36

Disclaimer: I believe this question may be primarily opinion-based and not very appropriate for this site, but there are a number of technical misunderstandings that can be clarified along with it, so I'll give it a shot. There are many nuances involved here, and I fear that a large part of them didn't reach as much of an audience as the exchange announcing ...


12

There is no substitute in terms of security and trust for running a full node. There are different "lightweight client" concepts. Some of them are... BIP37 (bloom filter): [minus] With current used false-positive rates, peers may learn all wallet addresses [minus] Usually done over an unencrypted channel (p2p 8333), ISPs, etc. learn also all your ...


11

Recommendations for how or where to buy Bitcoin are generally off-topic here, but long-term storage is a fair question. First, understand what owning Bitcoin really boils down to: having knowledge of the private key that allows you to spend the Bitcoin stored at that key's address. You aren't storing the bitcoins themselves persay, you just need to store ...


11

From the (very recently updated) bip-schnorr draft: Implicit Y coordinates are not a reduction in security when expressed as the number of elliptic curve operations an attacker is expected to perform to compute the secret key. An attacker can normalize any given public key to a point whose Y coordinate is a quadratic residue by negating the point if ...


9

TCP and other stream based protocols do not have a 1-to-1 correlation of application level messages and IP packets. If you call send() 3 times, it might result in sending a single IP packet over the wire (eg, due to Nagle's algorithm which is enabled by default), it might get sent individually as 3 packets, as you would expect from a packet oriented protocol ...


9

(adding some color) Some discussion I saw suggested that people promoting this believed they only needed to achieve >50% hashpower, which caused them to overestimate the feasibility. Reorging with only slightly over 50% would take weeks-- even months, creating massive disruption if successful, and virtually guaranteeing an effective public initiative to ...


7

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that ...


6

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to prevent some specific attack or fix some specific bug. asymmetric cryptography is one of two fundamental foundation stones, one of the two primary building blocks ...


6

When you sign the transaction with your private key, you include the hash of the entire transaction data as a message. This means the signature which is generated is specific to that transaction itself and any modification to the transaction will render the signature invalid. In this case, the user who has signed the transaction has already specified the ...


5

Without asymetric cryptography, there wouldn't be information asymmetry: in other words, everyone knows exactly as much as everyone else. If everyone knows equally much, there is no way to distinguish a legitimate sender from a malicious one. More specifically, if a symmetric construction like an HMAC was used to authenticate a transaction, miners would ...


5

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger algorithm twice. However, in practice such constant factors are ignored when describing security levels. For example, typically ed25519 and secp256k1 are placed in ...


5

It depends on what you're actually asking. Bitcoin doesn't exist within the normal model of BFT consensus so in one sense the answer is mu. Under conventional assumptions Bitcoin will converge on a stable history if honest participants have a majority hashpower. But the arguments given as to why you could expect this hashpower majority assumption to hold ...


5

There are significantly more than 10k full nodes on the network. The 10k figure is simply the number of reachable nodes which listen publicly for new connections. There are many more times that amount which do not have open ports. Luke-jr publishes information about nodes his own knows about[1], suggesting there are in the order of 100k nodes. It only takes ...


5

We're deep in speculative territory here but, theoretically, if the elliptic curve algorithm were broken the entire Bitcoin system would immediately collapse. Let's consider the case where you've successfully guarded your own funds somehow. How many public keys would still be out there vulnerable to such an attack? Even though your "base" survived the ...


5

Addresses are textually encoded public key hashes, which means that somebody in possession of only the address cannot read the public key - but eventually the public key must be revealed in order to spend the funds which are locked by an address - so it may become a privacy concern if addresses are reused, which is discouraged anyway. With a HD wallet, we ...


4

I want to add a little bit to the coordination problem that @PiererWuille mentioned. Not only does the probabilistic success of a rollback depend on the ability of miners and affected parties to coordinate, it also requires that individual miners must trust one another to participate in the rollback. Consider this: If I had a significant portion of the ...


