6

Yesterday Trezor released details of a segwit-related hardware wallet vulnerability.

The writeup claims that providing full previous transactions to the hardware wallet prevents the exploit.

My question: Why can't the compromised desktop software provide fake previous transactions corresponding to the fake inputs?

Using the example in the writeup:

  • In "step 2", create a fake transaction containing an output spent by "input 2" with value 5.00000001 BTC and same outpoint as the 20BTC UTXO.
  • In "step 5", create a fake transaction containing an output spent by "input 1" with value 0.00000001 BTC and same outpoint as the 15BTC UTXO.

The offline signer couldn't know that these fake transactions aren't on the blockchain. Most hardware wallets don't show information about the UTXOs being consumed so the user couldn't catch it by inspection. Does the fix involve incompatible sighash values for the two rounds?

  • The attack vector seems very edge case, I'm also interested in more details regarding the proposed fix. – m1xolyd1an Jun 5 at 1:58
4

Answered on Twitter

The hash of the provided prevtx must match the prevtx hash given in the input. The attacker is unable to construct a fake prevtx that hashes to a predefined value. The prevtx hash in the input cannot be changed either, otherwise the network will reject the tx.

Basically, you can't create fake previous transactions because that would require producing a sha256 collision, which we assume can't happen.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.