2 ms·

Aha! That changes everything again! You can create the transaction hash on as many untrusted machines as you like. To make sure the hash represents the correct

Aha! That changes everything again! You can create the transaction hash on as many untrusted machines as you like. To make sure the hash represents the correct transaction. Then you can enter only the hash into the hardware wallet. That solves the problem of how to operate an air gapped hardware wallet! I think this also does away with the "wallet publishes your seed via nonces" problem? I would hope signing the transaction hash is deterministic?

olalonde 4y ago
When you type the signature on your computer, how do you know you are not unknowingly transmitting your seed? If your hardware wallet is malicious the "signature" it displays could be your seed instead of an actual signature. > I would hope signing the transaction hash is deterministic? Not really. A signer can generate an arbitrary number of valid signatures for the same message, using the same private key because the signature algorithm requires a secret random number. There are ways to generate the signature deterministically by deriving that secret random number from the private key but AFAIK, the only way to verify this was actually done requires knowing the private key in the first place. I believe you a malicious signer could iterate through valid signatures until the first n bits correspond to bits it wants to leak. That's actually an even bigger problem that I hadn't considered before. https://medium.com/@simonwarta/signature-determinism-for-blockchain-developers-dbd84865a93e https://medium.com/@simonwarta/signature-determinism-for-blo...
- JonathanBeuys 4y ago
  You can check that the signature signs the transaction on an air gapped computer. That signing the transaction is not deterministic but involves a "random" number is indeed huge. Now we are back to square one. The hardware wallet can phone home. No way to use Bitcoin in a trustless way.
  - operator-name 4y ago
    This is not true, or at least a huge red flag for a client implimentation. Bitcoin the network cannot tell the difference, but by convention clients should use RFC 6979.
  - olalonde 4y ago
    In theory, you can compute the signature using a pen and paper. Or you can build a computer from first principles and then program it. In both cases, it would take a long, long time.

olalonde 4y ago

When you type the signature on your computer, how do you know you are not unknowingly transmitting your seed? If your hardware wallet is malicious the "signature" it displays could be your seed instead of an actual signature. > I would hope signing the transaction hash is deterministic? Not really. A signer can generate an arbitrary number of valid signatures for the same message, using the same private key because the signature algorithm requires a secret random number. There are ways to generate the signature deterministically by deriving that secret random number from the private key but AFAIK, the only way to verify this was actually done requires knowing the private key in the first place. I believe you a malicious signer could iterate through valid signatures until the first n bits correspond to bits it wants to leak. That's actually an even bigger problem that I hadn't considered before. https://medium.com/@simonwarta/signature-determinism-for-blockchain-developers-dbd84865a93e https://medium.com/@simonwarta/signature-determinism-for-blo...

JonathanBeuys 4y ago
You can check that the signature signs the transaction on an air gapped computer. That signing the transaction is not deterministic but involves a "random" number is indeed huge. Now we are back to square one. The hardware wallet can phone home. No way to use Bitcoin in a trustless way.
- operator-name 4y ago
  This is not true, or at least a huge red flag for a client implimentation. Bitcoin the network cannot tell the difference, but by convention clients should use RFC 6979.
- olalonde 4y ago
  In theory, you can compute the signature using a pen and paper. Or you can build a computer from first principles and then program it. In both cases, it would take a long, long time.