Pages:
Author

Topic: [ANNOUNCE] Android key rotation - page 8. (Read 66313 times)

hero member
Activity: 836
Merit: 1021
bits of proof
August 12, 2013, 04:24:17 AM
The new bitcoinj release that will be announced shortly has some initial code for BIP32. It's definitely something I want to integrate. It's difficult on mobile devices because they don't have any swapfile, so you can't just use as much memory as you want. You have to define a key window in which money can be received. Coins sent to keys that fall outside that window won't show up which is obviously very problematic. All in all, it's delicate and will require some careful experimentation and testing to make it work.

The BOP android wallet to be released in conjunction with our payment solution uses BIP32.

The mobile uses the next even index of BIP32 as change and odd as next receiver addresses. The server implements a single pass scan using a BIP32 public key, that generates an increasing look ahead window from last seen address on the block chain.
I was asked in a PM if that increases the load on the server with every new transaction.

Yes it does, but we have a strategy to reset the effort. Knowing current master key birth time point limits scan as we only have to scan blocks thereafter. Now, the BOP wallet does not directly use the root BIP32 master, but a current master child of that and rolls to a new master child at user's request thereby resetting birth and scan effort. I consider making these rolls mandatory after a threshold use.
donator
Activity: 2772
Merit: 1019
August 12, 2013, 04:10:57 AM
How vulnerable is electrum to the seed issue that android has
particularly on the various OS's

eg

OSX 10.8 +
WIN7 / WIN 8
UBUNTU

etc
etc

does any one even know???

how can we check we are not doing

http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html

this?

you can look at some signatures and check the random numbers. If they're equal, RNG is flawed. If not there is a chance it's not flawed. One could also look at the implementation. Not sure which random generator electrum uses. It's written in python, chances are it falls back to OS-specific native implementation. I'm pretty sure the mobile version doesn't use the android java implementation.
legendary
Activity: 2618
Merit: 1022
August 12, 2013, 04:02:53 AM
How vulnerable is electrum to the seed issue that android has
particularly on the various OS's

eg

OSX 10.8 +
WIN7 / WIN 8
UBUNTU

etc
etc

does any one even know???

how can we check we are not doing

http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html

this?
hero member
Activity: 763
Merit: 500
August 12, 2013, 04:02:28 AM
this thread should be closed, and only updated with news reagrding the actual problem. we don't need yet another fee discussion.

also, one should answer the question, if imported vanity addresses are a problem. i would say no, only the possible other addresses where some change might have gone.
legendary
Activity: 1512
Merit: 1000
August 12, 2013, 03:44:18 AM
Thanks for the update.
legendary
Activity: 1400
Merit: 1009
August 12, 2013, 02:38:46 AM
It's possible a user exportet a single key from his electrum wallet and used it in mycelium (for example). It could get compromised by the bad RNG in android and compromise all keys of the wallet.
Does Electrum have "watching only" copies of deterministic wallets like Armory does? The attacker would need access to that in order to compromise the entire wallet instead of just the single private key that was exported and then used on a vulnerable client.

I just don't ever export private keys from them.
Private keys are called "private" for a reason, the belief of some people that it's a good idea to share them notwithstanding...
donator
Activity: 2772
Merit: 1019
August 12, 2013, 02:34:17 AM
Ive always thought computers could not generate random numbers.    I once won a large prize buying the last ticket before a lotto draw, computer random number generator was the source though I didnt complain at the time
Nothing can generate a random number. Us included. Only pseudo-random.
So you believe that radioactive decay is deterministic? If so, you are in the minority. Say I have two uranium atoms and one of the decays before the other, what do you think accounts for that?

God ;-). He makes decisions based on discussion with the other gods. It's not random, but based on divine rationality. Just believe me, I talk to the spaghetti monster every day and it never utters random nonsense.

side-note: Oh hey cool. Here's another reason to found the "church of random".
donator
Activity: 2772
Merit: 1019
August 12, 2013, 02:24:01 AM
But that has nothing to do with deterministic wallets. Non deterministic wallets do not require address re-use.
The reason that clients reuse addresses is because random key wallets are unsuitable for general use.

Requiring users to update their backups after every n transactions results in permanently lost funds.

The solution is to implement BIP32.

correct me if I'm wrong... type 2 deterministic wallets pose a danger in themselves: rf one key gets compromised, all of them are. It's possible a user exportet a single key from his electrum wallet and used it in mycelium (for example). It could get compromised by the bad RNG in android and compromise all keys of the wallet.

I'm all for using deterministic wallets and use them myself. I just don't ever export private keys from them.


newbie
Activity: 41
Merit: 0
August 12, 2013, 01:39:48 AM
Thanks for the update.
legendary
Activity: 980
Merit: 1004
Firstbits: Compromised. Thanks, Android!
August 12, 2013, 01:28:23 AM
i randomly received .15 btc yesterday to one of my android generated addresses.  Why would I randomly get free money?  this never happened to me before, is this related to the flaw?

