58 votes

Is secp256r1 more secure than secp256k1?

The main difference is that secp256k1 is a Koblitz curve, while secp256r1 is not. Koblitz curves are known to be a few bits weaker than other curves, but since we are talking about 256-bit curves, ...
  • 31.5k
52 votes
Accepted

How does hashing twice protect against birthday attacks?

A collision in any hash function gives a collision in a "squared" variant of the hash function. This is easy to see. If hash(x)==hash(y), then hashing the outputs ...
  • 37.9k
30 votes
Accepted

Why hashing twice?

A common rationale for hashing twice is to guard against the length-extension property of the hash (if it has that property, as many hashes before SHA-3 did). For SHA-256, this property allows to ...
  • 126k
26 votes
Accepted

Why "1" in 51% attack on Blockchain network

From Bitcoin Wiki; A majority attack (usually labeled 51% attack or >50% attack) is an attack on the network. It is also called consensus attacks. It is only to demonstrate that one needs the ...
  • 44.2k
25 votes

Is secp256r1 more secure than secp256k1?

The curves secp256r1 and secp256k1 have comparable security. If we consider only the best known attacks today, they have very close security. Both curves are defined over prime fields and have no ...
  • 6,499
18 votes
Accepted

Is double SHA-256 the best choice for Bitcoin?

Since the initial release of Bitcoin is 9 January 2009, the designer had these NIST hash functions (NIST-FIPS 180-4) as available options: SHA-1( 1995), SHA-256 (2001), SHA-512 (2001), and some more....
  • 44.2k
15 votes
Accepted

Does secp256k1 have any known weaknesses?

secp256k1 fails the following SafeCurves criteria, but it doesn't matter for Bitcoin's use of secp256k1: CM field discriminant. secp256k1 is a Koblitz curve that admits a fast endomorphism for ...
15 votes

Why do people criticize and mistrust the e-voting based block chain?

There's a good reason many democracies reserve mail voting to rare cases where that's the only option: it allows one's vote to be influenced by duress or bribery, because one can prove how one voted. ...
  • 126k
13 votes
Accepted

How to deal with collisions in Bitcoin addresses?

Cryptography (and real security in general) offer quantitative analysis of the security provided - Meaning, real security products will describe how long they will resist a certain class of attack. ...
  • 19.3k
13 votes

Has a SHA256 output ever been found consisting entirely of the same character?

If any filtering criterion on the output of SHA-256 (with its definition independent of SHA-256 internals) leaves $n$ possible values out of $2^{256}$, then as far as we know, the best method to ...
  • 126k
12 votes
Accepted

What are the characteristics of a quantum secure protocol?

Quantum computers don't attack the protocol, they attack the cryptographic primitives used in the protocol. You need to avoid primitives that can be broken by quantum computers. Quantum computers don'...
  • 24.3k
12 votes

How does hashing twice protect against birthday attacks?

Strictly speaking, hashing twice might actually increase the chances of a collision. If there is a hash collision of two outputs of the hash function then any string that has that colliding hash will ...
  • 279
11 votes

Why don't crypto-currencies use the Lamport signature scheme?

The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature. For ECDSA in bitcoin The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
  • 2,008
9 votes

Is secp256r1 more secure than secp256k1?

Here's a good amount of hard data on a variety of curves, well-analysed and the findings summarised in a readable way: http://safecurves.cr.yp.to/ The article linked from this answer is not nearly ...
  • 191
8 votes
Accepted

ECC private key generation collision

Assume that there are $2^{50}$ keys out there. Then calculating one of these keys by chance is $2^{50} \over 2^{255}$ for each calculation or a chance of one in $2^{205}$. Now say that you generate $2^...
  • 86.5k
8 votes

Is double SHA-256 the best choice for Bitcoin?

Comparing double sha256 to sha512 is like comparing apples to oranges. For one, the result of sha512 is 512 bits in length. The result of double sha256 (or triple sha256, or quadruple sha256, for ...
  • 742
7 votes

Brute forcing an elliptic curve encrypted key

Doesn't this mean we could attempt to brute force a private key by using: $$\mathit{privKey} = \mathit{pubKey}/G$$ for all potential values of $G$? There seems to be a misunderstanding here: $\...
  • 11.2k
7 votes
Accepted

Is there a guarantee that for each possible hash y there exists a number x such that with hash function H, H(x) = y?

TL;DR: there is no mathematical certainty that every output value of common cryptographic hash functions is reachable, but for most that's overwhelmingly likely. A notable exception is double-SHA-256 (...
  • 126k
7 votes
Accepted

Why can't you hijack someone's public key

Short answer: Because the public key is derived from the private key. Recall that when we are working with elliptic curves, we rely on the elliptic curve discrete logarithm problem (ECDLP). That is ...
  • 1,105
7 votes
Accepted

How difficult is it to crack sha256(sha256(pin)) with a 6 digit pin and no salt?

Yes, it is possible to do this. You can just try each and every PIN, decrypt and then verify the private key; i.e. try a brute force approach. If you don't know the format, the toughest thing will be ...
  • 86.5k
7 votes
Accepted

Recovery Passphrase Collission for BIP-39 and BIP-44

128-bit entropy simply means that we have $2^{128}$ different values to search, which is similar to 128-bit security. For a single target that is impossible since even the collaborative powers of ...
  • 44.2k
7 votes

Is double SHA-256 the best choice for Bitcoin?

The typical reason one uses double hashing is to deal with length-extension attacks. That's because any Merkle-Dåmgard algorithm that outputs its entire state (e.g., SHA-1, SHA-256, and SHA-512) is ...
  • 1,798
7 votes
Accepted

Is the Bitcoin cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

It's really much too early to make a definitive statement one way or the other on this. The information leakage is based on a feature of some CISC architectures to allow a variable clockrate depending ...
  • 12k
6 votes

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

In ECDSA, the message is never encoded as a point in the elliptic curve. Signing in ECDSA loosely works like this: $$ \begin{align*} k &= \text{random}(0, n) \\ (x, \_) &= k \cdot G \\ r &...
  • 11.9k
6 votes
Accepted

A general definition for cryptocurrencies

I write here a partial answer to my own question (but it is only partial, feel free to write an answer of your own). In the book "Introduction to Cryptography with Coding Theory" (2nd edition), by ...
  • 595
6 votes

How to deal with collisions in Bitcoin addresses?

In this application we don't care about attackers generating collisions with themselves. What we care about is. Two legitimate users inadvertently generating the same address. An attacker ...
  • 1,554
6 votes

Is it possible to combine digital signature to provide message addition?

No, in textbook RSA signature with $\operatorname{Sig}(x)=x^d\bmod N$, there is no method to deduce $\operatorname{Sig}(15)$ from $\operatorname{Sig}(5)$ and $\operatorname{Sig}(10)$. It is possible ...
  • 126k
6 votes

Optimized modular multiplicative inverse for Bitcoin (secp256k1)

Half-extended binary GCD The extended binary GCD of the HAC's algorithm 14.61 mentioned in the question, when given positive integers $x$ and $y$ , computes integers $a$ , $b$ , $v$ with $ax+by=v=\...
  • 126k
6 votes

Does secp256k1 have any known weaknesses?

The safecurves site is substantially advertising material for the deservedly well regarded curve25519/ed25519 family curves with a rather one sided presentation. Some of the criteria it names are ...
6 votes

Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity?

The points of an Elliptic Curves $E$ over a finite field $K$ are forming a finite commutative additive group ( finite Abelian group) with the point addition as the group operation. The group needs an ...
  • 44.2k

Only top scored, non community-wiki answers of a minimum length are eligible