6 ms·
I would like to see some analysis done on the Blockchain itself; it should be pretty easy to see if there are any compromised addresses like this according to t
by vessenes 12y ago
I would like to see some analysis done on the Blockchain itself; it should be pretty easy to see if there are any compromised addresses like this according to their paper.
As it is, I think it's probably unreasonable for someone to worry if they're using a generally available audited ECDSA toolkit for their signature signing. You have to imagine that the ECDSA kit has a way of secretly storing these numbers and keeping track of their state across calls which might span months. Sounds hard to implement in an open source project.
On the other hand, the idea of something like a Trezor leaking information isn't too hard to believe; at least, now that this paper is written.
Those sorts of attacks don't seem likely to be economical, which is to say a highly secure hardware wallet implementation might be worth more as a company than any one user's single address. You probably couldn't do it more than once or twice before shit got real nasty.
- pg314 12y agoYou cannot distinguish malicious from legitimate signatures. From the paper: 'This can be done in such a way that only the attacker, who made the malicious implementation, can extract the secret from the signature, and that the distribution of malicious signatures is polynomially indistinguishable from legitimate signatures by anybody else.'
- vessenes 12y agoHmm, I must have read too quickly. The initial analogy they used didn't have that property. Thanks!