29

If you were a miner, what are the steps you would take to create the extra (21,000,012.5th) bitcoin? Where in the source code is this exactly (link)? There are two components to CVE-2018-17144. There is a crash bug and an inflation bug. Both are triggered by almost the same scenario: a transaction contains an input multiple times. In general, how this would ...


19

Worst case scenario: Bitcoin ECDSA algorithm would be broken. Because quantum computers can easily decrypt the private key using the public key, anyone with a quantum computer can extract Bitcoins using the corresponding public key. Bitcoin hashing would become exponentially difficult. There's already a predicted escalation in mining difficulty due to the ...


10

If you would like to see some proof to verify that it is truly quite impossible to generate a known keypair, you could test this yourself, if you wanted. Pavol Rusnak has created coinkit, a python library for interacting with Bitcoin related stuff. In there, there is an example on how to use it that does exactly what you are asking. What it does is it ...


9

Have a look at the early sources here: http://www.bitcointrading.com/forum/bitcoin-clients/original-bitcoin-source-code-archives/ there is a small piece of code in script.cpp: case OP_RETURN: { pc = pend; } break; which allows to spend ANY UTXO with just a very simple scriptSig OP_1 OP_RETURN


7

Only Copay is affected by this vulnerability. Although the package was included by many, many projects (both within and outside the crypto space), the attack payload was encrypted, and used the package description as a decryption key. They key in question was found to be (via brute force) A Secure Bitcoin Wallet, which is the npm description for the copay-...


6

In Bitcoin, inner nodes of the merkle tree are constructed by concatenating two 32 byte SHA256d hashes together. The resulting 64 byte value is hashed to get the next node in the tree. The leaf nodes are the transactions themselves. Merkle trees are used to prove that a transaction is part of a block as the merkle root is placed in the block header for the ...


6

I appreciate the enthusiasm of those who have answered this question. Everyone here clearly wants bitcoin to succeed, and so everyone is enthusiastic. I am enthusiastic, too. I am afraid, however, that this enthusiasm is coloring respondents' logic. Literally every response on this page (especially the highest ranked one) is wrong. In order for a ...


5

I believe Satoshi was once asked this question, and answered that it was just some curve that existed and was presumed to be efficiently implemented. I'll try to find a reference.


5

You could easy manipulate a pool to wreck havoc on other SHA256 coins if you owned it or managed to gain access. You don't even need to be a large pool, some altcoins are really small and vulnerable. It has affected other coins before, where a pool or a large miner created trouble solely by mining a smaller altcoin. Feathercoin hit by massive attack Only ...


4

The transactions will likely never be included in a block, as they do not meet the defacto bitcoin transactions rules for transactions sent without a fee, detailed here: A transaction may be safely sent without fees if these conditions are met: It is smaller than 1,000 bytes. All outputs are 0.01 BTC or larger. Its priority is large ...


4

There is the LBC (Large Bitcoin Collider) project that attempts to do that. According to their website they've created over 8,000 trillion keys, as of October 2017. According to a Motherboard article of April 2017, LBC found over 30 Bitcoin private keys.


4

It's entirely up to the people living at this hypothetical future point. There's no current rule about what happens. Maybe when this happens, people are tired of Bitcoin, so they go back to trading seashells. Or maybe when this happens, there's something better than Bitcoin available, so they all switch to that. Or maybe they just restart Bitcoin and ...


3

It doesn't matter if a mining pool has 100% of the total mining power so long as that mining pool can't choose which transactions its users work on, prevent them from submitting blocks that they find, or choose which blocks they build from. No change is needed to the Bitcoin protocol as far as I know. Only the protocol used between pools and their clients ...


3

If you prefer diagrams: http://i.imgur.com/ag3KQ0L.png (there are more addresses in the address space than there are zeptometres, 1/1 000 000 000 000 000 000 of a metre, in the universe's width). If you prefer maths: http://download.wpsoftware.net/bitcoin-birthday.pdf (by Andrew Poelstra) says (slightly edited): Using [birthday attack maths], we ...


