3 ms·
This would not be up to specification, although non compliant bitcoin clients are functionally transparent (unless they reuse `k`, in which case your funds will
by operator-name 4y ago
This would not be up to specification, although non compliant bitcoin clients are functionally transparent (unless they reuse `k`, in which case your funds will be quickly drained):
https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch06.asciidoc#the-importance-of-randomness-in-signatures https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch06...
To avoid this vulnerability, the industry best practice is to not generate k with a random-number generator seeded with entropy, but instead to use a deterministic-random process seeded with the transaction data itself. This ensures that each transaction produces a different k. The industry-standard algorithm for deterministic initialization of k is defined in RFC 6979, published by the Internet Engineering Task Force.
> If you are implementing an algorithm to sign transactions in bitcoin, you must use RFC 6979 or a similarly deterministic-random algorithm to ensure you generate a different k for each transaction.
(https://datatracker.ietf.org/doc/html/rfc6979 https://datatracker.ietf.org/doc/html/rfc6979)
- mattdesl 4y agoThanks for the info! So it seems if k is chosen correctly there is no way it can leak data even after an improbably large number of transactions are posted. But there must still be some source of randomness for k besides just the message data? Otherwise signing the same message twice (like re-connecting to a web3 app via signed message, no transaction involved) would reveal your private key.
- CodesInChaos 4y agoYou need to include both the message and the private key in the hash. Since signing the same message twice with the same private key produces the same signature, it doesn't leak any additional information.
- mattdesl 4y agoGot it, makes sense. Thanks.