitcoin. He is currently proving the case. But how is the base64 encoded proof, that is published by himself on his blog post ...
3
votes
1answer
55 views

How to decrypt using public key?

Can anyone decrypt ciphertext using a public key? I always thought we can only decrypt using a private key. In that case, what does this line in the RLPx documentation mean? ...
3
votes
1answer
797 views

Blockchain use in record management

From my understanding of blockchain, I feel the main use of blockchain is to do something in a decentralised way as compared to the traditional centralised way which involves a middle man. Usually, ...
3
votes
3answers
1k views

Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin. I need multiple wallets because a) I don't want all my eggs in one basket, and b)...
3
votes
1answer
1k views

Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our ...
3
votes
2answers
129 views

Post-quantum SNARGs with near-constant verification?

We're building a private computation platform similar to Zexe, where nested proofs are used to preserve the privacy of the programs being computed. We may use different proof systems for the inner and ...
3
votes
1answer
1k views

GoofyCoin question — why pk, why not sk?

At 45:43 in this video (from the Princeton Coursera Bitcoin and CryptoCurrency Course), they talk about GoofyCoin and show the image below. My question is, why does it say "signed by pk"... isn't the ...
3
votes
1answer
462 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
3
votes
1answer
64 views

Time locked cryptography using Bitcoin difficulty param and/or smart contract?

Outcome: Create a message with a count down timer. Once a top level password is entered, a countdown timer starts. Once timer expires, the message is decrypted. Known methods: Proof of work. ...
3
votes
1answer
103 views

POW with Linear time to solve it?

Any suggestions for A Proof-of-Work algorithm in literature so that the time required for solving it is linear with the puzzle difficulty ??
3
votes
1answer
137 views

Piggyback on Bitcoin for independent data verification?

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival. ...
3
votes
1answer
203 views

Could eVoting on the bitcoin blockchain be done?

I'm basically a crypto noob (and not an english native), so please be indulgent :) I thought about if you could realize an eVoting system with bitcoin. I see 2 major requirements: each citizen can ...
3
votes
1answer
358 views

Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
3
votes
1answer
67 views

Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?

In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers : ...
3
votes
1answer
116 views

How can I generate a deterministic evenly distributed random number in a blockchain

Here's the hypothetical. There's a blockchain, which for the sake of simplicity, is modelled around Bitcoin and proof-of-work. My goal, is that for each mined block, rather than a set reward (12.5 ...
3
votes
2answers
198 views

Lack of usage of secrets in ZK Bitcoin ownership proof

I read the paper "Provisions: Privacy-preserving proofs of solvency for Bitcoin exchanges" which is available for download on http://crypto.stanford.edu/~dabo/pubs/abstracts/provisions.html and have ...
3
votes
0answers
242 views

Could the multisignature scheme in bitcoin alternatively also be implemented by means of a Shamir Secret Sharing Scheme?

When I first came across the Bitcoin multisignature scheme, I wondered that it remarkably looked similar to what Shamir Secret Sharing does (SSS), but then by using facilities in the bitcoin scripting ...