I have not yet reviewed this code, but IF there is a bug in the code (or introduced into the bitcore nodejs module) that re-uses k values, then running this on a computer that never touches the internet will not protect you. It will be possible to calculate your private key from the combination of 2 signatures.
I appreciate your very kind offer to carefully review the code. I understand that such processes take their time, so that it was not "yet" possible.
To give everyone else the chance here to have a look at the code themselves as well, here it is
var dumbsign = function(wif,msg){
var privateKey = bitcore.PrivateKey.fromWIF(wif);
var signature = Message(msg).sign(privateKey);
return signature;
}
Any "bug reports", improvement suggestions or reimplementations are welcome
I saw that you included the github link and I was going to take a look tonight. Hadn't even clicked on it yet.
I wasn't aware that it was so short, or else I may have taken a look right away.
The main concern here that people will want to be aware of is that running something "on a computer that never touches the internet" is not helpful if the signature calculation re-uses a k value. I would hope the bitcore nodejs module won't have such a problem, but bugs happen and mistakes (and malicious behavior) happen.
If people are going to re-use bitcoin addresses, generating multiple signatures with them, then they should be aware that they can leak their private key without ever letting the private key touch an internet connected computer. Wouldn't want anyone to develop a false sense of security now, would we?
