Skip to main content
10 votes
Accepted

How much entropy is lost alphabetising your mnemonics?

TL;DR: you get around a factor 500 million attack speedup for 12 words, bringing it not quite in the realm of feasible attacks, but it's getting close. For 24 words, the speedup is around a factor ...
Pieter Wuille's user avatar
6 votes

How much entropy is lost alphabetising your mnemonics?

The number of possible 12 word phrases (disregarding the checksum) is 2048 ^ 12 = 5444517870735015415413993718908291383296 The number of alphabetically ordered 12 word phrases is = ...
Mike D's user avatar
  • 3,569
5 votes

Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?

As with any open source project, if no one cares enough to implement it, it doesn't get implemented. Providing no auxiliary randomness is still safe as the deterministic nonce generation algorithm ...
Ava Chow's user avatar
  • 71k
5 votes
Accepted

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (...
Pieter Wuille's user avatar
5 votes
Accepted

C secp256k1 : what is the purpose of secp256k1_context_randomize?

I just merged a PR by Rusty Russell that aims to explain its purpose. From the text that was added: While secp256k1 code is written to be constant-time no matter what secret values are, it's ...
Pieter Wuille's user avatar
5 votes
Accepted

Strange LockTime values in Electrum transactions?

The locktime value is deliberately set to discourage a subtle attack known as "Fee sniping" and randomly set to an earlier block height to improve privacy (eg for CoinJoin users that need more setup ...
Jonathan Cross's user avatar
3 votes
Accepted

How does the Bitcoin Core wallet generate entropy for the HD seed?

The Bitcoin Core wallet requires entropy both for generating HD seeds and for generating nonces (number used once) used in digital signatures (handled by the secp256k1 library). raw_avocado discussed ...
Michael Folkson's user avatar
3 votes

How does randomness works in mnemonic phrase generation?

That depends on the specific wallet’s implementation. Typically wallets will mix multiple sources of entropy to generate a random seed (user input, system time, /dev/urandom etc). Also most operating ...
Mike D's user avatar
  • 3,569
3 votes

How is the random number R for transaction signatures created?

The nonce k is supposed to be an unpredictable number in the range 1 to 115792089237316195423570985008687907852837564279074904382605163141518161494336, inclusive - one for each point on the curve ...
Pieter Wuille's user avatar
3 votes

Known cases of miners withholding blocks when used as randomness?

You're probably better off going to some ethereum venue, as ethereum has been rife with broken schemes like this-- riggable "fair" lotteries and such.
G. Maxwell's user avatar
  • 7,727
3 votes
Accepted

Continuation question about nonce randomness and verification of the randomness by signing parties

In what way, if any, can all of the signing parties verify that the nonce is both random By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce. Even better, ...
Pieter Wuille's user avatar
2 votes

Distribution range for sending transactions to inbound and outbound connections

It's an exponential distribution. Transactions are relayed through the inv messages, and there are indeed delays to prevent topological analysis. The timing depends on whether it is an inbound and ...
Thomas's user avatar
  • 41
2 votes
Accepted

How is the entropy created for generating the mnemonic on the Jade hardware wallet?

This was answered by Jamie Driver in the Jade repo. Short answer: See this web post Long answer: If you opt for new wallet on Jade (ie for Jade to create you a new wallet on-board the hw - always the ...
Michael Folkson's user avatar
2 votes
Accepted

Question about transaction verification relating to the ECDSA "nonce"

Are these nonce values public or private? Yes and no. For every signature, a new, secret, unpredictable, private nonce is generated. It is never revealed, just like the private key is never revealed. ...
Pieter Wuille's user avatar
2 votes

The randomness of vanitygen is secure enough?

If two people running vanitygen 1abcdefg What is the chance that both of the person will get the same public key & private key? If a billion supercomputers each tried a billion keys per second ...
David Schwartz's user avatar
2 votes

Random Number In R Value , what is it actually, is it the same as Nonce in the blocks

The nonce in a signature is different from the nonce used in the block header. These are unrelated to each other. They only share a name because the term nonce is a generic word that means "a ...
Ava Chow's user avatar
  • 71k
2 votes
Accepted

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

This question was answered by Tim Ruffing on Twitter. The answer is simply that it's not easy to get truly random numbers right in practice. For example, you need to collect entropy in your system, ...
Michael Folkson's user avatar
1 vote

Is it secure to generate a new address using SBC such as raspberry pi? any problem with TRNG?

The TRNG in every modern rPi is indeed quality high entropy /dev/hwrng "seeds" (feed extra entropy to) the /dev/urandom device Take a look in the /var/log/syslog file need rng-tools.service ...
HansBKK's user avatar
  • 423
1 vote

Calculation of Bitcoin private key using it's generation time

Private key is not related to time or operating system it is just created from random number which is called secret exponent there are lots of procedure to recover the private key but all are ...
Muhammad Adnan Alam's user avatar
1 vote

Calculation of Bitcoin private key using it's generation time

No, the time when the key was generated is entirely irrelevant. A private key is essentially a random number and with a robust source of randomness the time it takes to generate this random number is ...
Michael Folkson's user avatar
1 vote

Strange LockTime values in Electrum transactions?

Both Bitcoin Core and Electrum have very similar behavior when it comes to setting the locktime. As already stated in your answer, this is used to prevent fee sniping. However, besides setting the ...
TheCharlatan's user avatar
1 vote

Need a random seed for vanitygen; where can I obtain one?

Do not use such a file from any (public) source! Generate it yourself always, preferable off-line. On linux: dd if=/dev/urandom bs=1024 count=1 2> /dev/null 1> seed.bin This file can be read by ...
Ytsen de Boer's user avatar
1 vote

How does hyperledger fabric handle random number generation?

Hyperledger fabric works in the order of Execute Order and Validate.So Execution steps is done in Endorser so execution is done with endorsement policy which is defined and it also removes ...
VforVendetta's user avatar
1 vote
Accepted

Where does the entropy of BitcoinJS' makeRandom() come from?

This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as ...
MCCCS's user avatar
  • 10.2k
1 vote

How a stakeholder is chosen randomly in proof-of-stake?

There are various variables to consider. Min Stake Age, Max Stake Age, Input Age, Input Size. And then there is the version of PoS being use. Min Stake Age determines an inputs eligibility, they ...
watermelon's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible