26

Because of the Birthday paradox, you only need 280 addresses (despite there existing 2160 different address combinations) before a collision becomes probable. Thankfully, that is still an enormous number. At 90 million addresses per 4 hours, it will take about 445 times the age of the universe to reach that number. It's also irrelevant. Even if anyone - or ...


16

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the source of these signatures. Copay is a multi-signature wallet which was initially released around that time. As I'm not a javascript developer it took me a bit of ...


8

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its corresponding public key is Q = qG. The nonce is n, its corresponding point is R = nG. The X coordinate of R is r. The hash function is h(x). A signature is (r,s)...


8

A very relevant answer can be found here: Is Each Bitcoin Address Unique? This is a question of the birthday attack on the hashes. Bitcoin addresses (assuming the "normal" style starting with a 1) encode 160 bit hashes, so the output space has a possible 2^160 hashes. Because its a hash function, we assume all outputs have equal probability of being output. ...


7

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that ...


7

Let's disect this function call: void sha256(struct sha256 *sha, const void *p, size_t size) First we realize that the return value is void which means the function does not return the sha256 of the data. However we see that the first argument struct sha256 *sha is a pointer to a sha256 struct with the name sha. This suggests that the pointer that we pass ...


4

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (ChaCha20 for the stream cipher, Poly1305 for MAC) that are designed with similar goals in mind: Easy to write a correct implementation in software Optimized for ...


4

This is valid, and there are even smaller types as well. Be aware that Bitcoin no longer really uses ASN.1 DER, but a even more restrictive subset of it. ASN.1 itself as it turns out is not deterministic or platform independent in many implementations, which is a source of consensus failure. For reference, here is how to encode signatures correctly in ...


4

It's easy to verify the order (n): Multiply G by n and find that you get the point at infinity. This proves that n is either the order or a multiple of it. Then convince yourself n is prime using a Baillie-PSW primality test, so it must be the order itself and not a multiple of it. Finding the order is not quite so simple as verifying it. To do so you ...


3

A Bitcoin mining ASIC: does not attempt to complete a single hash, rather fragments of two SHA256 compression rounds which is then compared to a target, the result is never returned can not accept arbitrary information that is not in the form of a partial SHA256 compression round So in terms of competitiveness, a CPU can actually complete a SHA256 hash, ...


3

The semantics of multiplication are different in your two equations. As for the first equation. The s-part of a signature is an element in a group (represented by a number) so the inverse exists and is easy to compute (or even well known) In the second case you take the numerical value of the private key and compute the multiple of this with a base point. ...


3

The security implication of removing a checksig operation from the encumbrance script is that the coins can be stolen while in flight by anybody, and especially by miners. Obviously, on testnet, only someone who's bored or interested enough to grab the coins will take the time to "attack" your transactions. There's not much sense in listing and analyzing ...


3

bpub appears to be the extended private key prefix for the Blockcypher testnet. Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key. The original xpub notation comes from BIP32, meaning extended public key. This expanded into ypub with BIP49, and finally zpub with BIP49+ (used in BIP84). Various coins can ...


3

Questions like this cannot be answered without specifying the digital signature scheme you're using. In general In general, a digital signature scheme consists of 3 algorithms: KeyGen() -> (PrivKey, PubKey): generates a private key and a corresponding public key. Sign(PrivKey,Message) -> Signature: signs a message with a given private key. Verify(PubKey,...


3

sha256.h has the exported (visible from outside) methods and functions. To compute SHA256, you should #include that. sha256_sse4.cpp sha256_sse41.cpp sha256_avx2.cpp sha256_shani.cpp contain SHA256 transform functions (used in SHA256.Write), each specialized for different processors with different instruction sets. Above is the list in order, most of the ...


2

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N. 1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of ...


2

No, and this will not happen in the foreseeable future. Any given hash calculation will result in any one of 2^256 possible numbers. That means, the odds of finding any one exact number is 1/2^256. Even at today's hashrate of ~47000000 TH/s, it would take you 7.812×10^49 years to find a preimage for every one of those 2^256 numbers, assuming each hash you ...


2

Yes, just set X=1, and Y=number of people.


2

It's possible, but: It's much slower Pubkey recovery for this kind of application is arguably patented For a "signature only" scriptpubkey, we already have p2pk. Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.


2

What are the advantages (and disadvantages) of using this over other specifications such as secp256r1? Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1. That isn't true today, and the fastest implementations of k1 are considerably faster than r1. Secp256k1's security critical parameters are ...


2

Details are in BIP 146: We require that the S value inside ECDSA signatures is at most the curve order divided by 2... ... A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S. Signatures encode two important values for verification r and S. If (r, S) is a ...


2

(Disclaimer: this is not my field.) Let g be the chosen generator and n its (prime) order. In the ECDSA algorithm, these are publicly known. It is true that g generates a cyclic (abelian) group isomorphic to Z/nZ. Now a private key consists of an integer k, and the corresponding public key is the group element h = kg. (I use additive notation since we ...


2

I think that the answer to your question is no, a transaction which makes every block it is included in invalid does not exist. An important core property of a cryptographic hash function is that there is no discernable relationship between the input data, and output data. If such a relationship existed, then miners could 'cheat' by only creating blocks (...


1

isn't solving for N^(-1), and hence N, becomes equivalent to finding the solution to the discrete logarithm? No, it is not. This does not require finding the discrete logarithm at all. Solving the discrete logarithm is finding the exponent to a known base. However in this problem we are trying to find the base and know what the exponent is. Furthermore, ...


1

The only way to determine the private key associated with a given public key is by a brute force method, spanning the entire 2^256 key space. More specifically, any number from 0x1 to 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364140 (order of G) is a valid private key. According to an article on wikipedia on brute force cryptography,...


1

...you've forgotten your private key/s. How do you prove that this is true You cannot prove that you have forgotten something. How would you prove you don't have a secret backup hidden away? Is there a transaction you can make, or a message you can sign? No, making transactions and signing messages are both actions that require the use of your private ...


1

The vulnerability affects the encryption of the wallet file, weakening the encryption by lowering the resources needed to brute force attack it. Practically, this means if an attacker were to get a copy of your wallet.dat file, they would have an easier time brute force attacking it (ie. guessing your password would become a little easier), compared to an ...


1

Currencies get value from demand and supply not from governments backing them. Currencies have existed long before government's started stamping them out in their own name. The demand for a currency comes from the utility that it offers as a medium of exchange. Even pre-historic humans went out of their way to create currencies because they were useful. ...


1

You need: 1) libsecp256k1 to calculate the public key from a private key 2) Hash the result with Sha2/256 + RipeMD160 3) Add version byte and 4-byte checksum 4) Encode it using Base58. My minimal code would work. So, it's not really simple


1

Your first three questions are questions about what you want to do. We have no way to know what you want to do. Your fourth question is technical: according to What is proof-of-stake? it was said that someone possessing 1% of the total stakes "mine" 1% of the total blocks, it gets confusing here, if example 1 block contains 100 transaction, so this 1% ...


Only top voted, non community-wiki answers of a minimum length are eligible