a warm welcome to filippova sorta and
ryan castellucci I like to start out by
thanking everyone for coming to our talk
i'm ryan castellucci I work for a
company called white ups but this is
just a side project at DEFCON 23 i gave
a talk called cracking cryptocurrency
brain wallets at and since then I've
co-authored a couple of papers about
Bitcoin cracking so high I'm people sort
of i work at cloud for about justice
about this is a completely side personal
project at the last hacking the boxing
kuala lumpur I spoke about using ecsa
mistakes to compromise Bitcoin private
keys now we all know that death is scary
and dangerous and you should ever if you
see someone doing math you should say
something right good but how do a how is
math exactly dangerous for Bitcoin
obviously to understand is we need to
understand a bit more about how Bitcoin
works now these are the fundamental
pieces of Bitcoin you start with a
private key which is nothing else then
random bytes and you convert that into a
public key using some crypto black magic
that I'm not gonna go into the details
of right now and then you hash that
public key to get an address
now that you have an address keep you
can use it to receive Bitcoin from other
people because people can use this
address to send bitcoins they owned
themselves to to you all these addresses
are published on the Bitcoin public
ledger which is called the blockchain so
every time our address received some
money some Bitcoin that that is locked
on this up and only blockchain and
anyone has a complete idea at any time
of all the dresses that hold any balance
now whether had
the private key that generated this
address can use this private key to
spend the Bitcoin it just received on
that address so far so good is probably
something you already knew about Bitcoin
and so obviously you can also imagine
that if what we want to do is to is
stealing Bitcoin without literally just
hacking into the server that stores them
or buying cod arrange a five-dollar
wrench to get them out of the person
that owns the bitcoins what we want to
do is to somehow compromised or guess or
figure out the private key and here
obviously the simplest thing that could
work is to just try them all especially
now you start with the private key
number one because the private key
number 0 is not body and you do the crip
the Blackmagic you get the public key
you hashed internet dress you go to the
blockchain and you check if that private
key holds any any balance and then you
do the same for to you do the same for
trade now I swear that this is not all
the talk is about we're not here to tell
you that you can just go over all the
private keys and steal everybody's
Bitcoin but stupid things sometimes
actually work as part of my defcon talk
i released a tool called brain flare
which was used for cracking brain
wallets but I've since modified it so
that it can also do this attack and
sometimes doing is get as we posted
doing a stupid thing really fast is a
decent attack so i did a scan we
actually did find some results know if
I'd say I was surprised but results i
went through about the first hundred and
fifty billion possible keys got a
hundred and forty nine hits this was
back in February one interesting thing I
noticed is that there were a lot of
patterns that looked kind of like people
were deliberately leaving Bitcoin around
playfully too
see who would take it and that's really
interesting because from some of that i
was able to infer that somebody has
actually tried guessing the first seven
hundred trillion keys and it looks like
it was over the course of less than a
year so i'm guessing they have something
faster than brain fire probably a big ol
botnet or a GPU cracker but the highest
possible private key is really really
big i don't know that we have a word for
this number but its large um so you know
sequentially searching keys got old and
what's the next thing that I can do that
is also dumb but slightly more creative
well patterns so this first one appears
to have been generated by taking the
string 1234 in ascii and using it as the
least significant bits of the private
key these are all real private keys that
were really associated with Bitcoin at
some point they're all long since empty
though so i tried putting strings in
that didn't really work
I tried keys that only had a few bits
set that got a few some stupid patterns
you know starting with 42 42 is a great
number
yeah patterns and so that got old too so
i had to get a little creative again to
find more things again these are all
real private keys that really were
associated with bitcoins at some point
so the format addresses you see are
actually what's used in the Bitcoin
protocol there's actually a raw format
so i took all of the raw format
addresses and tried the nice least
significant bits of private keys and I
got hits there too
I don't know why
um and then I tried the this is a little
out of scope of the talk but every block
in the blockchain has a specific hash I
tried running all of those through i got
hits there too then I just tried to
dumping the entire block chain each
offset one bite at a time through there
that got hits as well and I I don't even
know what those are
ok so this was all fun and laughs but
obviously just searching the entire
private key space sequential your by
shooting in the dark is not exactly
something we can keep doing so we need
something to limit the search space of
possible private keys and when you're
looking for is something that is very
useful to know about his brain wallets
now the idea of bringing all that is to
be able to control some money some
Bitcoin we just something that you can
keep your head and this may seem like a
good idea because nobody can read your
mind right but as we learned a fast
computer can probably get take a very
good guess at anything that you are able
to remember yourself
so how brain wallets work is that they
just add another step in the derivation
process we've seen before so to generate
the private key they just take some
memorable string-like correct horse
battery stable or whatever you're using
and hash it to get a private key that
then it's used to generate the public
key to join the address which they used
to receive money and then by just
remembering that string you can move
that money and use it to pay for
something else
sure that you're using passwords for to
save money is already kinda unsettling
but since we've learned so much about
pastor storage and how to make sure that
database dance are not cracked you'd
think
well obviously they used something and
slow something like bcrypt or s script
that is hard to put force right you'd be
wrong
they use sha-256 a perfectly cromulent
hash algorithm so for my defcon talk i
did a bunch of research into cracking
brain wallets and I went through the
transaction history of a lot of them
that I was able to find I correct worse
battery staple was in fact used its had
about 15 bitcoins go through it give her
take on and over four thousand
transactions there's a complicated
reason for that if you want to know why
find you later then bitcoin is awesome
had 500 Bitcoin put into it at once and
and then somebody else found it and
whoever put it there originally was sad
my favorite though is the empty string
nobody would ever guess that one ah that
has had almost 60 Bitcoin co through its
and fifty of it was all at once somebody
had a really bad day because it was
stolen instantly
the quick brown fox jumped over the lazy
dog has had about a hundred Bitcoin go
through it so yeah people to some things
um so of course i'm not the only one
who's had this idea there are plenty of
other people who have gone through with
quite extensive dictionaries and guests
brain wallets this fellow was active on
reddit and the Bitcoin forms for a while
he would crack the addresses sweep them
off for safekeeping
I have no idea how much he actually kept
but any time somebody would complain
about getting the brain wallet ripped
off if he if he had the key he'd show up
and offer to return it
some people were not so nice this other
fellow came on reddit to complain
because that's what people do on reddit
he lost four big coins out of his brain
wallet and the passphrase was
line from an obscure poem in Africa so
somebody had some pretty serious
dictionaries they were throwing at this
which is really interesting and if you
create what sort of performance can be
done with this rain fire itself in the
latest version the biggest job I've
running it was checking all six
character ascii passwords that ended up
being a search space of a little less
than 750 billion i did that in less than
24 hours for fifty dollars on amazon
cloud computing service so so to hammer
in the point of how dangerous it is to
essentially take a password amp that is
completely public because it's in dog
chain and putting money on it after not
even using a script we're gonna lose the
manual stage so what we're going to run
here is as simple script that now will
generate a brain wallet
we are short enough keys that's the the
brain wallet password and it will send
some management and if the demon gods
are with us
ok so this is the doctrine that info
page and this is this our transaction
that just deposited some money in this
very vulnerable the brain wallet it's
not currently spreading through the
network and with a little luck somebody
will be watching
obviously nobody can happen here we go
alright yeah yeah I'm sure this guy
loves us he's been stealing our test
wallets all day
no no
ok obviously nobody can compute all the
ascii five characters phrases in such a
short time
so what happened here probably is that
they have they have a huge huge database
of all the possible addresses and mapped
to the original private keys so that as
soon as they see a transaction
depositing my name such a such an
address they can immediately
it took 40 seconds or less steal the
money that was deposited in it said
enough
it used to be that even stronger
Rainwater's be stolen on the fly and
instead
right now we still have some money on a
sick character their brain wallet that
nobody has webbed which was kind of
disappointing
anyway this guy was not disappointed
because you can see that it has for
Bitcoin and that means just like since
november 2015 it that's currently worth
about three thousand dollars
ok so not the point
we shouldn't be using password to to
save to save money on them after they
get published
good so brain wallet org had this other
bottom that is inspired so much more
trust this random pattern of random
private key is definitely something that
nobody can figure out because they the
search space so vast right so what you
will do instead of making a brain wallet
with chorus horse battery stable is that
you click the random pattern and you
write down the private key me
yeah good now something that you should
be asking i guess is where does this
random value come from
well obviously the site owner is
responsible and it's probably coming
from the local browser from JavaScript
so you can check the code that generates
it and indeed it's this function called
crypto utr run by its which I'm sure is
absolutely fine
function that is not fuck act sorry
so there's no research to be done on
this but the weakest case i could find
was the firefox random number generator
arm at the time this site was popular it
would be seated with the number of
milliseconds since the UNIX epoch which
if you don't know is midnight january
first nineteen seventy explored with two
pointers and the way the two pointers
were chosen they were almost always very
close in value so you could just ignore
the pointers and figure it would be
about right if you just use milliseconds
on so if the seat is predictable
somebody can predict the seeds and
replay what would have been generated
and in fact this happened as we said
earlier people go to read it to come
complain about stuffed and this guy lost
a couple bitcoins and posted his address
hoping that somebody would be nice and
return them
unfortunately he was not in Lock there
so I took a look at the transaction
history on this address and looked at
the time it was initially funded and I
ran a scan and i was able to find the
time stamp which was very close to the
time the dress was originally funded
this is I think that date mid-2013 and
with the seed i was able to recover the
private key and verify that it matched
the address posted on reddit so good now
we know another way not to generate
private keys math.random okay note taken
now to graduate to the next kind of
attacks however we need to expand our
big nine Bitcoin knowledge bit we're
going to be talking now about
transaction
I've mentioned before that how many
money moves in bitcoin is that something
is published on the blockchain write a
transaction on the high level is just
this public statement that says so I
owned this money and please make this
money be owned by this order address now
instead and is a payment you sign this
statement with your private key which
proves that whoever owned that man
before on that address actually wants
that money to change hands and this is
recorded on blockchain so we have access
to this gigantic database of statements
with their signatures and public keys so
we can take any transaction and we'll
see the the public key that sent the
money the signature from the
corresponding public/private key and the
target addresses which are meant to be
the next owners okay so obviously the
idea here is that anyone can verify that
the public he actually hashes to address
that used to him that money and they can
use the public key and the signature to
verify that the statement is true and so
the entire network can go to terror
later to their balance and say okay this
address now has a different balance and
this is how many is at how Bitcoin
accounting works now obviously it's not
exactly as simple as as i put it and
it's much more flexible than that
because transactions are truly food
scripts that essentially pose a
challenge to someone that has to be
solved to need to be spent but usually
this challenge is just sign a statement
that says you want to move the man so
back to our high-level approach because
this is all we really need to start
cracking now next step is what exactly
is this signature right so this
signature is a ecdsa signature in
Bitcoin easy to say is the elliptic
curve detail signature algorithm
an algorithm that that does two jobs
with the private key and the message
makes a signature and with a signature
public key and the message says yes it's
true or no it's false
now I fair warning here
ecdsa is math so we are about to show
math on the slides if there's anyone
with serious sensibility to topic you
should leave the room now there is
matter head have been clearer
excellent so this is how icts a
signature looks like i want you now
let's break it down into pieces of it we
have G which is the global curve base
point this is always the same is a
property of the cure and all Bitcoin
transactions use the same then there's k
k is this random number that every time
anyone makes a transaction they have to
come up with
it's a long number its 256 bits and it's
supposed to be a beginning unpredictable
random a new every time you make a
transaction and then there's the which
is the private key the private key is
just the one we've seen the first slides
just interpreted as an under because
again easy to say is old math so all
string of bytes are just interpreted as
this very long asked number and used in
normal math and finally there's said
which is the hash of the message you're
trying to sign in bit going to message
is if you remember the center's that
says the script that says this money i
used to own
now please let it owned by this folder
address
ok so we have the pieces now the the the
signature is made of two parts one part
is called are and it's just that random
number x the cube base point that
generates a coordinate on the cure and
we take the x coordinate for as much as
you need to know it's simply an
operation that map's numbering to
another number so you go from k which is
this random
long number two are which is this order
very long number that could be as random
as far as you know but it all depends on
K because Jesus fixed okay and then you
have s which is the other house of this
of the signature which is just the
result of that formula that that's
literally big in math that the computer
does it takes the hash interpreted as a
number ads are times the which is a
private key and divide everything by k
now i'm not here to explain you why this
work because that is what you need a
cryptographer for but the important
thing to know is that as long as you
publish these two numbers anyone with
the public he can verify the signature
and that's exactly what bitcoin does
every time you make a transaction you
use your private key you generate a new
k number and you publish these two huge
numbers for everyone to know that you
actually want that transaction to happen
so far so good
this was a lot of math sorry
so now let's see what we can do a fan
with this let's see what happens if we
know k because we've said that he needs
to be is a commonly called announced but
this is kind of a misnomer in ecsa
because it's not enough to use the
number ones nones but it also must be
unpredictable and run them looking so if
you instead know k you can you can do
what you've learned in algebra and just
put does formula down as an equation and
solve for the private key look at this
formula here you have s which is this
the other half of the signature which
you have because it's published on the
blockchain you have our which is
published on the blockchain you have z
which is the half of the message which
is published on the blockchain and now
if you also have k you can recover the
private key
so you take this from the from the dog
chain you take these from hashing the
message and then if you have that last
piece
k announced then you know the privately
and you fall
sorry i I'm sorry here
so how would you know that you have our
and you're about to fall
well you know because you notice that
our is exactly K times G so if you have
a night poses about what up K that has
been used is you can derive our and look
for are on the blockchain and again the
stupid attack that can possibly work we
just searched sequentially on I i will
point out that this is actually
searching not for our for a particular
transaction but if but for our in any
transaction all at once so we let this
run overnight it's it only got three
hits and we only ran through the first
nine billion or so when i did that like
on thursday but now this is so this is
what again the stupidest attack now we
know that if we can figure out k we can
break use a signature to recover the
private key but again searching
literally the entire space won't work
because the nonce is just as long as the
private key so there's another attack
you can pull out the math doesn't stop
and sorry
now you can take 22 transactions that
you've noticed have the same are and if
they have the same are it means they
have the same k right and take the other
half which is the one that is different
and try to figure out okay so what are
the parts of this other half of this is
well there's the private key which might
be the same if it was two different
transactions sent from the same one
let from the same address the K we just
said that is equal because we've noticed
that our is the same in the two
transactions are the same so we just
group together all the parts that are
the same this house and if we just do s1
minus s2 what do you think is left all
the parts that are equal
cancel out so now we have this formula
s1 minus s2 so the second half of the
first signature and the second half of
the second signature their difference is
equal to that again group a lot of
algebra turns out high school has been
useful and finally we can derive a
formula that only uses things we know
because again hash of the first message
which is public on the blockchain hash
of the second message which is public on
the blockchain second half of the first
signature and second half of the second
server using this formula we get back
pain and again we've learned before that
if we recover k we can get the private
key so to wrap this up if you see two
transactions when ecsa that we use the
private key and announced at the same
time you will notice because you'll see
that are in the public hear the same and
you can use this formula to compute k
and then to compute the private key and
this resin is that the actual work you
just literally called them into math on
the laptop and you get numbers and those
are private keys i found that wonderful
now obviously I can't claim any merit
for coming up with this attack let's be
clear this is a well-known shortcomings
with ecsa and in at the CC i think it
was 2073 the it it was shown how to use
it to jailbreak the playstation 3 Sony
had used a static number for their csa
for their csa signatures relevant XKCD
obviously up and they were able to use
it to recover the private key and sign
new firmware updates but others have
used in different context for example in
the context of TLS the factor built on
that team has can be internet for
certificates that we're doing this
mistakes and got private keys and
published it into mining your P's and
Q's which is possibly my favorite type
of academic paper title now for a
complete analysis of this there's
there's more on on the slide deck of my
jack-in-the-box kuala lumpur
presentation for example there is a Sun
eyes of this happening on the blockchain
this is over time and the different
addresses and there are some pretty
high-profile events that involve this
for example here is a bitcoin forum past
complaining about using up to 55
bitcoins because of bed signatures
this is about blockchain dot info not
seeing the random number generator well
enough on some browsers and again using
money because if you have a bed random
number generator you risk we're using
the same cake Weiss and you end up with
losing your private key and finally
there was the very high-profile android
bag where a lot of applications where in
seeding the random number generator at
all and even if you generated your key
somewhere else and then imported it on
your phone and made two transactions
anyone would be able to recover you
privately from the blockchain here we
used to have a nice demo because there
used to be about that would do this on
the fly just like with the brain wallets
and it's gone it's not running anymore
and doing a demo where you depend on
some third party has this negative
outcomes but we didn't set up the sum
test bullets and these very addresses
have at least 20 bucks on them that if
you followed the talk well enough and
you're fast enough you can definitely
steel we're we're gonna sweep it when we
get off stage so if you can get it
before then it's yours
otherwise I'm gonna hide them
ok so you've been thinking well but
that's pretty dangerous and run the
opportunity is are usually not that good
so can't we do better answer is yes
there is a way to do it ecdsa
deterministically which means that
instead of picking a random k we think
about the three things that Cait needs
to be needs to be random looking so high
entropy he needs to be unpredictable and
he needs to be different for every
transaction so if we hash together the
message we are trying to sign and the
private key it's something that nobody
can figure out because it it's a hash of
the private key is something that is
always different for different messages
because the message will be different
and we can just use that as the k value
Stan now all these as we said only works
if you use k ND at the same time
everyone on the same page about this
attack you see two transactions in the
blockchain you notice they have the same
are in the same public key and you say i
can probably computer the private key
from that but if the private keys are
different this attack doesn't work out
of the box
however if you have a lot of people with
bad random number generators that are
prone to producing colliding results
odds are eventually two people will
independently produce the same bad
random number generator
this is another avenue for attack
we haven't seen this documented anywhere
we call it the ecdsa pivot attack so
earlier we mentioned with simple reuse
we see here that r is the same in these
two transactions therefore they must
have the same knots the public key is
also the same which means the private
key is the same so we are able to solve
here for the private key and the knots
for this specific our value so this guy
we used an address
oops well what happens if somebody else
makes a transaction with that same not
so we see that this has the same our
value therefore the same nonce but the
public key is different so the private
key is different so the equation we used
earlier wouldn't work but we already
know this knots and as we saw earlier if
you know the nonce you can simply solve
for the private key and then this fellow
does another transaction and since we
know the private key we can rewrite our
equations a little bit move things
around write it in terms of the private
key instead of in terms of the knots and
we can solve for the nonce here too so
now we know not for this new our value
and then somebody else wouldn't you know
it makes another transaction with that
our value which has never been reused
with the same public key but again since
we were able to compute that non spy
going back and forth between private
keys and nonces across multiple
transactions
we can solve their to we know that
nonsense we get that private key and
this is not terribly difficult to scan
for and so when that was run it turned
up 719 additional private keys that were
exposed as a second-order
vulnerabilities in this weakness and
close to a hundred thousand nonces and
some of the chains back and forth were
as much as seven hops long I'm another
interesting thing is that we saw that
blockchain dot info one of the sites
that had some problems with this looks
like they figured this attack out on
their own and tried to protect as many
of their customers funds as possible but
there was a bot that was attacking this
to for a while we also would have had
the demo here but that but is also shut
down up something we haven't waived
before is that a Bitcoin wallet
technically isn't usually not a single
address the hole open wallet is made up
of multiple addresses and so multiple
private keys so this attack can allow
the compromise of one of the addresses
to cause the compromise of order
addresses in the same bullet just
because they were used to share gnosis
across the different for private keys
right so another interesting thing that
we get out of this is that we see a lot
more plain text nonces and we can
analyze them and look at what might have
gone wrong the first interesting cluster
I found were these ones that had the
first half of the knots filled out
apparently at random and then the second
half was all zeros somebody put 16 bytes
where they should have put 32 I don't
know a real cryptographer also tell you
that such gnosis are probably normal
just by themselves because using
nonsense we just too strong patterns is
vulnerable to what I'm too
these lattices attacks but this is
definitely not something you can easily
scan for because you have to target the
specific transaction that you know had
this mistake right and we don't know of
any specific way to find such
transactions on the other one we saw is
very similar to the first one except for
there was something else at the end
instead of zeros again
somebody probably put the wrong number
of random bytes in our code and bad
things happened my favorite one though
was this one
this looks like it was uninitialized
memory in a on a intel machine at the
very end you can see it starts with you
can see what looks like a pointer at the
very end and so that's another inch
yeah that's interesting but what else
can we do the last one and very
interesting one is a related non stack
so we said earlier that if you reuse the
same nonce and the same private key
together into different transactions you
can recover everything but if you know
of a algebraic relationship between the
two nonces for example the nonces were
incremental e generated one was
generated random and then out of
laziness the next one was simply one
more because after all their different
numbers they're only used once that's
probably okay right so if you know the
difference between two nonces will call
this different see you can solve for one
of the nonces and then the other using
this terrible message an equation right
here and the derivation of this I'm
unfortunately going to have to leave as
an exercise to the audience
but you may be asking how can we know
that such a relationship exists
well the answer is of course more math
because this is stealing bitcoin with
math I'm so our second nonce is the
first non plus a constant R to R values
are simply those two nonces plus the
constant all x the base points and it
turns out that this relationship carries
through are so with with the first are
you can simply try adding one to it and
then see if that ever shows up
um I was somewhat so so we ran the scan
and I was actually quite surprised to
see that this didn't ever happen
we're confident that there are other
patterns that you can look for that you
can still scan for because nothing stops
you from having see being not one but
something else and for example maybe
some bit patterns and we're confident
that someone can run other scans you
were to find interesting ones because
here is really just a matter of
creativity because the elliptic curves
math to do of this is there and it's
it's essentially just the fact that
addition carries over to elliptic curves
where you can instead of adding one you
can add the point that corresponds to
one endpoint edition results in the same
result anyway this is faster
ok excellent then oh and yet the
American about faster is that is that we
even an optimization Ryan figured out to
scan faster for sequential sequential
points instead of for each point first
figure out at 12 care to the to the
private key and then multiply the
private key by G then you can instead
add always the same one
so the secret i kept from you here is
that that black magic of turning the
private key into a public key is nothing
else than that multiplying by the base
point so there's a lot of parallels
between knowns and our and private key
and public key so that's also why some a
lot of attacks or optimizations
carryover and even let us people between
them and in fact there were even
transactions where we found instances of
nonces and private keys being in in
various transactions the same value used
as both an ounce and a private so i just
said their semen are right
yeah very very similar in fact and we're
still experimenting with more nonsense
cracking techniques we're going to try
some weak random algorithms and see if
we find anything there and I suspect
well okay so this is it for math you can
take a breath
there are no other formulas for the rest
of the slides now i will actually just
mention a couple other attacks that can
happen that remotely that that don't
require hacking or you know wrenching
and the first one is kind of well known
in the Bitcoin industries it's double
spending the idea is that Bitcoin works
because all these transactions from
time-to-time bundled into a block and
that's not go over the reasons but it's
very hard then to reverse this operation
so they are etched in in stone forever
after enough blocks have been wrapped
around it if you trust the transaction
and you accept a payment and maybe you
ship an item or provide a service before
this setting stone block operation which
we call confirmation happens what the
attacker can do is show you a payment to
you and then send to be written into
stone a payment to himself and now what
happens is that the money actually it
never reaches you because the one that
is written down
for posterity is the one that says oh
yeah did this manna just went back so
this is what's called a double spending
attack attack is is called transaction
malleability that is that a transaction
which is rumored that r and s encoded in
some format can be messed with it can be
touched and changed without invalidating
it while still being a valid transaction
provides signature by the same private
key for the same message for the same
level so this is a problem per se and
it's actually expect out in the protocol
but if your accounting system relies on
transaction hashes to not do operations
twice now what i can do is send you a
transaction that says i have deposited
some money on my account on my mount cox
account for example they liked it a lot
of money this way
yes and then change it a bit so that
their hash changes but it's still the
same transaction and send it to you
again and you'll be in Mount Cox was
like oh look your transaction
what's the value than Bitcoin well now
this account has 10 more bitcoins and
you if you could keep it up and find
other ways to change it you could keep
changing the same transaction and
