Questions tagged [cryptography]
Concerning the broad subject of cryptography and its narrow application in Bitcoin protocol and applications.
283
questions
77
votes
3
answers
57k
views
What does the curve used in Bitcoin, secp256k1, look like?
I'm reading up on ECC curves and on many of them I see an illustration that looks like this
What does the comparable curve in Bitcoin look like, or are all curves generally the same?
- 12.7k
73
votes
4
answers
36k
views
What is a compressed Bitcoin key?
The standard Bitcoin client in version 0.6 apparently introduces compressed keys.
What are they? Are there any drawbacks to using them? Any incompatibilities with older software? Reductions in ...
- 4,751
57
votes
4
answers
7k
views
Have any cryptography experts vetted the bitcoin source code?
Theoretically, bitcoin's open source nature makes it more resistant to bugs and exploits. However, due to the specialized nature of the code, even many programmers don't fully understand the ...
- 5,392
47
votes
4
answers
34k
views
ECDSA: (v, r, s), what is v?
Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates.
...
- 5,248
34
votes
5
answers
12k
views
Bitcoin Mining ASICs used for cryptographic application? Rainbow tables?
What is the potential that the ASICs being developed for mining could be used for other cryptographic applications such as building rainbow tables? I know that for instance those that crack GSM with ...
- 655
15
votes
1
answer
2k
views
What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?
In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
- 7,646
15
votes
6
answers
4k
views
Which Bitcoin-powered gambling sites are "provably fair"?
Through the spread of Bitcoin for the purposes of online gambling, the concept of "provably fair" games came more into the limelight. Which of the Bitcoin-powered gambling websites are provably fair?
...
- 42.9k
13
votes
3
answers
2k
views
Can the Bitcoin network be used for cracking?
I'm assuming that the Bitcoin economy is rapidly building a computing cluster capable of unprecedented amount of hash searching.
Would it be possible for an attacker to leverage this to crack other ...
- 274
12
votes
5
answers
13k
views
What exactly is generator G in Bitcoin's elliptical curve algorithm?
What exactly is the generator G in elliptical curve math? It is typically described as a point on the curve. Is this a tuple of values? What properties does it have?
- 375
11
votes
1
answer
3k
views
Problems with deterministic ECDSA based on RFC6979 in Bitcoin
Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
- 854
11
votes
1
answer
640
views
What mathematical property links the Armory chain to the public/private keys?
According to the Armory site the Public Keys needed for the Bitcoin addresses can be generated without having access to the Private Keys, which ideally are stored on a completely different computer.
...
- 9,139
11
votes
1
answer
721
views
Is there a fallback plan if bitcoin's underlying cryptography is cracked?
Lets say someone started making real viable quantum computers that were affordable enough that large companies could buy one. And lets say a quantum algorithm was devised to crack the private keys of ...
- 1,571
10
votes
2
answers
2k
views
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
The generator point G in the secp256k1 curve used in Bitcoin is a known constant:
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = ...
- 1,021
10
votes
1
answer
32k
views
Byte array to hexadecimal and back again in JavaScript [closed]
I can generate a byte array with
var myByteArray = window.crypto.getRandomValues(new Uint8Array(16))
and I get
181,143,16,173,231,56,63,149,181,185,224,124,84,230,123,36
I can then turn this into ...
- 468
9
votes
1
answer
3k
views
What complexity class is Bitcoin's proof-of-work (hashcash) in?
To formulate this question precisely, I will define an idealized hypothetical "perfect" hash function H(n) which has nice scalability properties, and will formulate a problem PERFECT HASHCASH in terms ...
- 272
8
votes
2
answers
4k
views
Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?
I am running a test to see if I can obtain a successful bitcoin address collision after generating billions of addresses. I am not entirely sure how I would check them yet. Basically I have an extra ...
- 183
8
votes
1
answer
2k
views
Should I share my seed phrase to earn airdrop tokens?
Someone on Face Book said I could earn free crypto by appying for an airdrop. He told me to download Blockchain from app store to my phone. I did this and created my account with a password. I also ...
