10
votes
Accepted
How much entropy is lost alphabetising your mnemonics?
TL;DR: you get around a factor 500 million attack speedup for 12 words, bringing it not quite in the realm of feasible attacks, but it's getting close. For 24 words, the speedup is around a factor ...
- 110k
6
votes
Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?
As with any open source project, if no one cares enough to implement it, it doesn't get implemented. Providing no auxiliary randomness is still safe as the deterministic nonce generation algorithm ...
- 72.2k
6
votes
How much entropy is lost alphabetising your mnemonics?
The number of possible 12 word phrases (disregarding the checksum) is 2048 ^ 12 = 5444517870735015415413993718908291383296
The number of alphabetically ordered 12 word phrases is
= ...
- 3,589
5
votes
Accepted
What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?
What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?
There is nothing special about the combination. It's just a combination of two constructions (...
- 110k
5
votes
Accepted
C secp256k1 : what is the purpose of secp256k1_context_randomize?
I just merged a PR by Rusty Russell that aims to explain its purpose. From the text that was added:
While secp256k1 code is written to be constant-time no matter what secret values are, it's ...
- 110k
5
votes
Accepted
Strange LockTime values in Electrum transactions?
The locktime value is deliberately set to discourage a subtle attack known as "Fee sniping" and randomly set to an earlier block height to improve privacy (eg for CoinJoin users that need more setup ...
- 1,419
3
votes
Known cases of miners withholding blocks when used as randomness?
You're probably better off going to some ethereum venue, as ethereum has been rife with broken schemes like this-- riggable "fair" lotteries and such.
- 7,727
3
votes
Accepted
How does the Bitcoin Core wallet generate entropy for the HD seed?
The Bitcoin Core wallet requires entropy both for generating HD seeds and for generating nonces (number used once) used in digital signatures (handled by the secp256k1 library).
raw_avocado discussed ...
- 15.8k
3
votes
How does randomness works in mnemonic phrase generation?
That depends on the specific wallet’s implementation. Typically wallets will mix multiple sources of entropy to generate a random seed (user input, system time, /dev/urandom etc). Also most operating ...
- 3,589
3
votes
How is the random number R for transaction signatures created?
The nonce k is supposed to be an unpredictable number in the range 1 to 115792089237316195423570985008687907852837564279074904382605163141518161494336, inclusive - one for each point on the curve ...
- 110k
3
votes
Accepted
Continuation question about nonce randomness and verification of the randomness by signing parties
In what way, if any, can all of the signing parties verify that the nonce is both random
By randomly generating the nonce yourself you know for a fact that nobody else knows the nonce.
Even better, ...
- 110k
2
votes
Accepted
When Satoshi Nakamoto mined his first set of blocks in 2008/2009, it was on Bitcoin Core, but was he using Linux or Windows?
Microsoft Windows.
In the Bitcoin v0.1 release announcement Satoshi Nakamoto stated
Windows only for now. Open source C++ code is included.
Unpack the files into a directory
Run BITCOIN.EXE
It ...
- 28.5k
2
votes
Distribution range for sending transactions to inbound and outbound connections
It's an exponential distribution. Transactions are relayed through the inv messages, and there are indeed delays to prevent topological analysis. The timing depends on whether it is an inbound and ...
- 41
2
votes
Accepted
How is the entropy created for generating the mnemonic on the Jade hardware wallet?
This was answered by Jamie Driver in the Jade repo.
Short answer:
See this web post
Long answer:
If you opt for new wallet on Jade (ie for Jade to create you a new wallet on-board the hw - always the ...
- 15.8k
2
votes
Accepted
Question about transaction verification relating to the ECDSA "nonce"
Are these nonce values public or private?
Yes and no.
For every signature, a new, secret, unpredictable, private nonce is generated. It is never revealed, just like the private key is never revealed. ...
- 110k
2
votes
Random Number In R Value , what is it actually, is it the same as Nonce in the blocks
The nonce in a signature is different from the nonce used in the block header. These are unrelated to each other. They only share a name because the term nonce is a generic word that means "a ...
- 72.2k
2
votes
Accepted
In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?
This question was answered by Tim Ruffing on Twitter.
The answer is simply that it's not easy to get truly random numbers
right in practice. For example, you need to collect entropy in your
system, ...
- 15.8k
1
vote
Is it secure to generate a new address using SBC such as raspberry pi? any problem with TRNG?
The TRNG in every modern rPi is indeed quality high entropy
/dev/hwrng "seeds" (feed extra entropy to) the /dev/urandom device
Take a look in the /var/log/syslog file
need rng-tools.service ...
- 423
1
vote
Calculation of Bitcoin private key using it's generation time
Private key is not related to time or operating system it is just created from random number which is called secret exponent there are lots of procedure to recover the private key but all are ...
1
vote
Calculation of Bitcoin private key using it's generation time
No, the time when the key was generated is entirely irrelevant. A private key is essentially a random number and with a robust source of randomness the time it takes to generate this random number is ...
- 15.8k
1
vote
Strange LockTime values in Electrum transactions?
Both Bitcoin Core and Electrum have very similar behavior when it comes to setting the locktime. As already stated in your answer, this is used to prevent fee sniping. However, besides setting the ...
- 433
1
vote
Need a random seed for vanitygen; where can I obtain one?
Do not use such a file from any (public) source!
Generate it yourself always, preferable off-line.
On linux:
dd if=/dev/urandom bs=1024 count=1 2> /dev/null 1> seed.bin
This file can be read by ...
- 121
1
vote
How does hyperledger fabric handle random number generation?
Hyperledger fabric works in the order of Execute Order and Validate.So Execution steps is done in Endorser so execution is done with endorsement policy which is defined and it also removes ...
- 102
1
vote
Accepted
Where does the entropy of BitcoinJS' makeRandom() come from?
This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as ...
- 10.2k
1
vote
How a stakeholder is chosen randomly in proof-of-stake?
There are various variables to consider.
Min Stake Age, Max Stake Age, Input Age, Input Size.
And then there is the version of PoS being use.
Min Stake Age determines an inputs eligibility, they ...
- 41
Only top scored, non community-wiki answers of a minimum length are eligible