deposit the same time bitcoins over and
over and over again that there there
were two main ways to do it
bitcoins protocol has been changed to
enforce normalized representations which
as far as anybody can tell has fixed
this but anyway they're the two methods
that were available were changing the
sign bit on the s portion of the
signature that is going from a positive
value for s2 a negative one or a
negative 12 a positive one due to some
quirks about the way
ecdsa works both are valid the other
trick is due to the fact that these
signatures are encoded
in a scheme called asn dot one abstract
syntax notation
I don't know what the dot one stands for
anyway um if anybody here is familiar
with that you're probably cringing right
now because it's terrible the trick
there is it's a very flexible encoding
standard and you can do things like have
variable with number representations so
one method of track the other method of
transaction really malleability that was
used punch against mapbox in particular
was adding extra bytes of zero at the
beginning of the AR and/or s portion of
the signature and all these things that
start going wrong or in weird ways when
you start looking at bites as numbers
and try to apply next to them is really
one of my favorite things of
cryptography and let's be honest here
all these weird attacks is actually why
we love Bitcoin thank you
looks like even if everything else
happen we still have time for a few
questions
so mike i don't i don't believe that
everyone got everything else I've said
i'm not i'm not that good of a speaker
so get there and ask me what you didn't
get over i spent at least at least
twenty percent of the time we were
working on these slides having no idea
what was going on so don't feel bad
alright like a like a good question ah
like do you know like what uh curves you
know did they use you know in those like
oh I they use like development like
Edwards curve like on Bitcoin
specifically uses a curve called sec
p200 256k one which is defined in a
document called standards for efficient
photography from sir calm and if you
would like the details you can read them
in that document i might be terribly
wrong but I think the case there's four
couplets yet it does that is correct if
so it's easy to say over a couple its
curve but these these attacks would work
on any look any of the curve and what do
you see as the future of Bitcoin well
don't think honestly personally I'm
concerned with is the future of attacks
on Bitcoin so i'm i'm sure that would be
many mistakes they're coming but
honestly the more economic side and
changing the word side is about my pay
grade and definitely more drama and
geeks with opinions
did you guys look at any of the early
transactions before they changed the
script cash and were there any attacks
against those that were you guys have
ever looked at to be honest there there
weren't enough of pay to public key
transactions for it to be worth adding
person code for it but if you're
interested in that information you could
certainly add to the decode that's up on
github and do that search yourself just
to clarify
you say that G was the same for every
transaction
yeah and then how is it picked like what
is this ah up ellipticals black magic
the base point of the elliptic curve is
essentially this fixed parameter of the
curve which in this case is the 256 256
sec key so it's a unique piece of the
current so it does its use
yeah yes it is it is chosen by whoever
chooses the rest of the parameters of
the curve
hopefully in a totally trustworthy
manner like I'm sure it's fine
God abides by huh think I people won't
be using application-specific integrated
circuits to crack some of the brain
wallets out there what do you think's
behind uh so I actually have a blog
posts on why bitcoin mining asics are
completely useless for cracking
passwords and it is because bitcoin
mining a6 accelerates Bitcoin mining
they do not generically accelerate
hashing you could totally make Ann a
brain wallet cracking asic but I don't
know why you would
and considering the shuttle 56 yeah but
anyway sorry have you tried this many
altcoins or any of the newer yes
yeah in fact there is a website called
either camp where if you click new
address it makes a brain wallet for you
on a serious and it does not say it's a
brain well let's be and the guy who runs
this site so he and i don't agree on
this i will i will just say that
question and i have found brain wallets
on
litecoin-dogecoin and a couple of other
points out something interesting would
be to truck notices and private keys and
people came between us coins by the way
yes this is just a tip is if then you
can ask me for a Bitcoin address and you
if you find money that i won't ask where
they cut come from you can you know sent
me tapes because of this dip
anyway sorry yeah graduated last request
so all of these attacks are almost these
attacks seem too sorry arise from mostly
from client vulnerabilities you know
poorly coded none of them arise from the
protocol you think there are protocol
level changes we can make to make things
safer the bad programmers just going to
always put people with money at risk
he's right that all of these are
vulnerabilities on the client sites but
essentially definitely something that
could have been done was standardizing
easy to say only as deterministic but i
can think of any other specific ones
right now and I the the of mine that the
malleability liability form enforcement
ok we all decade the stage now
thank you to a matter
[Applause]