pull down to refresh

Mk4, MK5, Q will get drained.

72 bits of entropy is not great but definitely not trivial to crack. Bitcoin Puzzle 71 is still uncracked after all.

So users who generated their wallet on Mk4, Mk5, or Q don't need to panic immediately, but their wallets might be cracked in the next few months/years.

reply

Praveen seems to think that 72 bits should be treated more as an upper bound. I can't find the specific post right now, but this is their conclusion:

As does @raw_avocado:

reply

You can check for yourself that Puzzle 71 is uncracked:
https://bitcointalk.org/index.php?topic=5218972.msg53649852#msg53649852

https://mempool.space/address/1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU


This additional entropy materially improves the situation for Mk4, Q and Mk5. Under the same current assumptions, we estimate the effective search space at about 72 bits.

Source: https://blog.coinkite.com/entropy-technical-backgrounder/

reply

I don't dispute the 71 bit puzzle beingbunsolved, but what do you make of this from the block report:

Mk4/Q/Mk5Mk4/Q/Mk5

For a successful reseed with known fallback state and call history:
  • Secure reseed possibilities: at most 2^32
  • Average enumeration: approximately 2^31
A deliberately loose known-UID ceiling can be obtained by treating every timer field as independent:
120,000 SysTick values
× 86,400 RTC times
× 256 RTC subsecond values
≈ 2^41.27 fallback states
Including the reseed gives a raw ceiling near 2^73.27.

This is not 73-bit cryptographic security. The timer fields are correlated, may occupy much smaller ranges, and can potentially be observed or reconstructed.
reply

I had not read the Block report before. But this changes things.

If the entropy is sourced from timers that count from zero at boot, then an attacker is more likely to find a wallet by brute-forcing small timer values.

And also a correlation between SysTick and RTC might bring the effective bits of entropy down.

reply

This may also be helpful:

source

reply
I think we can use STM32 UIDs to identify legitimate coin owners

That might be hard. Only 32 bits of the UID are used and it's also XORed with SysTick.

pad = UID_low32 ^ SysTick->VAL;
reply

This is the best info I've seen so far:

From around 1200 UTC.

The researchers at block still haven't published any updates since their original blog post.

In all fairness I did add this clarification after :p

reply

Ah, thanks! I missed that!

reply

You did not miss anything, I re-wrote the single tweet after replying to Kevin.
You linked the first time i mentioned it.

reply
135 sats \ 1 reply \ @Scoresby 31 Jul

If you had a geographically distributed multisig where all the keys were generated by CCs, this would be a very unpleasant moment.

reply

If you didn't dice. But even then, think about what it takes to reconstruct a redeemscript. The multisig buys you a few days now. So, better get going.

reply