3 ms·

But this comes down to “trusting a compromised device is bad.” The device could steal your funds from the moment you send your first transaction (it could only

But this comes down to “trusting a compromised device is bad.” The device could steal your funds from the moment you send your first transaction (it could only generate a set of known private keys). Assuming the mode of key signing is not compromised and is producing robust uniform randomness (whether it’s a hardware wallet, airgapped device or your own hand-rolled code) it shouldn’t leak anything per transaction that would lead to your private key being more easily discoverable.

afiori 4y ago
The point of such an airgapped device is that you can validate its outputs to make sure that it is not using your private key to do shady stuff. OP's post is that since signatures are not deterministic you have no way to inspect device output and make sure that nothing subvert is going on. Obviously you should not trust compromised devices, but you cannot know if such a device is compromised.
- mattdesl 4y ago
  A “wallet” is just a series of math operations over standard cryptographic primitives. An airgapped device can be a calculator and pencil, or software that you have programmed and verified yourself in Python[1] or another language. At some point you need to trust that your tools and environment aren’t compromised; but this is a different argument than suggesting that the ‘k’ nonce in ECDSA is the only thing keeping Bitcoin from being able to be used trustlessly. [1] http://karpathy.github.io/2021/06/21/blockchain/ http://karpathy.github.io/2021/06/21/blockchain/
  - afiori 4y ago
    My point was different; you can compute a hash (or any other deterministic computation) trustlessly by having multiple independent parties compute it separately and then checking if the result is the same. You cannot necessarily do the same for nondeterministic computations in general. In this case you can easily verify that the signature is valid, but unless you control the rando parameters you cannot verify that a few bits of entropy have been exfiltrated by one or more parties in the computation. In the simplest case you could with statistical methods but not with slightly more sophisticated attacks.

afiori 4y ago

The point of such an airgapped device is that you can validate its outputs to make sure that it is not using your private key to do shady stuff. OP's post is that since signatures are not deterministic you have no way to inspect device output and make sure that nothing subvert is going on. Obviously you should not trust compromised devices, but you cannot know if such a device is compromised.

mattdesl 4y ago
A “wallet” is just a series of math operations over standard cryptographic primitives. An airgapped device can be a calculator and pencil, or software that you have programmed and verified yourself in Python[1] or another language. At some point you need to trust that your tools and environment aren’t compromised; but this is a different argument than suggesting that the ‘k’ nonce in ECDSA is the only thing keeping Bitcoin from being able to be used trustlessly. [1] http://karpathy.github.io/2021/06/21/blockchain/ http://karpathy.github.io/2021/06/21/blockchain/
- afiori 4y ago
  My point was different; you can compute a hash (or any other deterministic computation) trustlessly by having multiple independent parties compute it separately and then checking if the result is the same. You cannot necessarily do the same for nondeterministic computations in general. In this case you can easily verify that the signature is valid, but unless you control the rando parameters you cannot verify that a few bits of entropy have been exfiltrated by one or more parties in the computation. In the simplest case you could with statistical methods but not with slightly more sophisticated attacks.