47 votes
Accepted

ECDSA: (v, r, s), what is v?

This has nothing to do with RFC6979, but with ECDSA signing and public key recovery. The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
user avatar
31 votes

What does the curve used in Bitcoin, secp256k1, look like?

you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 , there you will find some technical details about the secp256k1 used in bitcoin. Below an illustration of the secp256k1's elliptic ...
user avatar
  • 1,101
26 votes
Accepted

Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?

Because of the Birthday paradox, you only need 280 addresses (despite there existing 2160 different address combinations) before a collision becomes probable. Thankfully, that is still an enormous ...
user avatar
19 votes
Accepted

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

We don't know. The secp256k1 curve (and the corresponding generator) was defined and standardized by people at Certicom. I know people have inquired about its origins, but it appears those involved ...
user avatar
17 votes
Accepted

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
user avatar
  • 7,429
17 votes

Should I share my seed phrase to earn airdrop tokens?

No, it is not safe. Never share your 12 word phrase. It is a backup of your private key and allows people to spend your money. They only need your public key or Bitcoin address to give you money, not ...
user avatar
  • 412
10 votes
Accepted

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly ...
user avatar
  • 13.7k
10 votes
Accepted

Byte array to hexadecimal and back again in JavaScript

Here's something you can copy-paste in. byteArray = new Uint8Array([181,143,16,173,231,56,63,149,181,185,224,124,84,230,123,36]); function toHexString(byteArray) { return Array.prototype.map.call(...
user avatar
  • 28.6k
9 votes
Accepted

How to generate a Bitcoin Private Key Checksum

F29E9187 are indeed the first four bytes of the double sha256 of the bytes: 802CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B982401 In order to check this, you need to compute the ...
user avatar
9 votes
Accepted

Is there a point on the secp256k1 curve for any given X coordinate?

The size of secp256k1's coordinate field is 2256 - 232 - 977. That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate. Only slightly less ...
user avatar
9 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
user avatar
9 votes

Why does the TXID have 256 bits when Bitcoin's address security is 160-bit?

Security levels First of all, the relation between security level and the number of bits involved is non-trivial, and depends on the sort of attack we're talking about. For what follows, there are ...
user avatar
8 votes

What exactly is generator G in Bitcoin's elliptical curve algorithm?

You can think of the generator G as the first point after infinity on the curve. Begin with infinity and add G; the result is G. Add G to this and you get 2G. Add G to this and you get 3G. And so on. ...
user avatar
8 votes
Accepted

What exactly is generator G in Bitcoin's elliptical curve algorithm?

For a curve with for instance the equation: y^2 = x^3 + a * x + b The generator point G, or a ECDSA public key, is a pair of coordinates x and y, for which the above equation holds. To reduce the ...
user avatar
8 votes

Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?

A very relevant answer can be found here: Is Each Bitcoin Address Unique? This is a question of the birthday attack on the hashes. Bitcoin addresses (assuming the "normal" style starting with a 1) ...
user avatar
  • 11.3k
8 votes
Accepted

How can my private key be revealed if I use the same nonce while generating the signature?

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its ...
user avatar
7 votes
Accepted

Is there a fallback plan if bitcoin's underlying cryptography is cracked?

No, there is no explicit, publicly-disclosed plan for this situation. However, there is an implicit plan: when it becomes know that practical quantum computers are on the near-term horizon, the ...
user avatar
7 votes

HMAC "Bitcoin Seed" for BIP32

It is specified in BIP32 (https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key ...
user avatar
7 votes
Accepted

Private key generation doubt

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) ...
user avatar
7 votes
Accepted

What are the 3 arguments called in function SHA256?

Let's disect this function call: void sha256(struct sha256 *sha, const void *p, size_t size) First we realize that the return value is void which means the function does not return the sha256 of the ...
user avatar
6 votes

What exactly is generator G in Bitcoin's elliptical curve algorithm?

The value of G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 and G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B ...
user avatar
6 votes
Accepted

Why is only the block header SHA256-hashed and not the whole block?

In fact, it is done over the whole block, but indirectly. One of the members in the block header is the Merkle root hash of the transaction hashes. Effectively, that is a hash of all the transactions....
user avatar
6 votes

To what extent does asymmetric cryptography secure bitcoin transactions?

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to ...
user avatar
6 votes

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

As Pieter already described in his answer it is not known why the multiplicative inverse of 2 of the generator point of secp256k1 is such a short (166 bit) number. But interestingly all prime order ...
user avatar
5 votes

How can a bitcoin exchange prove its solvency while maintaining privacy?

We start out with the exchange having two things. It has a set of Bitcoin addresses that it owns, each of which has some balance. It also has a set of accounts, each of which it owes some number of ...
user avatar
5 votes

What is a compressed Bitcoin key?

a good explanation is available in How can I test if a bitcoin address is compressed or not? More specifically, a public key in Bitcoin is a pair integers (x,y). For uncompressed public keys, ...
user avatar
  • 1,101
5 votes

How to generate Ed25519 public key from private key using libsodium?

It's not possible to directly compute the ed25519 public key from the private key. Instead, use the deterministic private key to create a seed, then use the seed to re-create the private key with its ...
user avatar
  • 2,917
5 votes
Accepted

SECP256K1 Minimum Value for Private Key

If people in general would more often pick lower integers as private keys than larger integers, then it would be a good strategy for an attacker to start with lower integers. However, the opposite ...
user avatar
5 votes
Accepted

What's the difference between xpub and bpub?

bpub appears to be the extended private key prefix for the Blockcypher testnet. Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key. The original ...
user avatar
  • 16.4k
5 votes
Accepted

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible