News for hackers. Stuff that matters.

A comment on Large Bitcoin Collider Is Generating Trillions of Keys and Breaking into Wallets.

Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by chejazi on Saturday April 15, 2017 @01:40PM (#14121785)
Not sure their what their heuristics are for narrowing the search space, but there certainly are some good ones. For instance, early versions of blockchain.info's wallet generated private keys by reading an ARC4 stream that had been seeded with Math.random() calls xor'd with timestamps. Quite the circus!
[ Parent | on HN ]
Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by scintill76 on Saturday April 15, 2017 @05:16PM (#14122905)
I believe there was a time when blockchain.info's Android wallet generated keys from Apache's 301 redirect HTML fetched over HTTP[1].

I think there's also a lesson about idiot-proofing APIs. With the benefit of this in hindsight, I might instead return an invalid, non-HTTP response that blows up every major HTTP client internally, so that it's impossible for the API consumer code to happily truck along interpreting a non-200 response body as if it's valid random data.

[1] https://www.reddit.com/r/Bitcoin/comments/37nlg1/i_was_the_g...

[ Parent | on HN ]
Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by ryan-c on Saturday April 15, 2017 @03:17PM (#14122322)
They're just doing a naive sequential search.
[ Parent | on HN ]
Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by mankash666 on Saturday April 15, 2017 @02:29PM (#14122039)
If collisions exist in the hashing algorithm, how you derive the seed for a random number generator is pointless
[ Parent | on HN ]
Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by Ded7xSEoPKYNsDd on Saturday April 15, 2017 @04:38PM (#14122725)
Every hashing algorithm has collisions, for good cryptographic ones there's just no practical way of finding them.
[ Parent | on HN ]
Re:Large Bitcoin Collider Is Generating Trillions of Keys an... by estro on Saturday April 15, 2017 @09:24PM (#14123847)
There is no practical way of finding a collision for a specific key. Finding collisions to one of the created keys non-specifically is a much smaller search space.
[ Parent | on HN ]