8

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its corresponding public key is Q = qG. The nonce is n, its corresponding point is R = nG. The X coordinate of R is r. The hash function is h(x). A signature is (r,s)...


7

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that ...


7

Let's disect this function call: void sha256(struct sha256 *sha, const void *p, size_t size) First we realize that the return value is void which means the function does not return the sha256 of the data. However we see that the first argument struct sha256 *sha is a pointer to a sha256 struct with the name sha. This suggests that the pointer that we pass ...


6

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to prevent some specific attack or fix some specific bug. asymmetric cryptography is one of two fundamental foundation stones, one of the two primary building blocks ...


5

Bitcoin doesn't use RSA and there is no encryption or cryptography that hides transaction details. Bitcoin is pseudonymous, not anonymous. There are unique identifers for every participant in Bitcoin, the somewhat hard part is tying those identifiers to actual people. So there is no RSA, number theory, or ECC involved in what the IRS is doing because none of ...


5

Without asymetric cryptography, there wouldn't be information asymmetry: in other words, everyone knows exactly as much as everyone else. If everyone knows equally much, there is no way to distinguish a legitimate sender from a malicious one. More specifically, if a symmetric construction like an HMAC was used to authenticate a transaction, miners would ...


4

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (ChaCha20 for the stream cipher, Poly1305 for MAC) that are designed with similar goals in mind: Easy to write a correct implementation in software Optimized for ...


4

This is valid, and there are even smaller types as well. Be aware that Bitcoin no longer really uses ASN.1 DER, but a even more restrictive subset of it. ASN.1 itself as it turns out is not deterministic or platform independent in many implementations, which is a source of consensus failure. For reference, here is how to encode signatures correctly in ...


4

It's easy to verify the order (n): Multiply G by n and find that you get the point at infinity. This proves that n is either the order or a multiple of it. Then convince yourself n is prime using a Baillie-PSW primality test, so it must be the order itself and not a multiple of it. Finding the order is not quite so simple as verifying it. To do so you ...


3

There really isn't a "positive" or "negative" for private keys. Private keys are unsigned integers, so they're basically all "positive". Your "negative" numbers are not actually negative, they're the modular additive inverse of the "positive" private key. Since private keys are really unsigned integers, you can't glean any information about signed-ness from ...


3

The random number generators that generate private keys should follow a uniform distribution as this is the distribution that maximizes entropy. As the private keys that are used are not known we can't measure if the keys in use have been statistically speaking distributed uniformly.


3

sha256.h has the exported (visible from outside) methods and functions. To compute SHA256, you should #include that. sha256_sse4.cpp sha256_sse41.cpp sha256_avx2.cpp sha256_shani.cpp contain SHA256 transform functions (used in SHA256.Write), each specialized for different processors with different instruction sets. Above is the list in order, most of the ...


3

The semantics of multiplication are different in your two equations. As for the first equation. The s-part of a signature is an element in a group (represented by a number) so the inverse exists and is easy to compute (or even well known) In the second case you take the numerical value of the private key and compute the multiple of this with a base point. ...


2

Details are in BIP 146: We require that the S value inside ECDSA signatures is at most the curve order divided by 2... ... A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S. Signatures encode two important values for verification r and S. If (r, S) is a ...


2

I think that the answer to your question is no, a transaction which makes every block it is included in invalid does not exist. An important core property of a cryptographic hash function is that there is no discernable relationship between the input data, and output data. If such a relationship existed, then miners could 'cheat' by only creating blocks (...


2

Public key cryptography has nothing to do with 51% attacks. The only thing a miner can do with >50% hash power is double spend bitcoins for which he controls the private key or censor transactions by not including them in the blocks he creates. He cannot spend bitcoins for which he doesn't control the private keys.


2

(Disclaimer: this is not my field.) Let g be the chosen generator and n its (prime) order. In the ECDSA algorithm, these are publicly known. It is true that g generates a cyclic (abelian) group isomorphic to Z/nZ. Now a private key consists of an integer k, and the corresponding public key is the group element h = kg. (I use additive notation since we ...


2

Yes, but not for the reason you think. You don't start with the public keys or their hashes, argue that they should be uniform, and that then implies private keys must be uniform too. It's the other way around: private keys are uniform because the algorithm to generate a private key is literally "pick a uniformly random number in this range". The fact that ...


2

Pretty much any mining operation short of buying hardware (ASICs, GPUs) is a scam. IQ Mining appears to be a ponzi scheme of some form based on a quick Google.


1

For Pay2PubKey addresses, it's always 160 bits of entropy, regardless of the address format (old, 1... or the new Bech32 format) Pay2ScriptHash addresses, in the old Base58 format (3...) have 160 bits of entropy. In Bech32, they have 256 bits. You can read more about why the developers increased it here and here.


1

It's helpful to keep in mind that a wallet, is just an application that interfaces with Bitcoin by managing your keys associated with your bitcoin. So if you broadcast a transaction, the transfer time you're talking about, is actually the time it takes for the miners to include your transaction in a block included on the blockchain. The time it takes doesn't ...


1

Coins are spendable by a wallet as soon as the transaction is included in a mined block. Some online wallets use their own software to sync, or in other words, to make their application aware that the account has received coins. Applications that use this method could have varying durations for recognizing received coins. Furthermore, different wallet ...


1

In exchanges like Binance when a user wants to deposit coins in bitcoin or in other coins, per user receives a unique public key?Do they have to generate pair key private/public key for each user in each coin? I suppose they must be using a HD wallet for each users, but since one you send them your coins, everything happen in their back end they can do ...


1

Choose a wallet program/app from a reputable list such as https://bitcoin.org/en/choose-your-wallet Install that wallet program/app on a secure clean PC or phone (as appropriate) Get the wallet to give you a receive address (nowadays wallets issue a different address each time) Get your brokerage to transfer money to that address Get them to tell you the ...


1

There is no way to check the transaction separately for each signature. Either the entire transaction is valid or it is invalid. When you receive the partially signed transaction, you would need to sign it with your own private key using the signrawtransaction command in bitcoind. It would give you two outputs (1) hex which is the serialized transaction and (...


1

CSHA256 itself mimics OpenSSL's SHA256_CTX, and its constructor mimics the Init function. The Write method corresponds to the Update function. The Finalize method matches the Final function. In short: you construct a CSHA256 object, call Write any number of times to feed it bytes to hash, and then call Finalize to compute the resulting hash.


1

isn't solving for N^(-1), and hence N, becomes equivalent to finding the solution to the discrete logarithm? No, it is not. This does not require finding the discrete logarithm at all. Solving the discrete logarithm is finding the exponent to a known base. However in this problem we are trying to find the base and know what the exponent is. Furthermore, ...


1

The only way to determine the private key associated with a given public key is by a brute force method, spanning the entire 2^256 key space. More specifically, any number from 0x1 to 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364140 (order of G) is a valid private key. According to an article on wikipedia on brute force cryptography,...


Only top voted, non community-wiki answers of a minimum length are eligible