51
votes
Accepted
ECDSA: (v, r, s), what is v?
This has nothing to do with RFC6979, but with ECDSA signing and public key recovery.
The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
- 94.1k
32
votes
What does the curve used in Bitcoin, secp256k1, look like?
you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 ,
there you will find some technical details about the secp256k1 used in bitcoin.
Below an illustration of the secp256k1's elliptic ...
- 1,111
26
votes
Accepted
Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?
Because of the Birthday paradox, you only need 280 addresses (despite there existing 2160 different address combinations) before a collision becomes probable.
Thankfully, that is still an enormous ...
- 94.1k
22
votes
Accepted
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
We don't know. The secp256k1 curve (and the corresponding generator) was defined and standardized by people at Certicom. I know people have inquired about its origins, but it appears those involved ...
- 94.1k
17
votes
Accepted
What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?
Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
- 7,606
17
votes
Should I share my seed phrase to earn airdrop tokens?
No, it is not safe. Never share your 12 word phrase. It is a backup of your private key and allows people to spend your money. They only need your public key or Bitcoin address to give you money, not ...
- 412
12
votes
Accepted
Byte array to hexadecimal and back again in JavaScript
Here's something you can copy-paste in.
byteArray = new Uint8Array([181,143,16,173,231,56,63,149,181,185,224,124,84,230,123,36]);
function toHexString(byteArray) {
return Array.prototype.map.call(...
- 29k
11
votes
Accepted
Problems with deterministic ECDSA based on RFC6979 in Bitcoin
Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly ...
- 13.9k
11
votes
Why does the TXID have 256 bits when Bitcoin's address security is 160-bit?
Security levels
First of all, the relation between security level and the number of bits involved is non-trivial, and depends on the sort of attack we're talking about. For what follows, there are ...
- 94.1k
9
votes
Accepted
How to generate a Bitcoin Private Key Checksum
F29E9187 are indeed the first four bytes of the double sha256 of the bytes:
802CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B982401
In order to check this, you need to compute the ...
- 1,504
9
votes
Accepted
Is there a point on the secp256k1 curve for any given X coordinate?
The size of secp256k1's coordinate field is 2256 - 232 - 977.
That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate.
Only slightly less ...
- 94.1k
9
votes
Accepted
BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?
The reasons for the 3 numbers:
Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
- 94.1k
8
votes
HMAC "Bitcoin Seed" for BIP32
It is specified in BIP32 (https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key ...
- 94.1k
8
votes
Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?
A very relevant answer can be found here: Is Each Bitcoin Address Unique?
This is a question of the birthday attack on the hashes. Bitcoin addresses (assuming the "normal" style starting with a 1) ...
- 11.6k
8
votes
Accepted
How can my private key be revealed if I use the same nonce while generating the signature?
Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points.
The group generator is G (a known constant).
The private key is q, its ...
- 94.1k
8
votes
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
As Pieter already described in his answer it is not known why the multiplicative inverse of 2 of the generator point of secp256k1 is such a short (166 bit) number.
But interestingly all prime order ...
- 131
8
votes
Accepted
Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?
The secp256k1 arithmetic is defined over the finite field of integers modulo 2256 - 232 - 977.
The following code works:
M = 2**256 - 2**32 - 977
Acurve = 0
Bcurve = 7
Gx = ...
- 94.1k
7
votes
Accepted
Private key generation doubt
You're right, there is no strict requirement that the private key is strictly less than the group order.
However, it is required that the resulting public key is uniform, which implies that (x % n) ...
- 94.1k
7
votes
Accepted
What are the 3 arguments called in function SHA256?
Let's disect this function call:
void sha256(struct sha256 *sha, const void *p, size_t size)
First we realize that the return value is void which means the function does not return the sha256 of the ...
- 11.5k
6
votes
What exactly is generator G in Bitcoin's elliptical curve algorithm?
The value of
G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798
and
G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B ...
- 585
6
votes
Accepted
Why is only the block header SHA256-hashed and not the whole block?
In fact, it is done over the whole block, but indirectly.
One of the members in the block header is the Merkle root hash of the transaction hashes. Effectively, that is a hash of all the transactions....
- 94.1k
6
votes
Accepted
SECP256K1 Minimum Value for Private Key
If people in general would more often pick lower integers as private keys than larger integers, then it would be a good strategy for an attacker to start with lower integers.
However, the opposite ...
- 94.1k
6
votes
To what extent does asymmetric cryptography secure bitcoin transactions?
Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions?
asymmetric cryptography is not really something that was added on top of Bitcoin in order to ...
- 22.2k
5
votes
Accepted
Why is a chain code needed for entropy in HD wallets?
For reference, the original spec is located here.
A few minor adjustment to your basic equations of how HD wallet child key derivation works. (And also note that these equations only apply for non-...
- 13.9k
5
votes
How to generate Ed25519 public key from private key using libsodium?
It's not possible to directly compute the ed25519 public key from the private key. Instead, use the deterministic private key to create a seed, then use the seed to re-create the private key with its ...
- 2,997
5
votes
What is a compressed Bitcoin key?
a good explanation is available in How can I test if a bitcoin address is compressed or not?
More specifically, a public key in Bitcoin is a pair integers (x,y).
For uncompressed public keys, ...
- 1,111
5
votes
Accepted
What's the difference between xpub and bpub?
bpub appears to be the extended private key prefix for the Blockcypher testnet.
Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key.
The original ...
- 16.7k
5
votes
Accepted
What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?
What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?
There is nothing special about the combination. It's just a combination of two constructions (...
- 94.1k
5
votes
To what extent does asymmetric cryptography secure bitcoin transactions?
Without asymetric cryptography, there wouldn't be information asymmetry: in other words, everyone knows exactly as much as everyone else. If everyone knows equally much, there is no way to distinguish ...
- 94.1k
5
votes
Accepted
Elliptic Curve Point at Infinity
What exactly is the "point at infinity"?
It's a point that is added to the points on the curve. Together they form a group. It has the following properties:
(x,y) + (x,-y) = infinity
(x,y) + ...
- 94.1k
Only top scored, non community-wiki answers of a minimum length are eligible