Segwit & Offline Signing

Question

Yesterday Trezor released details of a segwit-related hardware wallet vulnerability.

The writeup claims that providing full previous transactions to the hardware wallet prevents the exploit.

My question: Why can't the compromised desktop software provide fake previous transactions corresponding to the fake inputs?

Using the example in the writeup:

• In "step 2", create a fake transaction containing an output spent by "input 2" with value 5.00000001 BTC and same outpoint as the 20BTC UTXO.
• In "step 5", create a fake transaction containing an output spent by "input 1" with value 0.00000001 BTC and same outpoint as the 15BTC UTXO.

The offline signer couldn't know that these fake transactions aren't on the blockchain. Most hardware wallets don't show information about the UTXOs being consumed so the user couldn't catch it by inspection. Does the fix involve incompatible sighash values for the two rounds?

Answer 1

Answered on Twitter

The hash of the provided prevtx must match the prevtx hash given in the input. The attacker is unable to construct a fake prevtx that hashes to a predefined value. The prevtx hash in the input cannot be changed either, otherwise the network will reject the tx.

Basically, you can't create fake previous transactions because that would require producing a sha256 collision, which we assume can't happen.