5 ms·

transactions, which move bitcoins from one address to another, must be signed by the sending address. however, not all parts of a transaction are signed. modif

by exit 13y ago

transactions, which move bitcoins from one address to another, must be signed by the sending address. however, not all parts of a transaction are signed. modifying those parts allows one to create a valid transaction with the same bitcoin transferring effect, but with a different overall hash. the hash of the entire transaction is used as a transaction id. so a modified transaction would have a different id. some bitcoin management software (a wallet) loses track of transfers, because those transfers don't occur under the transaction-id it expected. the implication is that some bitcoin services could get confused about who they've successfully sent bitcoins to. an attacker could socially engineer a "robbery" by transmitting a mutation of an official withdrawal transaction, then appealing to the helpdesk of that service that their withdrawal never went through. it did go through - just under a different transaction id.

foxhill 13y ago
checking transaction hashes for acceptance into the blockchain was a stupid idea to begin with. clearly the data in a transaction is malleable without affecting the signature. given that mtgox already were using non-canonical transactions, they should have been aware of this. a transaction only becomes immutable once it has been included in the blockchain. after this point, searching for a tx by hash is ok. calling this a bug of the bitcoin protocol is akin to saying that array decay in C is a bug in the language spec. it is known, and and has been talked about for a long time. in both cases.
paulgb 13y ago
Thanks for taking the time to explain this, I've been curious myself. Do you know why scripts aren't signed? I don't fully understand bitcoin but it seems like they're an integral part of the transaction.
- implr 13y ago
  scriptSig (the second part of the script) contains the signature - it can't sign itself, but you can add other opcodes to it and that allows malleability.
sillysaurus2 13y ago
More seriously, if the software was set up to retransmit bitcoin after a "failed" transfer, then that service could be exploited automatically. Mostly, this wasn't a social attack. The seriousness was that many services were set up to retransmit automatically, and did lose a lot of money automatically.
tonylampada 13y ago
I'm still not sure what's the best way to defend against that, so I posted a "Ask HN" here: https://news.ycombinator.com/item?id=7246381 https://news.ycombinator.com/item?id=7246381 Any help is appreciated
- judk 13y ago
  Instead of relying on transaction hashes, you need to scan the blockchain for any transaction involving the addresses you care about. Transaction hashes are a misnomer -- the hash is a has of the message, NOT of the transaction. Many messages match one transaction.

by exit 13y ago

foxhill 13y ago

checking transaction hashes for acceptance into the blockchain was a stupid idea to begin with. clearly the data in a transaction is malleable without affecting the signature. given that mtgox already were using non-canonical transactions, they should have been aware of this. a transaction only becomes immutable once it has been included in the blockchain. after this point, searching for a tx by hash is ok. calling this a bug of the bitcoin protocol is akin to saying that array decay in C is a bug in the language spec. it is known, and and has been talked about for a long time. in both cases.

paulgb 13y ago

Thanks for taking the time to explain this, I've been curious myself. Do you know why scripts aren't signed? I don't fully understand bitcoin but it seems like they're an integral part of the transaction.

implr 13y ago
scriptSig (the second part of the script) contains the signature - it can't sign itself, but you can add other opcodes to it and that allows malleability.

sillysaurus2 13y ago

More seriously, if the software was set up to retransmit bitcoin after a "failed" transfer, then that service could be exploited automatically. Mostly, this wasn't a social attack. The seriousness was that many services were set up to retransmit automatically, and did lose a lot of money automatically.

tonylampada 13y ago

I'm still not sure what's the best way to defend against that, so I posted a "Ask HN" here: https://news.ycombinator.com/item?id=7246381 https://news.ycombinator.com/item?id=7246381 Any help is appreciated

judk 13y ago
Instead of relying on transaction hashes, you need to scan the blockchain for any transaction involving the addresses you care about. Transaction hashes are a misnomer -- the hash is a has of the message, NOT of the transaction. Many messages match one transaction.