51–60 of 133 posts
Worth noting: libbitcoin is an obscure project with an impressive name. In that it's not used by bitcoind or any wallets I know of: it's mainly of interest here because the book Mastering Bitcoin used it for examples.
Earlier quoted context omitted.
That is correct, you still have 2^32 permutations of possible values.
Given it's seeded with system time, depending on the resolution, that may in practice be as low as tens of thousands of possible values (as in time(2) )
Earlier quoted context omitted.
2^32 search space for each set? That seems to imply a little under 2,000 keys per second?
My numbers are very rough estimates and not good enough to do work on. More accurate information may be made public later.
Not that it's particularly worth bothering if you have an 80 core machine and only 13 billion keys to check.
Earlier quoted context omitted.
You only need a phrase of twelve words from a 2048 word dictionary to have 128 bits of entropy. Twelve words is up to "Thy kingdom" in the Lord's Prayer, so certainly people are able to memorize twelve word phrases or even 24 word phrases without too much trouble. And English is a lot more than 2048 words - so you could probably use a shorter phrase and still be fine.
But the phrases are random, so unlike poems or prayers they are difficult to memorize.
Worth noting: libbitcoin is an obscure project with an impressive name. In that it's not used by bitcoind or any wallets I know of: it's mainly of interest here because the book Mastering Bitcoin used it for examples.
It is also of interest because at least ~$1m of funds were stolen from thousands of wallets made by people that wanted a simple and seemingly reputable CLI tool to generate a mnemonic and derive addresses for various coins.
Earlier quoted context omitted.
Given it's seeded with system time, depending on the resolution, that may in practice be as low as tens of thousands of possible values (as in time(2) )
2^32 is still incredibly small for crypto and is inexcusable.
Worth noting: libbitcoin is an obscure project with an impressive name. In that it's not used by bitcoind or any wallets I know of: it's mainly of interest here because the book Mastering Bitcoin used it for examples.
"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…
Would a CSPRNG be at all an improvement with only a 32 bit seed? Couldn't you still brute force it?
so it's not even 32 bits of entropy, it's some tiny fraction of that. (system times for a few years interval)
Earlier quoted context omitted.
> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly Sure there is. Have horse batteries taught us nothing? https://xkcd.com/936/ Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.
This xkcd comic has been instrumental to me. I wrote a command-line utility a couple of years ago that I use myself regularly to generate secure and memorable passwords https://github.com/ctsrc/Pgen With this tool you can also see how many bits of entropy the passphrase generation settings you are using will result in. For example, generating a 5 word passphrase using the long wordlist pgen -l -n 5 will yield a passp…