6 ms·

Reading this makes me wonder how probable/improbable it is that this kind of thing has happened / will happen with the seed generation function in one of the po

Reading this makes me wonder how probable/improbable it is that this kind of thing has happened / will happen with the seed generation function in one of the popular Bitcoin hardware wallets. And what the fallout would be.

trashburger 3y ago
Feels like that would be noticed rather quickly given that you would be able to access someone else's funds on the network automatically, whereas in the SSH vulnerability case you have to proactively check if servers you want to access have one of the bad fingerprints.
xiphias2 3y ago
https://news.ycombinator.com/item?id=6195493 https://news.ycombinator.com/item?id=6195493
- baobun 3y ago
  also https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool/ https://blog.1inch.io/a-vulnerability-disclosed-in-profanity...
- ArtTimeInvestor 3y ago
  In 2013, Bitcoin's market cap was less than a Billion, I think. And those Android wallets probably only held small amounts. But now that pension funds get into Bitcoin, one has to wonder what would happen if a giant like Coinbase turns out to be holding their funds in cold storage but with guessable keys.
  - 3abiton 3y ago
    It's crazy to to from a hobbyist niche commodity to a nearly gold reserve alternative.
  - xiphias2 3y ago
    Even if those ,,small amounts'' were 5% of net worth of some people (which was not uncommon), the same small amount would consist of more than 99% of the net worth of the same people currently. As Android wallets were the easiest to use wallets and exchanges routinely robbed people, it mattered a lot even back then. While Coinbase has a quite good protocol for securing keys, what's scary to me is that so many ETFs are trusting it to be the only key holder instead of using multi-signature wallets between multiple entities (like Fidelity and Unchained capital as the other 2).
    - ArtTimeInvestor 3y ago
      Is it documented, how the individual ETFs are holding their assets? I know they state that they do it via a custodian and name it like "Coinbase", but is that really all? All they got is an IOU from Coinbase? Maybe they have more specific setups?
- pcthrowaway 3y ago
  Interesting to see Vitalik pop up in that thread
pants2 3y ago
The $160M Wintermute hack was a result of insecure key generation in a public library, though it's unlikely that one was introduced intentionally.
macrolime 3y ago
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards https://www.unciphered.com/blog/randstorm-you-cant-patch-a-h... Over the last 22 months, Unciphered has been working on a vulnerability which affected BitcoinJS, a popular package for the browser based generation of cryptocurrency wallets, as well as products and projects built from this software. Over a period of years, this vulnerability caused the generation of a significant number of vulnerable cryptocurrency wallets.
withinboredom 3y ago
Considering that each key can be generated deterministically from a seed key and the seed keys are not infinite… it’s only a matter of time (millions of years compute time with current technology, and not out of reach for state actors who can spend infinite money to run that much compute in a matter of weeks) until every wallet is accessible by anyone who knows the address. Bitcoin isn’t that safe to hold value in, if you might be targeted by someone with brains and money.
- posnet 3y ago
  Just for fun, because it's hard to appreciate how strong a 256bit ECDSA key is. Base Numbers: - 2*128 guesses on average - public state of the art for ECDSA on an FPGA is 1315tps [0] - retail price of said fpga $10,000 [1] - total net income for xilinx from advanced FPGAs FY2022 (936M * 0.74 + 879M * 0.72) = 1325M [2] Ballpark numbers, we'll assume that attacker can buy 10x every FPGA xilinx made in 2022 for a 50% discount and can run them non stop for zero cost. We'll also assume they have a bunch of secret math geniuses and have a faster ECDSA implementation that can do 1,000,000,000 tps ( or 1,000,000x SOTA) - (1325,000,000 / 5,000) * 10 = 2,650,000 FPGAs - 2,650,000 * 100,000,000,000 = 2,650,000,000,000,000tps - 2*128 / 2,650,000,000,000,000 = 1.28e+23s - 1.28e+24 / 60 / 60 / 24 / 365 = 4,080,000,000,000,000 years - ~4 quadrillion years - or 4x the time until every planet has been ejected from every star system and the sun has cooled to 5K [3] But why stop there, lets assume that the attacker can use the entire planets GDP to buy chips and has a 1,000,000,000,000,000x faster ECDSA implementation. - World GDP (2022): 101.3 trillion - (101,300,000,000,000 / 5000) = 20,260,000,000 - 100,000,000,000,000,000 * 20,260,000,000 = 2.66419e+28tps - 2*128 / 2.66419e+28 = 12,772,451,173s - 12,772,451,173 / 60 / 60 / 24 / 365 = 405 years So even then, we wouldn't see a single BTC key broken within our lifetime. (Unless you believe that 3 letter agencies have successfully built a quantum computer that practically implement shore's algorithm, in which case you should probably be more worried about the fact that they can break public key encryption globally) [0]: https://arxiv.org/pdf/2112.02229.pdf https://arxiv.org/pdf/2112.02229.pdf [1]: https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=3664&idcategory=6 https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=... [2]: https://web.archive.org/web/20211203065624/https://investor.xilinx.com/node/18856/pdf https://web.archive.org/web/20211203065624/https://investor.... [3]: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future

trashburger 3y ago

Feels like that would be noticed rather quickly given that you would be able to access someone else's funds on the network automatically, whereas in the SSH vulnerability case you have to proactively check if servers you want to access have one of the bad fingerprints.

