Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
26

Because of the Birthday paradox, you only need 280 addresses (despite there existing 2160 different address combinations) before a collision becomes probable. Thankfully, that is still an enormous number. At 90 million addresses per 4 hours, it will take about 445 times the age of the universe to reach that number. It's also irrelevant. Even if anyone - or ...


16

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the source of these signatures. Copay is a multi-signature wallet which was initially released around that time. As I'm not a javascript developer it took me a bit of ...


8

A very relevant answer can be found here: Is Each Bitcoin Address Unique? This is a question of the birthday attack on the hashes. Bitcoin addresses (assuming the "normal" style starting with a 1) encode 160 bit hashes, so the output space has a possible 2^160 hashes. Because its a hash function, we assume all outputs have equal probability of being output. ...


8

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its corresponding public key is Q = qG. The nonce is n, its corresponding point is R = nG. The X coordinate of R is r. The hash function is h(x). A signature is (r,s)...


7

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that ...


5

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we aim to always require an attacker to perform 2128 steps. If the seed has less than 128 bits of entropy, this inevitably leads to a faster algorithm, where an ...


4

It's easy to verify the order (n): Multiply G by n and find that you get the point at infinity. This proves that n is either the order or a multiple of it. Then convince yourself n is prime using a Baillie-PSW primality test, so it must be the order itself and not a multiple of it. Finding the order is not quite so simple as verifying it. To do so you ...


4

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (ChaCha20 for the stream cipher, Poly1305 for MAC) that are designed with similar goals in mind: Easy to write a correct implementation in software Optimized for ...


4

This is valid, and there are even smaller types as well. Be aware that Bitcoin no longer really uses ASN.1 DER, but a even more restrictive subset of it. ASN.1 itself as it turns out is not deterministic or platform independent in many implementations, which is a source of consensus failure. For reference, here is how to encode signatures correctly in ...


3

The security implication of removing a checksig operation from the encumbrance script is that the coins can be stolen while in flight by anybody, and especially by miners. Obviously, on testnet, only someone who's bored or interested enough to grab the coins will take the time to "attack" your transactions. There's not much sense in listing and analyzing ...


3

A Bitcoin mining ASIC: does not attempt to complete a single hash, rather fragments of two SHA256 compression rounds which is then compared to a target, the result is never returned can not accept arbitrary information that is not in the form of a partial SHA256 compression round So in terms of competitiveness, a CPU can actually complete a SHA256 hash, ...


3

The semantics of multiplication are different in your two equations. As for the first equation. The s-part of a signature is an element in a group (represented by a number) so the inverse exists and is easy to compute (or even well known) In the second case you take the numerical value of the private key and compute the multiple of this with a base point. ...


3

Questions like this cannot be answered without specifying the digital signature scheme you're using. In general In general, a digital signature scheme consists of 3 algorithms: KeyGen() -> (PrivKey, PubKey): generates a private key and a corresponding public key. Sign(PrivKey,Message) -> Signature: signs a message with a given private key. Verify(PubKey,...


3

bpub appears to be the extended private key prefix for the Blockcypher testnet. Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key. The original xpub notation comes from BIP32, meaning extended public key. This expanded into ypub with BIP49, and finally zpub with BIP49+ (used in BIP84). Various coins can ...


2

Imagine attacker introduces 100000 rogue nodes in the network and their goal is to send false information about transaction validity ... That's no possible. Every node validates blocks and transactions for itself. It doesn't matter what another node tries to represent - if the block is invalid, it's ignored by the receiving node. Proof-of-work is ...


2

A "digital fingerprint" is a unique identifier that references some particular piece of data. Typically, the fingerprint is fixed in size and the information it references is much larger in size. In this case, a bitcoin address is a 160-bit digital fingerprint of a 256-bit public key created by hashing the public key twice. The difference between a digital ...


2

What are the advantages (and disadvantages) of using this over other specifications such as secp256r1? Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1. That isn't true today, and the fastest implementations of k1 are considerably faster than r1. Secp256k1's security critical parameters are ...


2

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N. 1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of ...


2

No, and this will not happen in the foreseeable future. Any given hash calculation will result in any one of 2^256 possible numbers. That means, the odds of finding any one exact number is 1/2^256. Even at today's hashrate of ~47000000 TH/s, it would take you 7.812×10^49 years to find a preimage for every one of those 2^256 numbers, assuming each hash you ...


2

Yes, just set X=1, and Y=number of people.


2

It's possible, but: It's much slower Pubkey recovery for this kind of application is arguably patented For a "signature only" scriptpubkey, we already have p2pk. Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.


2

Details are in BIP 146: We require that the S value inside ECDSA signatures is at most the curve order divided by 2... ... A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S. Signatures encode two important values for verification r and S. If (r, S) is a ...


1

The only way to determine the private key associated with a given public key is by a brute force method, spanning the entire 2^256 key space. More specifically, any number from 0x1 to 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364140 (order of G) is a valid private key. According to an article on wikipedia on brute force cryptography,...


1

...you've forgotten your private key/s. How do you prove that this is true You cannot prove that you have forgotten something. How would you prove you don't have a secret backup hidden away? Is there a transaction you can make, or a message you can sign? No, making transactions and signing messages are both actions that require the use of your private ...


1

The vulnerability affects the encryption of the wallet file, weakening the encryption by lowering the resources needed to brute force attack it. Practically, this means if an attacker were to get a copy of your wallet.dat file, they would have an easier time brute force attacking it (ie. guessing your password would become a little easier), compared to an ...


1

Currencies get value from demand and supply not from governments backing them. Currencies have existed long before government's started stamping them out in their own name. The demand for a currency comes from the utility that it offers as a medium of exchange. Even pre-historic humans went out of their way to create currencies because they were useful. ...


1

You need: 1) libsecp256k1 to calculate the public key from a private key 2) Hash the result with Sha2/256 + RipeMD160 3) Add version byte and 4-byte checksum 4) Encode it using Base58. My minimal code would work. So, it's not really simple


1

Your first three questions are questions about what you want to do. We have no way to know what you want to do. Your fourth question is technical: according to What is proof-of-stake? it was said that someone possessing 1% of the total stakes "mine" 1% of the total blocks, it gets confusing here, if example 1 block contains 100 transaction, so this 1% ...


1

You can communicate transaction details to your counterparty using the app, but afaik neither of the messenger apps you mentioned have a cryptocurrency transfer system built into them. So you'll need a wallet app, but otherwise you can communicate with your counterparty through the messenger app (agree on the amount to be transacted, send a payment address,...


1

Bitcoin is a network that allows participants to hold and transfer value amongst each other. A journalist could use it to transact with sources, or perhaps to withhold their money from the grasp of an over-reaching government, but it will not protect a journalist that is publishing articles from an angry government. A journalist could publish anonymously, ...


Only top voted, non community-wiki answers of a minimum length are eligible