4 ms·

> Wow, the signing of a transaction needs the whole transaction, not just a hash? You sign the hash; but you need the entire transaction to verify it does what

by runeks 4y ago

> Wow, the signing of a transaction needs the whole transaction, not just a hash? You sign the hash; but you need the entire transaction to verify it does what you want (send funds to the expected addresses).

olalonde 4y ago
Ah, you are right. The transaction data is just required to display what is to be signed in a human-readable format. This lets the user decide whether it wants to proceed with the signature or not. Otherwise, some malware could intercept transaction signature requests and replace them with arbitrary data (e.g. a transaction that empties the user's wallet). That's also why manually typing a hash in an air-gapped computer/device isn't going to work, you need the full transaction data.
JonathanBeuys 4y ago
Aha! That changes everything again! You can create the transaction hash on as many untrusted machines as you like. To make sure the hash represents the correct transaction. Then you can enter only the hash into the hardware wallet. That solves the problem of how to operate an air gapped hardware wallet! I think this also does away with the "wallet publishes your seed via nonces" problem? I would hope signing the transaction hash is deterministic?
- olalonde 4y ago
  When you type the signature on your computer, how do you know you are not unknowingly transmitting your seed? If your hardware wallet is malicious the "signature" it displays could be your seed instead of an actual signature. > I would hope signing the transaction hash is deterministic? Not really. A signer can generate an arbitrary number of valid signatures for the same message, using the same private key because the signature algorithm requires a secret random number. There are ways to generate the signature deterministically by deriving that secret random number from the private key but AFAIK, the only way to verify this was actually done requires knowing the private key in the first place. I believe you a malicious signer could iterate through valid signatures until the first n bits correspond to bits it wants to leak. That's actually an even bigger problem that I hadn't considered before. https://medium.com/@simonwarta/signature-determinism-for-blockchain-developers-dbd84865a93e https://medium.com/@simonwarta/signature-determinism-for-blo...
  - JonathanBeuys 4y ago
    You can check that the signature signs the transaction on an air gapped computer. That signing the transaction is not deterministic but involves a "random" number is indeed huge. Now we are back to square one. The hardware wallet can phone home. No way to use Bitcoin in a trustless way.
    - operator-name 4y ago
      This is not true, or at least a huge red flag for a client implimentation. Bitcoin the network cannot tell the difference, but by convention clients should use RFC 6979.
    - olalonde 4y ago
      In theory, you can compute the signature using a pen and paper. Or you can build a computer from first principles and then program it. In both cases, it would take a long, long time.

by runeks 4y ago

olalonde 4y ago

Ah, you are right. The transaction data is just required to display what is to be signed in a human-readable format. This lets the user decide whether it wants to proceed with the signature or not. Otherwise, some malware could intercept transaction signature requests and replace them with arbitrary data (e.g. a transaction that empties the user's wallet). That's also why manually typing a hash in an air-gapped computer/device isn't going to work, you need the full transaction data.

JonathanBeuys 4y ago

Aha! That changes everything again! You can create the transaction hash on as many untrusted machines as you like. To make sure the hash represents the correct transaction. Then you can enter only the hash into the hardware wallet. That solves the problem of how to operate an air gapped hardware wallet! I think this also does away with the "wallet publishes your seed via nonces" problem? I would hope signing the transaction hash is deterministic?

olalonde 4y ago
When you type the signature on your computer, how do you know you are not unknowingly transmitting your seed? If your hardware wallet is malicious the "signature" it displays could be your seed instead of an actual signature. > I would hope signing the transaction hash is deterministic? Not really. A signer can generate an arbitrary number of valid signatures for the same message, using the same private key because the signature algorithm requires a secret random number. There are ways to generate the signature deterministically by deriving that secret random number from the private key but AFAIK, the only way to verify this was actually done requires knowing the private key in the first place. I believe you a malicious signer could iterate through valid signatures until the first n bits correspond to bits it wants to leak. That's actually an even bigger problem that I hadn't considered before. https://medium.com/@simonwarta/signature-determinism-for-blockchain-developers-dbd84865a93e https://medium.com/@simonwarta/signature-determinism-for-blo...
- JonathanBeuys 4y ago
  You can check that the signature signs the transaction on an air gapped computer. That signing the transaction is not deterministic but involves a "random" number is indeed huge. Now we are back to square one. The hardware wallet can phone home. No way to use Bitcoin in a trustless way.
  - operator-name 4y ago
    This is not true, or at least a huge red flag for a client implimentation. Bitcoin the network cannot tell the difference, but by convention clients should use RFC 6979.
  - olalonde 4y ago
    In theory, you can compute the signature using a pen and paper. Or you can build a computer from first principles and then program it. In both cases, it would take a long, long time.