pull down to refresh
Mk4, MK5, Q will get drained.
72 bits of entropy is not great but definitely not trivial to crack. Bitcoin Puzzle 71 is still uncracked after all.
So users who generated their wallet on Mk4, Mk5, or Q don't need to panic immediately, but their wallets might be cracked in the next few months/years.
Praveen seems to think that 72 bits should be treated more as an upper bound. I can't find the specific post right now, but this is their conclusion:
As does @raw_avocado:
You can check for yourself that Puzzle 71 is uncracked:
https://bitcointalk.org/index.php?topic=5218972.msg53649852#msg53649852
https://mempool.space/address/1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU
This additional entropy materially improves the situation for Mk4, Q and Mk5. Under the same current assumptions, we estimate the effective search space at about 72 bits.
Source: https://blog.coinkite.com/entropy-technical-backgrounder/
I don't dispute the 71 bit puzzle beingbunsolved, but what do you make of this from the block report:
Mk4/Q/Mk5Mk4/Q/Mk5
For a successful reseed with known fallback state and call history:A deliberately loose known-UID ceiling can be obtained by treating every timer field as independent:
- Secure reseed possibilities: at most
2^32- Average enumeration: approximately
2^31
120,000 SysTick values
× 86,400 RTC times
× 256 RTC subsecond values
≈ 2^41.27 fallback statesIncluding the reseed gives a raw ceiling near2^73.27.
This is not 73-bit cryptographic security. The timer fields are correlated, may occupy much smaller ranges, and can potentially be observed or reconstructed.
I had not read the Block report before. But this changes things.
If the entropy is sourced from timers that count from zero at boot, then an attacker is more likely to find a wallet by brute-forcing small timer values.
And also a correlation between SysTick and RTC might bring the effective bits of entropy down.
I think we can use STM32 UIDs to identify legitimate coin owners
That might be hard. Only 32 bits of the UID are used and it's also XORed with SysTick.
pad = UID_low32 ^ SysTick->VAL;In all fairness I did add this clarification after :p
source