While working on Bulletproofs++ I realized there were gaps in my understanding of zero-knowledge proofs. I did a quick search through the literature to find proofs for zero-knowledge that can help my understanding. I found that either the protocols were too different to Bulletproofs(++) or the proofs seemed incomplete. For example, in Bulletproofs, removing blinding values from the protocol does…
Abstract : Multi-signatures enable a group of signers to produce a single signature on a given message. Recently, Drijvers et al. (S&P 19) showed that all thus far proposed two-round multi-signature schemes in the DL setting (without pairings) are insecure under concurrent sessions, i.e., if a single signer participates in multiple signing sessions concurrently. While Drijvers et al. improve the…
BIP-Schnorr Abstract : This document proposes a standard for 64-byte Schnorr signatures over the elliptic curve secp256k1. BIP-Taproot Abstract : This document proposes a new SegWit version 1 output type, with spending rules based on Taproot, Schnorr signatures, and Merkle branches. BIP-Tapscript Abstract : This document specifies the semantics of the initial scripting system under BIP341…
Abstract : MuSig is a multi-signature scheme for Schnorr signatures, which supports key aggregation and is secure in the plain public key model. Standard derandomization techniques for discrete logarithm-based signatures such as RFC 6979, which make the signing procedure immune to catastrophic failures in the randomness generation, are not applicable to multi-signatures as an attacker could trick…
There are two posts I recently contributed to Blockstream’s engineering blog expanding on the talk I gave at The Lightning Conference 2019 . Cross-posting them here because they fit the theme of this blog: Reducing Bitcoin Transaction Sizes with x-only Pubkeys This article is about the recent introduction of so-called x-only pubkeys to the Bitcoin Improvement Proposal BIP-schnorr […]…
At Breaking Bitcoin 2019 in Amsterdam I gave a talk about how to build secure protocols on BIP-taproot or more specifically how to avoid the dangers we learned about so far. There was not enough time to cover everything. The talk also gives an introduction to how to use our MuSig implementation in libsecp256k1-zkp . The video recording is on youtube ( slides ). Thanks to kanzure there’s also…
nix-bitcoin ( github.com/fort-nix/nix-bitcoin ) is a project I contribute to in my spare time that provides nix packages and nixos modules for easily installing Bitcoin nodes and higher layer protocols. The initial idea was to build myself a lightning node in a reproducible way. I talked more about the motivation and how to use it at the LightningHackdayMUC ( video , slides ).
Last weekend a bunch of hackers assembled for the 3rd Lightning Netword Hackday in Berlin. The event was packed with interesting sessions, neat hacks and exciting discussions which were concluded with the traditional dinner & drinks at ROOM77. I gave a talk about “Schnorr and Taproot in Lightning” ( slides , video ) focusing on privacy and security implications.
At the recent Building on Bitcoin conference in Lisbon I gave a talk about a few new ideas in the scriptless scripts framework. The first part was mainly about blind coinswaps , which is a way to swap bitcoins with a tumbler without revealing which coin are swapped. The second part about how to exchange ecash tokens peer-to-peer using scriptless scripts and Brands credentials. You can find the…
Last week the Monero team disclosed a major bug in CryptoNote based cryptocurrencies ( reddit thread ) which could be used to create “create an infinite amount of coins”. Monero itself was quietly fixed in February ( release , pull request ) and the since then every user syncing the blockchain from scratch validates that it was never exploited in Monero. However, it was used in…
The crypto-currency Monero is about to introduce a new milestone in Blockchain technology: RingCT . This is a scheme that allows using Confidential Transactions (CT) while keeping the non-interactive coin mixing typical for Monero. CT enables hiding the transaction amounts from anyone but sender and receiver while full nodes are still able to verify that input amounts are equal to output amounts.…
Thanks to a quite a bit of luck I won this years version of the Underhanded Crypto Contest focused on crypto currencies. The submission consists of a writeup and – of course – backdoored code .
Slides Abstract We analyse the performance of several clustering algorithms in the digital peer- to-peer currency Bitcoin. Clustering in Bitcoin refers to the task of finding addresses that belongs to the same wallet as a given address. In order to assess the effectiveness of clustering strategies we exploit a vulner- ability in the implementation of Connection Bloom Filtering to capture ground…
This is the transcript of a talk I gave at the Scaling Bitcoin Conference 2015 in Hong Kong. See this mailing list post by Greg Maxwell for a general summary of the scaling measures that Bitcoin Core developers are adopting. The slides accompanying the transcript can be found here . Motivation As we’ve seen over the last two days scalability is a multidimensional problem. One of the main…
CSGOJackpot is a gambling website where players bet and win Counter Strike Go ‘skins’ (weapon textures). Because these items can only be found by playing a lot of CSGo, they are quite rare and valuable, and can be exchanged for example in Steam’s own Marketplace. What is fascinating about CSGOJackpot and initially captured my attention is the sheer amount of value that is gambled…
We don’t know yet. But modelling is in my opinion a useful tool to investigate potential effects. Therefore, I used Gavin Andresen’s mining simulator to create some more or less plausible scenarios. You can find the resulting plots on github .
TLDR I ran afl-fuzz against libbitcoinconsensus to discover interesting Bitcoin scripts and used them to search for Bitcoin reimplementations vulnerable to forking. This discovered two bugs in btcd by Conformal. See the bitcoinconsensus_testcases repository for the discovered Bitcoin scripts. Forks One of the things that must not happen during regular Bitcoin operation are forks . A fork occurs…
I found two vulnerabilities in the crypto currency Ethereum : negative transactions and predictable ECDSA nonce . As part of the bug bounty program I was awarded with 20 Bitcoin.
The DNS parser of the Bitcoin Seeder was vulnerable to a denial of service attack. A specially crafted DNS request could trigger infinite recursive function calls that lead to a stack overflow. See the exploit . The vulnerability was fixed in commit 11e935b .
The paper Deanonymisation of clients in Bitcoin P2P network (2014) by Biryukov, Khovratovich and Pustogarov (BKP), who describe an attack on Bitcoin Core clients, has started some discussion lately. The main idea of the paper is to first get a set of nodes $E_v$ to which your victim $v$ is directly connected to (“entry nodes”). Second, for each transaction $t$ record the $10$ nodes…