Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milk Sad Disclosure

milksad.info

Post reply on HN
Print view View original

11–20 of 133 posts

Re: Milk Sad Disclosure

#11

Post by kmeisthax »

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly, and once people realized that these wallets were crackable, they all got drained pretty quick.

Owning Bitcoin is like paying into an involuntary bug bounty program. Every time someone finds a bug, your life savings get wiped out.

Re: Milk Sad Disclosure

#12

Post by lostmsu »

Note: "Libbitcoin" here is a company name, and not a name of the core bitcoin library.

Only their products and whoever used them as a 3rd party is affected.

Re: Milk Sad Disclosure

#13

Post by comboy »

NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Why is it a mistake?

Re: Milk Sad Disclosure

#14

Post by ryanatdistrust »

yieldcrv wrote: post #10
NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

if it’s something only you can attack then there is no plausible deniability if you become accused as the code contributor

To verify, this is something anyone can attack, as was proven by our brute force lookup service: https://lookup.milksad.info.

Re: Milk Sad Disclosure

#15

Post by ajross »

kmeisthax wrote: post #11

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store e…

> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly

Sure there is. Have horse batteries taught us nothing?

https://xkcd.com/936/

Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.

Re: Milk Sad Disclosure

#16

Post by alchemist1e9 »

kmeisthax wrote: post #11

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store e…

Do you have a reference for large numbers of brain wallets being drained? I believe you are repeating a myth/FUD, but I might be wrong.

Re: Milk Sad Disclosure

#17

Post by wmf »

comboy wrote: post #13
NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Why is it a mistake?

As the article explains, 32 bits of entropy isn't enough for any cryptographic secret because it can be easily brute-forced.

Re: Milk Sad Disclosure

#18

Post by ryanatdistrust »

comboy wrote: post #13
NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Why is it a mistake?

The difference between 32 bits and 64 bits is the amount of people on Earth compared to (EDIT) the amount of grains of sand on Earth. 32 bits is nothing when it comes to entropy, and it can take a security researcher (like us) only $100 to rent a machine to completely brute force it. Nowadays, only values less than 128 or 256 bits (which are exponentially bigger) are seen as appropriate.

Re: Milk Sad Disclosure

#20

Post by alyandon »

NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

A non-cryptographic PRNG with a 32 bit seed and yet all the other maths/details are correct? I refuse to believe that that is anything but deliberate fraud.
Post reply on HN