Every few years there seems to be an exploit found in Trezor that allows people to bypass the security. I was wondering has there every been the same case for Bitcoin Core wallet encryption?
Add a comment
|
1 Answer
Bitcoin core weaknesses?
Bitcoin core wallet encryption uses AES-256-CBC. So far as I know this is still regarded as a good encryption system although people have identified potential issues with cipher-block-chaining (CBC)
Other likely weaknesses might include
- Poor implementation in Bitcoin core.
- Poor choice of passwords/passphrases by the end-user.
- Poor protection against snooping of in-memory keys etc by Bitcoin core or the OS.
- etc
I don't recall any major issue being reported so far. There are currently 0 security advisories. A quick scan of previous common vulnerabilities for wallet related vulnerabilities doesn't find anything.
A careful study of the release-notes or even change-logs for Bitcoin core might reveal the fixing of an exploitable weakness. A careful web-search might throw something up. I haven't found anything but have not spent any time on this.
Trezor weaknesses
Published weaknesses include
- weak proof of genuineness with respect to cloning etc.
- side-channel attack by measuring power consumption during PIN entry.
- extracting private key or seed from flash memory ICs
These require physical access to the device.
These don't really translate well into possible attacks against bitcoin core.
If you run bitcoin core on a PC say, and an attacker gets physical access to your PC, your security is probably gone.
If I had bitcoin core on a PC and suspected someone malicious had had physical access to it, I'd burn the PC and everything it touched, buy a new PC and recreate the wallet from offline backups, then transfer all remaining funds to yet another new/fresh/clean wallet or wallets.
answered Jun 18, 2019 at 13:10
