4 ms·

another dangerous toy I particularly enjoy, vanity keys: https://github.com/warner/wireguard-vanity-address https://github.com/warner/wireguard-vanity-address

another dangerous toy I particularly enjoy, vanity keys: https://github.com/warner/wireguard-vanity-address https://github.com/warner/wireguard-vanity-address Although not as dangerous since the entropy of the rng is (mostly?) still there. If I'm doing the handwaving right, it's base64 where each char contains 6 bits, so you reduce the effective keysize to 256-6*$num_chars -- cryptographers tell me how wrong I am :)

ghkbrew 5y ago
I'm having a hard time seeing much danger in that. If your threat model assumes the attacker already has your public key having an easily guessable public key doesnt give them any more information. My biggest worry would be some sort of spoofing. An attacker may be able to impersonate you (or rather a server you control) if they generate a similar vanity key and convince a 3rd party to accept it as yours.
- matthewaveryusa 5y ago
  Ah you're right, there is seemingly no loss of entropy.
daneel_w 5y ago
I may be wrong, but similar to BTC et al. vanity keys I don't think there is any actual loss of entropy.
- madars 5y ago
  There is: rejection sampling means that you don't ruin uniformity but your key space necessarily shrinks. As a thought experiment, imagine if you fixed all but the last hex digit of the public key to be your favorite string -- there are at most 16 private keys that could achieve that. We don't have fast ways to generate vanity addresses (just brute force with exponential complexity in the length of the fixed bits) so in practice entropy loss is minimal and cryptographically non-concerning.
  - daneel_w 5y ago
    Which is the crux of it all - there's no way to optimize the search of the key space to generate only keys that already have a set prefix. Rejection sampling can target anything, no matter if someone (or some dictionary) applies a meaning to the specified sequence. As another thought experiment, imagine using a true random source to generate a BTC priv key whose base58-represented P2PK address happened to spell out "1money". Would it be less entropic than if it were on purpose searched for and found using e.g. VanityGen? Or less entropic than some random characters like "1trwm"? Certainly not. By a total coincidence the word "trwm" is Welsh for "heavy".
remcob 5y ago
> so you reduce the effective keysize to 256-6*$num_chars Correct: you reduce the search-space of the private key, but you simultaneously increase the cost of brute-forcing by the same amount because finding keys to try in the smaller search-space takes more work (the same work as generating vanity addresses). As long as brute-forcing is the most efficient way to crack the attacker has to do the same expected amount of work on vanity addresses.

ghkbrew 5y ago

I'm having a hard time seeing much danger in that. If your threat model assumes the attacker already has your public key having an easily guessable public key doesnt give them any more information. My biggest worry would be some sort of spoofing. An attacker may be able to impersonate you (or rather a server you control) if they generate a similar vanity key and convince a 3rd party to accept it as yours.

matthewaveryusa 5y ago
Ah you're right, there is seemingly no loss of entropy.

daneel_w 5y ago

I may be wrong, but similar to BTC et al. vanity keys I don't think there is any actual loss of entropy.

madars 5y ago
There is: rejection sampling means that you don't ruin uniformity but your key space necessarily shrinks. As a thought experiment, imagine if you fixed all but the last hex digit of the public key to be your favorite string -- there are at most 16 private keys that could achieve that. We don't have fast ways to generate vanity addresses (just brute force with exponential complexity in the length of the fixed bits) so in practice entropy loss is minimal and cryptographically non-concerning.
- daneel_w 5y ago
  Which is the crux of it all - there's no way to optimize the search of the key space to generate only keys that already have a set prefix. Rejection sampling can target anything, no matter if someone (or some dictionary) applies a meaning to the specified sequence. As another thought experiment, imagine using a true random source to generate a BTC priv key whose base58-represented P2PK address happened to spell out "1money". Would it be less entropic than if it were on purpose searched for and found using e.g. VanityGen? Or less entropic than some random characters like "1trwm"? Certainly not. By a total coincidence the word "trwm" is Welsh for "heavy".

remcob 5y ago

> so you reduce the effective keysize to 256-6*$num_chars Correct: you reduce the search-space of the private key, but you simultaneously increase the cost of brute-forcing by the same amount because finding keys to try in the smaller search-space takes more work (the same work as generating vanity addresses). As long as brute-forcing is the most efficient way to crack the attacker has to do the same expected amount of work on vanity addresses.