8
votes
2
answers
18k
views
How to generate a Bitcoin Private Key Checksum
I want to understand how a bitcoin private key is made up.
Looking at this graphical generator
https://royalforkblog.github.io/2014/08/11/graphical-address-generator/#hello
I understand step 1, how ...
- 468
8
votes
4
answers
786
views
How can a bitcoin exchange prove its solvency while maintaining privacy?
What methods can an exchange website use to prove that it actually has all its users' bitcoins?
These are the requirements:
User privacy is a must. No one should be able to tell how many bitcoins an ...
- 2,115
8
votes
2
answers
3k
views
If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?
If not, what else would be needed to steal all funds from all people and completely break bitcoin?
I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
- 93
7
votes
1
answer
1k
views
Where and how is secp256k1 used within Bitcoin?
Bitcoin is unique that is uses secp256k1 to secure it's transactions; and any cryptographic attack against this algorithm is probably going to be percieved as an attack against the bitcoin network.
...
- 12.7k
7
votes
2
answers
3k
views
BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?
According to BIP32's "Master key generation" section, "256 bits is advised".
See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation
Why did BIP32 consider 256 bits ...
- 123
7
votes
1
answer
847
views
Is there a point on the secp256k1 curve for any given X coordinate?
There function in libsecp256k1 that allows you to directly set the field element to 32 bytes of your choice. Does secp256k1 always return a valid group element for any 32 byte value?
...
- 671
7
votes
3
answers
3k
views
How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?
You can see a little background about this on this bitcointalk post by the late Hal Finney.
Beta and lambda are the values on the secp256k1 curve where:
λ^3 (mod N) = 1
β^3 (mod P) = 1
As seen ...
- 7,709
7
votes
1
answer
364
views
What level of mathematical understanding do I need in order to contribute or to understand the crypto behind bitcoin?
My mathematical knowledge is up to CALC II (college level.) Is this enough mathematical maturity in order to understand the crypto in bitcoin or do I need more knowledge? If I do indeed need more ...
- 73
7
votes
1
answer
569
views
What OpenCL video cards (or FPGAs) are best for multiplication?
I'm benchmarking some Bitcoin related software and am looking for cards that are better at parallel multiplication vs parallel addition.
Is there any prior work that may have this information? ...
- 12.7k
7
votes
0
answers
96
views
How does this field multiplication in libsecp256k1 work?
I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
- 856
6
votes
4
answers
2k
views
Is it possible to forward bitcoins without the private keys?
According to this question, there isn't an easy way to automatically send bitcoins from one address to another and I think that it might be useful.
So I thought about creating a website were people ...
- 11.5k
6
votes
3
answers
990
views
Papers/Books on how bitcoin works from a mathematical perspective?
I'm a math student interested in Cryptography. Is there any paper or book which explains, in mathematics and cryptography terms, how bitcoin (more general, a digital cryptocurrency system) works? In ...
user21502
6
votes
1
answer
788
views
Why is a chain code needed for entropy in HD wallets?
In the documents and articles I have read, it is stated that the "chain code" in HD wallets exists to provide entropy to the derivation of child public/private keys. If I understand the process ...
- 163
6
votes
1
answer
462
views
Bitcoin Research
I have recently been assigned to advise a student on a senior thesis in math. She has taken linear algebra, introductory real analysis, basic cryptography, and abstract algebra. Her interest is in ...
- 163
6
votes
2
answers
2k
views
Is it possible to use a PGP key as a bitcoin address?
Both bitcoin and encrypted emailing are based on public key cryptography. However, they use different implementations, so I assume that a public PGP key cannot be used as a bitcoin address directly.
...
- 1,896
6
votes
1
answer
299
views
What standard is used for the ECDSA to verify transactions?
Bitcoin used Elliptic Curve Digital Signature Algorithm. (see here). I'm wondering what standard is actually used for this Algorithm: which curve? which prime? Can anybody give me a reference? (Wiki ...
- 433
6
votes
2
answers
1k
views
Bitcoin Blockchain in the Quantum computing era
The design and the evolution of quantum computers has been one of the "hot" topics during the last 20 years.