3

Bitcoin funds are locked to a specific private key. In order to spend them in a transaction, the transaction needs to be signed with the private keys corresponding to each input. The signature commits to the exact content of the transaction. If another user changes the transaction, the signature is no longer valid. Other users cannot produce another ...


2

It seems as if there is such a pool now, advertising the behavior as a feature to allow "reverting mistaken payments": BitUndo They also supply a patch to bitcoind.


2

In many cases a government could effectively shutdown bitcoin in its country by making the following law: No licensed or regulated financial institution can exchange currency for bitcoin. Since taxes and fees for government services must be paid in currency, if I receive bitcoin for services, I would have to exchange the bitcoin for something else that ...


2

Understanding bitcoin price behavior with the Quantity theory of money M · V = P · Q Money supply times the Velocity of money equals the Price level times the Quantity of goods. Several arguments against the success of Bitcoin are doing the round: Bitcoin is a bubble, the present $1000+ price level bears no relation to the small bitcoin economy. People ...


2

Centralized checkpoints is a mechanism whereby nodes trust a certain hardcoded key to make new checkpoints. This means that in case of a fork, the key owner can make the network choose any branch he wants, even the one which is shorter. If this key is compromised, an attacker can use it to mount an equivalent to 51% attack with any hash rate. This, together ...


2

What are the advantages (and disadvantages) of using this over other specifications such as secp256r1? Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1. That isn't true today, and the fastest implementations of k1 are considerably faster than r1. Secp256k1's security critical parameters are ...


2

In fact they can. Somebody who could raise 20x of the entire network's computing power can rerun the transaction history from the beginning, throwing out any transactions they don't like. So long as the rest of the transactions are consistent, they should be able to gain the trunk blockchain line. This would make the entire blockchain we have been running up ...


2

With the current mining difficulty classical computers need to do 2*10^21 SHA256D invocations in average to find a block nonce. A quantum computer would need to do 4.5*10^10 invocations, which is billions times "faster". This means that the answer is: It would be able to doublespend as many times as the quantum adversary wants.


2

I want to point out a quick possibly important point. As other answers have mentioned current implementations of Bitcoin could be compromised by a quantum computer. However, Quantum Computers do not solve all known classically hard problems and so any cryptography that is based on problems that are also difficult for a Quantum Computer to solve should work ...


2

If the attacker has minority hashrate, I don't think this is much of a problem. If he excludes all transactions in his blocks but doesn't try to orphan other blocks, the worst thing that can happen is a x2 increase in the average time until first confirmation (no effect on subsequent confirmations). This is fairly minor. If the attacker has majority ...


2

If your PRNGs are good, you don't lose any security by using the same address any number of times. Some websites claim that addresses should not be reused because that will make your bitcoins vulnerable to quantum computers and/or some newly discovered weaknesses in ECDSA. However, both of these scenarios are unrealistic at the moment, and I think that if ...


2

They would have no value. As such this cannot happen. If less people have less bitcoins the value of btc goes down as the utility goes down, as such holders would likely dump the btc which makes them cheaper and would likely distribute them among others. It's more likely though that btc loses value because a better from of decentralized money will replace ...


2

after the fastest node has found a nonce for its false transaction block, will the other nodes verify only the hash value (which fulfills the requirements) or do they also verify the transactions in the block again? Every full node fully verifies every transaction in every block independently. This is even true for non-mining nodes. If a block contains an ...


1

What products are effected by these vulnerabilties? -- Not Sure specific products, but watch out for products(wallets) using javascript lib to generate private keys. As a user of these products, what should I do to make myself no longer vulnerable? -- you should immediately move your funds to new addresses, make sure new wallet does not suffer from this ...


1

I believe what the wiki is implying, is that the other user's transactions won't be double spent. Because the attacker does not have the other user's private keys, he can't spend his coins to a new transaction during the attack. He could prevent those transactions from going into blocks, but still has no access to the coins. That's what I think is meant ...


1

AFAIK there is nothing that can be done within the protocol to prevent 51% attacks. The best way to prevent such attacks from mining pools is to ditch that pool, and mine somewhere else. This happened earlier this year, when GHash.io almost reached 51% (source).


Only top voted, non community-wiki answers of a minimum length are eligible