Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milk Sad Disclosure

milksad.info

Post reply on HN
Print view View original

41–50 of 133 posts

Re: Milk Sad Disclosure

#41

Post by ryanatdistrust »

codetrotter wrote: post #39
ajross wrote: post #15

Earlier quoted context omitted.

> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly Sure there is. Have horse batteries taught us nothing? https://xkcd.com/936/ Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.

This xkcd comic has been instrumental to me. I wrote a command-line utility a couple of years ago that I use myself regularly to generate secure and memorable passwords https://github.com/ctsrc/Pgen With this tool you can also see how many bits of entropy the passphrase generation settings you are using will result in. For example, generating a 5 word passphrase using the long wordlist pgen -l -n 5 will yield a passp…

It looks neat, I'll pass this along to the team and take a deeper look at it later.

Re: Milk Sad Disclosure

#42

Post by ryanatdistrust »

ryan-c wrote: post #36
ryanatdistrust wrote: post #34

Earlier quoted context omitted.

We used the broken algorithm from `bx` in a custom Rust program to brute force this.

What sort of rate did you get for computing the hashed public keys?

I was not involved in that specific aspect, so I can't provide accurate information. We may release more information later in the future.

Re: Milk Sad Disclosure

#43

Post by ryan-c »

ryanatdistrust wrote: post #42
ryan-c wrote: post #36

Earlier quoted context omitted.

What sort of rate did you get for computing the hashed public keys?

I was not involved in that specific aspect, so I can't provide accurate information. We may release more information later in the future.

2^32 search space for each set? That seems to imply a little under 2,000 keys per second?

Re: Milk Sad Disclosure

#45

Post by ryanatdistrust »

ryan-c wrote: post #43
ryanatdistrust wrote: post #42

Earlier quoted context omitted.

I was not involved in that specific aspect, so I can't provide accurate information. We may release more information later in the future.

2^32 search space for each set? That seems to imply a little under 2,000 keys per second?

My numbers are very rough estimates and not good enough to do work on. More accurate information may be made public later.

Re: Milk Sad Disclosure

#46

Post by marginalia_nu »

ryanatdistrust wrote: post #35
aidenn0 wrote: post #31

Earlier quoted context omitted.

Would a CSPRNG be at all an improvement with only a 32 bit seed? Couldn't you still brute force it?

That is correct, you still have 2^32 permutations of possible values.

Given it's seeded with system time, depending on the resolution, that may in practice be as low as tens of thousands of possible values (as in time(2) )

Re: Milk Sad Disclosure

#47

Post by nullc »

technion wrote: post #38
NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Seeing it declared a WONTFIX to me helps answer which of those it was. If it was fraud, you'd expect a fake apology and a fix at this point.

Why? The regress is infinite, it's zero information. A malicious party can anticipate any public-information rational for dismissing their actions and pretend to be whatever flavor of fool you might accept.

"Now, a clever man would put the poison into his own goblet, because he would know that only a great fool would reach for what he was given. I am not a great fool, so I can clearly not choose the wine in front of you. But you must have known I was not a great fool, you would have counted on it, so I can clearly not choose the wine in front of me. ... Because iocane comes from Australia, as everyone knows, and Australia is entirely peopled with criminals, and criminals are used to having people not trust them, as you are not trusted by me, so I can clearly not choose the wine in front of you."

Re: Milk Sad Disclosure

#48

Post by nullc »

tomjakubowski wrote: post #23
kmeisthax wrote: post #11

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store e…

You only need a phrase of twelve words from a 2048 word dictionary to have 128 bits of entropy. Twelve words is up to "Thy kingdom" in the Lord's Prayer, so certainly people are able to memorize twelve word phrases or even 24 word phrases without too much trouble. And English is a lot more than 2048 words - so you could probably use a shorter phrase and still be fine.

Unfortunately there is good reason to think that memorability and low entropy (against a sufficiently advanced sequence generator) are highly related.

Re: Milk Sad Disclosure

#49

Post by drexlspivey »

lostmsu wrote: post #12

Note: "Libbitcoin" here is a company name, and not a name of the core bitcoin library. Only their products and whoever used them as a 3rd party is affected.

Here's a thread on how bitcoin core generates entropy https://twitter.com/raw_avocado/status/1445024873382809604
Post reply on HN