4

I think that's an incorrect impression. The code involved in CVE-2018-17144 was relatively recent (the UTXO handling logic was written in 0.8 (released feb 2013), and underwent a few small changes after, and a large improvement in 0.15). If by "original code" you refer to the code written by Satoshi, this issue is unrelated, as fairly little of that code is ...


4

The other miners will not be aware that this malicious miner has find the correct hash(win) since he has not propagate it, so they will still try to find the correct hash and some second later one of them will find it correct and propagate it, then cycle will repeat again without anyone knowing that this malicious miner has win second before the one that has ...


4

The main difference is that Bitcoin in lightning network channels are in 2of2 multisig wallets. You own a key and your channel peer owns the second key. Your funds are "safe" because you have pre-signed transactions that spend from that multisig wallet (similar to an offline signing of a transaction). As soon as you keep those pre-signed transactions, your ...


3

(This answer is a selection of quotes from an email I got from David Harding where he replied to my email reply to the newsletter. In the answer below, the quoted text is from my email question and the non-quoted text is from David Harding's reply) I think it is indeed a collision attack. The attack you describe is based on a database of preimages and ...


3

There a are a few things to take into account when we consider the probabilities of a rollback attack (a posteriori reorg destroying net value) to be successful: If the reorg is shallower than 100 blocks (COINBASE_MATURITY), the attacker can minimize the amount of direct victims. But if we are talking about a deeper one, not only the payments he wants to ...


3

Assuming you aren't too concerned about someone tracking the total amount of bitcoin you own, a paper wallet (potentially encrypted via BIP38) would be the safest bet. You only need to generate the key once and derived the address from it. The key can then be stored somewhere very safe (there are a number of vault services, operated by banks and other ...


3

This is unsafe and definitely a scam. One common way it's done is as follows. Using your login and password, the guy will secretly retrieve the recovery phrase for the wallet. He will then let you change the password. Then, he will make up some story to convince you to acquire some Bitcoins and put them in the wallet (or maybe he'll just wait until you ...


3

It appears to largely be just a belt-and-suspenders check. As you say, it is unnecessary to do this check. However it doesn't hurt to have this check in there. At worst, it just adds a few nanoseconds to verification time. At best, it will catch some serious bugs. Given that this is consensus related, it does not hurt to have extra checks that are ...


3

This article expands on the security proof a bit more (with visual aids!) https://medium.com/blockstream/reducing-bitcoin-transaction-sizes-with-x-only-pubkeys-f86476af05d7


3

There are a few reasons why a user can lose funds in the lightning network. But to understand why that happens let us look at some of the basic constructs of Lightning Network. Lightning Basics When two parties open a channel in Lightning Network what they essentially do is send some bitcoins to a 2-of-2 multi-sig that they both control (in current specs ...


3

Quantum computing isn't simply faster. It is entirely different. Some computations are massively faster on a quantum computer, and other are not faster at all. What has been demonstrated is meaningless: the "program" that was executed was in fact a randomly generated one, designed to be specifically hard on traditional computers, but easy on that specific ...


3

You don't need to grant someone access to the entire machine to be able to use bitcoin-cli. You can provision credentials using the rpcauth parameter in bitcoin.conf (it may be defined multiple times for multiple username/password combinations), and whitelist their IP address for the port you are running the bitcoin RPC on. They can then use a local bitcoin-...


3

Bitcoin mining involves setting up and running highly specialized computer machinery called ASICs (application specific integrated circuits). If you are being told you will be 'mining', but are not setting up and running these machines yourself, then chances are you are being scammed. Pretty much every instance of 'cloud mining' through some website service ...


3

Bitcoin aren't stored on a machine, but they are held in a distributed public ledger known as the blockchain. The blockchain is a database which is replicated over the machines of everybody who participates by running the bitcoin software. This means that the database you hold locally on your machine is just a copy of the one which the network as a whole ...


Only top voted, non community-wiki answers of a minimum length are eligible