3 ms·

Craig Wright is obviously a scam artist. That said, I'd love it if someone could explain the argument by the other cryptographer. At the beginning (I couldn't

Craig Wright is obviously a scam artist. That said, I'd love it if someone could explain the argument by the other cryptographer. At the beginning (I couldn't make it to the end of the recording, the exchange was just painful to listen to) he's saying if you have the source code to a RNG, you can derive private keys just by looking at encrypted messages? As an absolute statement that is obviously nonsense, but I feel there's some important context missing to parse the critique.

maxerickson 10y ago
I'm not sure I have it, but I believe that with DSA, given the message, signature and message specific private value, you can derive the private key. Wright is calling that message specific value a nonce, but for DSA, it has to be secret and unpredictable ( https://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/ https://rdist.root.org/2010/11/19/dsa-requirements-for-rando... ). In the Playstation hack, a single private value was mistakenly used in multiple messages (so it could be recovered from just a couple signatures https://www.imperialviolet.org/2013/06/15/suddendeathentropy.html https://www.imperialviolet.org/2013/06/15/suddendeathentropy... ), but it's also true that if you have information about how the private value was created and it was poorly done, you can just check all the remaining possibilities. So that's what the cryptographer is talking about, given information about sufficiently poor generation of the message specific secret, you can pull private keys out of a single signature.
- throwaway7767 10y ago
  But in the context of bitcoin, it seems likely that if the bitcoin client originally had such a problem, someone would have already exploited it to steal funds. All the old funds, mined with the original version of the bitcoin software, are still just waiting there at the original addresses. Especially in light of the creative crypto attacks people have done on other implementations (like the one where attackers stole from android wallets based on a flaw in the system-wide android PRNG). Money is a powerful motivator.

maxerickson 10y ago

I'm not sure I have it, but I believe that with DSA, given the message, signature and message specific private value, you can derive the private key. Wright is calling that message specific value a nonce, but for DSA, it has to be secret and unpredictable ( https://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/ https://rdist.root.org/2010/11/19/dsa-requirements-for-rando... ). In the Playstation hack, a single private value was mistakenly used in multiple messages (so it could be recovered from just a couple signatures https://www.imperialviolet.org/2013/06/15/suddendeathentropy.html https://www.imperialviolet.org/2013/06/15/suddendeathentropy... ), but it's also true that if you have information about how the private value was created and it was poorly done, you can just check all the remaining possibilities. So that's what the cryptographer is talking about, given information about sufficiently poor generation of the message specific secret, you can pull private keys out of a single signature.

throwaway7767 10y ago
But in the context of bitcoin, it seems likely that if the bitcoin client originally had such a problem, someone would have already exploited it to steal funds. All the old funds, mined with the original version of the bitcoin software, are still just waiting there at the original addresses. Especially in light of the creative crypto attacks people have done on other implementations (like the one where attackers stole from android wallets based on a flaw in the system-wide android PRNG). Money is a powerful motivator.