0

I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense.

Recently I started using Sparrow Wallet and Coldcard (previously I was using a Nano X and Ledger Live) and noticed I'd been reusing receiving addresses in batches of two, always one after another within the span of a few hours or a few days. After some thinking, I realized that these were my withdrawals from the Fold rewards card. Even though my wallet was creating new receiving addresses each time it detected one had been used, there was, of course, no way for it to detect I was copying and pasting the address over to Fold, hence the reuse.

I understand that this has compromised my privacy somewhat, which is a shame, but not a major concern.

The major concern I have is that a potential security vulnerability has now been exposed. I can't claim to understand this very well, but I know it has something to do with ECDSA, and if ECDSA is ever cracked in the future, my coins could be vulnerable.

However, I've only ever reused receiving addresses. I've never spent from the same address more than once, so does that exclude me from that concern?

If it is still a concern, what's the best recourse? Creating an entirely new seedphrase and transferring the funds over? Coinjoining?

Again, I'm not particularly well versed in all of this, so please explain to me like I'm 5.

1 Answer 1

2

Address reuse is chiefly a privacy issue: because your UTXOs share the same output script, they are obviously controlled by the same entity. Reusing addresses reveals your receiving pattern, and if you spend those UTXOs in multiple different transactions, it heavily suggests that all spending transactions are (co-)authored by the same spender.

Address reuse would be a security issue if ECDSA were to become insecure in the future. The hypothetical scenario is that when a public key is known, an attacker would be able to use a quantum computer to solve the discrete logarithm problem and calculate the private key from the public key to steal your funds. Since many output types lock the funds to a hash, and hashes are more secure against quantum computing, a reused address would be more vulnerable because its public key has been revealed while an address that has only received funds would still have its public key hidden behind the hash.

You do not need to lose sleep about this. Quantum computers are decades away from doing anything interesting, if they ever will. Further, if quantum computers end-up being more of a thing than cold fusion, more than a quarter of all bitcoins are in outputs whose public keys are known. Your withdrawals from Fold would not make much of a dent either way, it would necessitate a network wide solution to keep Bitcoin viable.

6
  • So in this hypothetical scenario where ECDSA is cracked, am I right in understanding that address reuse would only put the coins associated with that particular address at risk? Not the entirety of the coins associated with the main seedphrase?
    – anonpleb
    Jul 14, 2023 at 15:57
  • 1
    Note that in theory, it's possible that even without quantum computer, elliptic curve cryptography, the secp256k1 curve, or even just ECDSA specifically get broken. If that happens, key reuse may or may not help such an attack. Similarly, even with a sufficiently powerful quantum computer capable of attacking secp256k1 ECDSA, key reuse may or may not help the attack. In general, it's very hard to talk about hypothetical future cryptographic or computational breakthroughs. Jul 14, 2023 at 16:21
  • I see, yes. But I think I'm still a little confused on some fundamentals. When I spend from a particular UTXO, I reveal the public key associated with it, right? So, if in the future a way to reverse engineer a public key is found, the funds associated with that particular UTXO would be at risk, correct? But what about all the other UTXOs that are associated with the parent seedphrase. Would they be at risk also? Or not?
    – anonpleb
    Jul 14, 2023 at 16:58
  • @anonpleb That all depends on which piece of cryptography is broken, and what is revealed. In general, if all the attacker has is a way to break break EC keys, they cannot go from one key to another key generated by the same seed. However, if they have the parent xpub of both keys, it is trivial. Jul 14, 2023 at 17:05
  • And what would have to happen for an attacker to gain access to the parent xpub?
    – anonpleb
    Jul 14, 2023 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.