Ethereum Security Bug Bounty

#1

Post by mischa_u » Mon, Jan 26, 2015, 2:43 PM UTC

Ethereum Security Bug Bounty
bounty.ethdev.com

Re: Ethereum Security Bug Bounty

#2

Post by woah » Mon, Jan 26, 2015, 3:31 PM UTC

Hard to read on my phone

Re: Ethereum Security Bug Bounty

#3

Post by sarciszewski » Mon, Jan 26, 2015, 3:47 PM UTC

> delivering stable protocols and secure software upon genesis block release

> Elliptic curve (secp256k1, ECDSA)

Isn't secp256k1 and ECDSA prone to implementation errors? Why not use EdDSA instead? :)

Re: Ethereum Security Bug Bounty

#4

Post by tptacek » Mon, Jan 26, 2015, 3:54 PM UTC

sarciszewski wrote: post #3

> delivering stable protocols and secure software upon genesis block release > Elliptic curve (secp256k1, ECDSA) Isn't secp256k1 and ECDSA prone to implementation errors? Why not use EdDSA instead? :)

Those are Bitcoin's primitives, right? Presumably, they're just doing what everyone else does.

Re: Ethereum Security Bug Bounty

#5

Post by sarciszewski » Mon, Jan 26, 2015, 5:09 PM UTC

tptacek wrote: post #4

sarciszewski wrote: post #3

> delivering stable protocols and secure software upon genesis block release > Elliptic curve (secp256k1, ECDSA) Isn't secp256k1 and ECDSA prone to implementation errors? Why not use EdDSA instead? :)

Those are Bitcoin's primitives, right? Presumably, they're just doing what everyone else does.

Sure, I just thought (based on the genesis block comment) that they were going to make their own. And, well, https://eprint.iacr.org/2014/161.pdf

Using the same primitives as everyone else is probably a conservative choice.

Re: Ethereum Security Bug Bounty

#6

Post by nullz » Mon, Jan 26, 2015, 6:05 PM UTC

sarciszewski wrote: post #3

> delivering stable protocols and secure software upon genesis block release > Elliptic curve (secp256k1, ECDSA) Isn't secp256k1 and ECDSA prone to implementation errors? Why not use EdDSA instead? :)

Relevant code if someone wants to audit: https://github.com/ethereum/go-ethereum/blob/4df2e1ef5c20ebd...