xiphias2 3y ago

https://news.ycombinator.com/item?id=6195493 https://news.ycombinator.com/item?id=6195493

baobun 3y ago
also https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool/ https://blog.1inch.io/a-vulnerability-disclosed-in-profanity...
ArtTimeInvestor 3y ago
In 2013, Bitcoin's market cap was less than a Billion, I think. And those Android wallets probably only held small amounts. But now that pension funds get into Bitcoin, one has to wonder what would happen if a giant like Coinbase turns out to be holding their funds in cold storage but with guessable keys.
- 3abiton 3y ago
  It's crazy to to from a hobbyist niche commodity to a nearly gold reserve alternative.
- xiphias2 3y ago
  Even if those ,,small amounts'' were 5% of net worth of some people (which was not uncommon), the same small amount would consist of more than 99% of the net worth of the same people currently. As Android wallets were the easiest to use wallets and exchanges routinely robbed people, it mattered a lot even back then. While Coinbase has a quite good protocol for securing keys, what's scary to me is that so many ETFs are trusting it to be the only key holder instead of using multi-signature wallets between multiple entities (like Fidelity and Unchained capital as the other 2).
  - ArtTimeInvestor 3y ago
    Is it documented, how the individual ETFs are holding their assets? I know they state that they do it via a custodian and name it like "Coinbase", but is that really all? All they got is an IOU from Coinbase? Maybe they have more specific setups?
pcthrowaway 3y ago
Interesting to see Vitalik pop up in that thread

pants2 3y ago

The $160M Wintermute hack was a result of insecure key generation in a public library, though it's unlikely that one was introduced intentionally.

macrolime 3y ago

https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards https://www.unciphered.com/blog/randstorm-you-cant-patch-a-h... Over the last 22 months, Unciphered has been working on a vulnerability which affected BitcoinJS, a popular package for the browser based generation of cryptocurrency wallets, as well as products and projects built from this software. Over a period of years, this vulnerability caused the generation of a significant number of vulnerable cryptocurrency wallets.

withinboredom 3y ago

Considering that each key can be generated deterministically from a seed key and the seed keys are not infinite… it’s only a matter of time (millions of years compute time with current technology, and not out of reach for state actors who can spend infinite money to run that much compute in a matter of weeks) until every wallet is accessible by anyone who knows the address. Bitcoin isn’t that safe to hold value in, if you might be targeted by someone with brains and money.

posnet 3y ago
Just for fun, because it's hard to appreciate how strong a 256bit ECDSA key is. Base Numbers: - 2*128 guesses on average - public state of the art for ECDSA on an FPGA is 1315tps [0] - retail price of said fpga $10,000 [1] - total net income for xilinx from advanced FPGAs FY2022 (936M * 0.74 + 879M * 0.72) = 1325M [2] Ballpark numbers, we'll assume that attacker can buy 10x every FPGA xilinx made in 2022 for a 50% discount and can run them non stop for zero cost. We'll also assume they have a bunch of secret math geniuses and have a faster ECDSA implementation that can do 1,000,000,000 tps ( or 1,000,000x SOTA) - (1325,000,000 / 5,000) * 10 = 2,650,000 FPGAs - 2,650,000 * 100,000,000,000 = 2,650,000,000,000,000tps - 2*128 / 2,650,000,000,000,000 = 1.28e+23s - 1.28e+24 / 60 / 60 / 24 / 365 = 4,080,000,000,000,000 years - ~4 quadrillion years - or 4x the time until every planet has been ejected from every star system and the sun has cooled to 5K [3] But why stop there, lets assume that the attacker can use the entire planets GDP to buy chips and has a 1,000,000,000,000,000x faster ECDSA implementation. - World GDP (2022): 101.3 trillion - (101,300,000,000,000 / 5000) = 20,260,000,000 - 100,000,000,000,000,000 * 20,260,000,000 = 2.66419e+28tps - 2*128 / 2.66419e+28 = 12,772,451,173s - 12,772,451,173 / 60 / 60 / 24 / 365 = 405 years So even then, we wouldn't see a single BTC key broken within our lifetime. (Unless you believe that 3 letter agencies have successfully built a quantum computer that practically implement shore's algorithm, in which case you should probably be more worried about the fact that they can break public key encryption globally) [0]: https://arxiv.org/pdf/2112.02229.pdf https://arxiv.org/pdf/2112.02229.pdf [1]: https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=3664&idcategory=6 https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=... [2]: https://web.archive.org/web/20211203065624/https://investor.xilinx.com/node/18856/pdf https://web.archive.org/web/20211203065624/https://investor.... [3]: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future