pull down to refresh

120 sats \ 8 replies \ @Filiprogrammer 31 Jul \ parent \ on: Technical Deep Dive into the Entropy Issue bitcoin

You can check for yourself that Puzzle 71 is uncracked:
https://bitcointalk.org/index.php?topic=5218972.msg53649852#msg53649852

https://mempool.space/address/1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU

This additional entropy materially improves the situation for Mk4, Q and Mk5. Under the same current assumptions, we estimate the effective search space at about 72 bits.

Source: https://blog.coinkite.com/entropy-technical-backgrounder/

write
compose
18 sats \ 7 replies \ @Scoresby 31 Jul

I don't dispute the 71 bit puzzle beingbunsolved, but what do you make of this from the block report:

Mk4/Q/Mk5Mk4/Q/Mk5

For a successful reseed with known fallback state and call history:
  • Secure reseed possibilities: at most 2^32
  • Average enumeration: approximately 2^31
A deliberately loose known-UID ceiling can be obtained by treating every timer field as independent:
120,000 SysTick values
× 86,400 RTC times
× 256 RTC subsecond values
≈ 2^41.27 fallback states
Including the reseed gives a raw ceiling near 2^73.27.

This is not 73-bit cryptographic security. The timer fields are correlated, may occupy much smaller ranges, and can potentially be observed or reconstructed.
reply
103 sats \ 3 replies \ @Filiprogrammer 31 Jul

I had not read the Block report before. But this changes things.

If the entropy is sourced from timers that count from zero at boot, then an attacker is more likely to find a wallet by brute-forcing small timer values.

And also a correlation between SysTick and RTC might bring the effective bits of entropy down.

reply
1 sat \ 2 replies \ @Scoresby 31 Jul

This may also be helpful:

source

reply
103 sats \ 1 reply \ @Filiprogrammer 31 Jul
I think we can use STM32 UIDs to identify legitimate coin owners

That might be hard. Only 32 bits of the UID are used and it's also XORed with SysTick.

pad = UID_low32 ^ SysTick->VAL;
reply
11 sats \ 0 replies \ @Scoresby 31 Jul

This is the best info I've seen so far:

From around 1200 UTC.

The researchers at block still haven't published any updates since their original blog post.

reply
103 sats \ 2 replies \ @raw_avocado 31 Jul

In all fairness I did add this clarification after :p

reply
1 sat \ 1 reply \ @Scoresby 31 Jul

Ah, thanks! I missed that!

reply
103 sats \ 0 replies \ @raw_avocado 31 Jul

You did not miss anything, I re-wrote the single tweet after replying to Kevin.
You linked the first time i mentioned it.

reply