My question is about the possible consequences of the rise of quantum computers (through ...
- 193
6
votes
1
answer
936
views
Recovering the last few digits of a Litecoin private key
Is it possible to recover the last few lost digits (10) of my Litecoin wallet private key? Are there any recovery tools available? Or will I have to try and roll my own? Crucially, what crypto ...
- 161
6
votes
2
answers
878
views
Is Electrum Cryptographically Secure?
Electrum seems very user friendly, thin and convenient, but is it cryptographically secure? One of the ways to attack any cryptographic system is to exploit weaknesses in the key generation algorithm....
- 61
5
votes
2
answers
873
views
What are the advantages of using Secp256k1?
Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
- 1,193
5
votes
1
answer
2k
views
HMAC "Bitcoin Seed" for BIP32
Pybitcointools uses the following code for calculating a master private key (BIP32) from a seed:
def bip32_master_key(seed, vbytes=MAINNET_PRIVATE):
I = hmac.new(from_string_to_bytes("Bitcoin ...
- 5,248
5
votes
2
answers
7k
views
How to generate Ed25519 public key from private key using libsodium?
Not all crypto currencies are using secp256k1 technology for keypair generation and digital signatures. Curve25519 technology (frequently used to support ECDH key exchanges) is being used by a few ...
- 3,007
5
votes
1
answer
1k
views
Address Public Private key verification [duplicate]
Apologies if this question has been asked before, but when a bitcoin client wishes to send funds to an address, does the bitcoin protocol force the client to verify that the address has a ...
- 1,094
5
votes
2
answers
3k
views
Is it possible to discover the set of bitcoin addresses from a public key?
I'm trying to find the set of bitcoin addresses from a public key associated with a user just to analyse this user transaction. Is there any way to derive/find all the addresses that have been ...
- 151
5
votes
1
answer
420
views
Does a Vanity Address reduce the randomness / entropy of the private key? Is there cryptographic proof?
Since a vanity address discards many "valid" keys in order to find one that matches a pre-determined string, I think that the "randomness" of the data would be reduced, thus weakening the key.
Is ...
- 12.7k
4
votes
1
answer
370
views
What are the 3 arguments called in function SHA256?
void sha256(struct sha256 *sha, const void *p, size_t size)
{
struct sha256_ctx ctx;
sha256_init(&ctx);
sha256_update(&ctx, p, size);
sha256_done(&ctx, sha);
}
I'm trying ...
- 504
4
votes
1
answer
280
views
Elliptic Curve Point at Infinity
Let's take into account the Bitcoin curve. My questions are:
What exactly is the "point at infinity"?
Is there more than one "point at infinity"
How can I identify if my EC generated x and y are the "...
- 322
4
votes
3
answers
967
views
Are BTC Private Keys evenly distributed in 256bit space?
If we assume that there are ~2^96 private keys for EACH bitcoin address (2^256-160) and we assume that in cryptography it is considered good property of every hash function if it evenly distributes ...
user100640
4
votes
1
answer
124
views
How does the BIP340 lift_x algorithm work?
Couple questions of code that I'm reviewing trying to learn schnorr sigs.
Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
- 331
4
votes
1
answer
117
views
Why is the Schnorr verification formula working and actually verifying the validity of a signature?
Reading the bottom of page 2 of the Musig Paper we can find that a Schnorr Signature for a cyclic Group G of prime order p with generator g is a tuple (R,s) where
R = gr for a random secret r and
s=r+...
- 11.6k
4
votes
1
answer
814
views
what is a discrete logarithmic assumption? how does it set-up trustless proofs?
pending proposal of bulletproofs as a zk proof for confidential transactions relies on fiat-shamir heuristic to be non-interactive via creating a digital signature on interactive proof of knowledge ...
4
votes
1
answer
81
views
Can ECDH peers waste each other's time at will?
Peter Dettman notes that ECDH peers can waste each other's time at will. What does he mean? Can this be weaponized against Lightning nodes?
- 899
4
votes
1
answer
153
views
ECDSA - why not using the cyclic additive group
As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7.
Now G is a cyclic group of finite order n and is, hence, ...
- 97