Potentially different (worrisome) issue.

https://bitcointalksearch.org/topic/whoever-just-sent-me-0001-btc-out-of-the-blue-269231

There is the chance that spending that "free money" could result in the private key of that address being exposed.
full member
Activity: 238
Merit: 100
RMBTB.com: The secure BTC:CNY exchange. 0% fee!
August 12, 2013, 01:12:29 AM
How are the patches working around the problem?

Are they using a different source of entropy, or are they checking that the two R-values don't collide?

In my mind, best practice would be to do both.

I see a lot of cases in code where people need multiple random and unique values, (e.g. UUIDs)... where the only two requirements are that they are indeterminate and unique... but because the domain of random outcomes is so huge they rely on the vanishingly small probability of collision, and don't bother to check uniqueness.

But as we have found, that "vanishingly small probability" isn't so small if the PRNG is broken. A simple collision check isn't a waste of CPU cycles -- it guards against this kind of system problem.

As such, can all Bitcoin clients, Android or otherwise, be updated to check that the two R-values are unique?

On a different note, I don't see much discussion about the broken Android PRNG, does anyone have a link to the bug reports? This must have some pretty far-reaching consequences outside Bitcoinland too...?
legendary
Activity: 1862
Merit: 1105
WalletScrutiny.com
August 12, 2013, 01:04:44 AM
@millsdmb, that's not helpful. Your opinion about Litecoin is less important than helping prevent theft, and hope others in this forum will have useful information for the community at large.

Not all consider all alt coins part of the community and while I consider most alt coins blatant scams and therefore would not bother helping them not loosing their premined coins or whatever, I wouldn't consider the bitcoin community at large responsible for those rare alt coins that are no scams.
newbie
Activity: 6
Merit: 0
August 11, 2013, 11:53:59 PM
@millsdmb, that's not helpful. Your opinion about Litecoin is less important than helping prevent theft, and hope others in this forum will have useful information for the community at large.
sr. member
Activity: 322
Merit: 250
August 11, 2013, 11:36:28 PM
What about other Android wallets that are derived from Schildbach's code, such as Litecoin-Qt and Feathercoin-Qt??? I assume they have the same vulnerability. Any plans to update those?
no BTC no care.

don't they call Feather Coin "Fork that Coin"??
newbie
Activity: 6
Merit: 0
August 11, 2013, 11:31:12 PM
What about other Android wallets that are derived from Schildbach's code, such as Litecoin-Qt and Feathercoin-Qt??? I assume they have the same vulnerability. Any plans to update those?
hero member
Activity: 836
Merit: 1021
bits of proof
August 11, 2013, 11:17:53 PM
#99
The new bitcoinj release that will be announced shortly has some initial code for BIP32. It's definitely something I want to integrate. It's difficult on mobile devices because they don't have any swapfile, so you can't just use as much memory as you want. You have to define a key window in which money can be received. Coins sent to keys that fall outside that window won't show up which is obviously very problematic. All in all, it's delicate and will require some careful experimentation and testing to make it work.

The BOP android wallet to be released in conjunction with our payment solution uses BIP32.

The mobile uses the next even index of BIP32 as change and odd as next receiver addresses. The server implements a single pass scan using a BIP32 public key, that generates an increasing look ahead window from last seen address on the block chain.
sr. member
Activity: 322
Merit: 250
August 11, 2013, 10:08:16 PM
#98
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

http://bitcoin.org/en/alert/2013-08-11-android

We recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses, that render all Android wallets generated to date vulnerable to theft. Because the problem lies with Android itself, this problem will affect you if you have a wallet generated by any Android app. An incomplete list would be Bitcoin Wallet, blockchain.info wallet, BitcoinSpinner and Mycelium Wallet.

as a former Google employee I thank you for your vigilance!
How many BTC you want for that crazy hat they give you?
newbie
Activity: 16
Merit: 0
August 11, 2013, 09:55:03 PM
#97
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

http://bitcoin.org/en/alert/2013-08-11-android

We recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses, that render all Android wallets generated to date vulnerable to theft. Because the problem lies with Android itself, this problem will affect you if you have a wallet generated by any Android app. An incomplete list would be Bitcoin Wallet, blockchain.info wallet, BitcoinSpinner and Mycelium Wallet.

as a former Google employee I thank you for your vigilance!
legendary
Activity: 1400
Merit: 1009
August 11, 2013, 09:25:27 PM
#96
Of course it must work multiple times - just like PGP/RSA has been working, ever since it was invented.
And nobody says that you using the same PGP key twice "should be considered negligent" - it would just defeat the purpose of a digital signature Smiley
A better analogy would compare Bitcoin addresses to session keys.
newbie
Activity: 46
Merit: 0
August 11, 2013, 09:15:21 PM
#95
i randomly received .15 btc yesterday to one of my android generated addresses.  Why would I randomly get free money?  this never happened to me before, is this related to the flaw?

Though unlikely I suppose if you (not so) "randomly" happened to create a collision on Android you may have gained .15 BTC of an other user and both of you could spend it. It may well be related but certainly a coincidence. Would be interesting if this is followed up...
Pages:
Jump to: