# Tag Info

### Is secp256r1 more secure than secp256k1?

The main difference is that secp256k1 is a Koblitz curve, while secp256r1 is not. Koblitz curves are known to be a few bits weaker than other curves, but since we are talking about 256-bit curves, ...
• 31.2k
Accepted

### How does hashing twice protect against birthday attacks?

A collision in any hash function gives a collision in a "squared" variant of the hash function. This is easy to see. If hash(x)==hash(y), then hashing the outputs ...
• 37.7k
Accepted

### Why hashing twice?

A common rationale for hashing twice is to guard against the length-extension property of the hash (if it has that property, as many hashes before SHA-3 did). For SHA-256, this property allows to ...
• 122k
Accepted

### Why "1" in 51% attack on Blockchain network

From Bitcoin Wiki; A majority attack (usually labeled 51% attack or >50% attack) is an attack on the network. It is also called consensus attacks. It is only to demonstrate that one needs the ...
• 43k

### Is secp256r1 more secure than secp256k1?

The curves secp256r1 and secp256k1 have comparable security. If we consider only the best known attacks today, they have very close security. Both curves are defined over prime fields and have no ...
• 6,319
Accepted

### Is double SHA-256 the best choice for Bitcoin?

Since the initial release of Bitcoin is 9 January 2009, the designer had these NIST hash functions (NIST-FIPS 180-4) as available options: SHA-1( 1995), SHA-256 (2001), SHA-512 (2001), and some more....
• 43k
Accepted

### Does secp256k1 have any known weaknesses?

secp256k1 fails the following SafeCurves criteria, but it doesn't matter for Bitcoin's use of secp256k1: CM field discriminant. secp256k1 is a Koblitz curve that admits a fast endomorphism for ...
• 45.6k

### Why do people criticize and mistrust the e-voting based block chain?

There's a good reason many democracies reserve mail voting to rare cases where that's the only option: it allows one's vote to be influenced by duress or bribery, because one can prove how one voted. ...
• 122k
Accepted

### How to deal with collisions in Bitcoin addresses?

Cryptography (and real security in general) offer quantitative analysis of the security provided - Meaning, real security products will describe how long they will resist a certain class of attack. ...
• 19.2k

### Has a SHA256 output ever been found consisting entirely of the same character?

If any filtering criterion on the output of SHA-256 (with its definition independent of SHA-256 internals) leaves $n$ possible values out of $2^{256}$, then as far as we know, the best method to ...
• 122k
Accepted

### What are the characteristics of a quantum secure protocol?

Quantum computers don't attack the protocol, they attack the cryptographic primitives used in the protocol. You need to avoid primitives that can be broken by quantum computers. Quantum computers don'...
• 24k

### How does hashing twice protect against birthday attacks?

Strictly speaking, hashing twice might actually increase the chances of a collision. If there is a hash collision of two outputs of the hash function then any string that has that colliding hash will ...
• 279

### Why don't crypto-currencies use the Lamport signature scheme?

The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature. For ECDSA in bitcoin The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
• 1,998

### Is secp256r1 more secure than secp256k1?

Here's a good amount of hard data on a variety of curves, well-analysed and the findings summarised in a readable way: http://safecurves.cr.yp.to/ The article linked from this answer is not nearly ...
• 191
Accepted

• 10.9k
Accepted

### Is there a guarantee that for each possible hash y there exists a number x such that with hash function H, H(x) = y?

TL;DR: there is no mathematical certainty that every output value of common cryptographic hash functions is reachable, but for most that's overwhelmingly likely. A notable exception is double-SHA-256 (...
• 122k
Accepted

### Why can't you hijack someone's public key

Short answer: Because the public key is derived from the private key. Recall that when we are working with elliptic curves, we rely on the elliptic curve discrete logarithm problem (ECDLP). That is ...
• 1,105
Accepted

### How difficult is it to crack sha256(sha256(pin)) with a 6 digit pin and no salt?

Yes, it is possible to do this. You can just try each and every PIN, decrypt and then verify the private key; i.e. try a brute force approach. If you don't know the format, the toughest thing will be ...
• 84.5k
Accepted

### Recovery Passphrase Collission for BIP-39 and BIP-44

128-bit entropy simply means that we have $2^{128}$ different values to search, which is similar to 128-bit security. For a single target that is impossible since even the collaborative powers of ...
• 43k

### Is double SHA-256 the best choice for Bitcoin?

The typical reason one uses double hashing is to deal with length-extension attacks. That's because any Merkle-Dåmgard algorithm that outputs its entire state (e.g., SHA-1, SHA-256, and SHA-512) is ...
• 1,547

### Any use for now-defunct Mt Gox Yubikey?

The access codes were recently leaked (by whom, I don't know). My Yubikey is listed and I can confirm that the access codes were necessary and sufficient to reprogram it. You can change or remove ...
• 181
Accepted

### ECC partially blind signature scheme verification

Designing such signature schemes from scratch without having strong experience is very likely to fail and very dangerous (see the tons of bad papers out there being accepted to "dubious" conferences ...
• 12.1k

### Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

In ECDSA, the message is never encoded as a point in the elliptic curve. Signing in ECDSA loosely works like this:  \begin{align*} k &= \text{random}(0, n) \\ (x, \_) &= k \cdot G \\ r &...
• 11.6k

### How to deal with collisions in Bitcoin addresses?

In this application we don't care about attackers generating collisions with themselves. What we care about is. Two legitimate users inadvertently generating the same address. An attacker ...
• 1,534
Accepted

### A general definition for cryptocurrencies

I write here a partial answer to my own question (but it is only partial, feel free to write an answer of your own). In the book "Introduction to Cryptography with Coding Theory" (2nd edition), by ...
• 595

### Is it possible to combine digital signature to provide message addition?

No, in textbook RSA signature with $\operatorname{Sig}(x)=x^d\bmod N$, there is no method to deduce $\operatorname{Sig}(15)$ from $\operatorname{Sig}(5)$ and $\operatorname{Sig}(10)$. It is possible ...
• 122k
Half-extended binary GCD The extended binary GCD of the HAC's algorithm 14.61 mentioned in the question, when given positive integers $x$ and $y$ , computes integers $a$ , $b$ , $v$ with \$ax+by=v=\...