Topic: Reused R values again - page 15. (Read 121295 times)

It was known right from the beginning, when ElGamal published his signature scheme, on which Schnorr signatures are based, on which classical DSA is based, on which ECDSA is based.


From his 1985 paper:

This information is public from 2010, since the Sony PlayStation fiasco where they used R=4 to sign *all* the games in their online store. At the bottom of this article http://kakaroto.homelinux.net/2012/01/how-the-ecdsa-algorithm-works/ you have two simple formulas how to calculate the private key from two reused R values. johoe monitored the blockchain to find repeating R values, they are public in every transaction.

Edit:
To be technically precise, R is the point on the curve you get as R=k*G, k being the random number and G being the reference point. Sony used k=4 as a random number.

Do you think the majority of the reused "R' values issue has been resolved? If so could you explain how you were able to identify which addresses had the reused R value and how to calculate the private key from the public key?

(maybe you could delay releasing such information until after the flawed transactions slow down a little bit more)

Very cool of you, didn't lose any funds but its refreshing to see this sort of thing.

You very much earned them!

Thanks again for you honesty and the work you put in to protect people from theft.

A "thank you" from me too. You saved about 3 BTC of my users' money (I hope blockchain.info will return it).

Very noble of you, sir.

Hello,

thanks for all the warm words.  I very much appreciated them.

I have to say, I already got a reasonable reward from bc.i.  Also many thanks to the satoshilabs people who offered me a new trezor (could be handy as a backup next time).  If you still want to donate I added one of my bitcoin addresses to the signature.  And if you ever need to store 267 BTC safely for a few days , you can get a trezor here.

To answer some of the questions:

In principle, it should be safe to use blockchain again, but I still see some bad transactions.  The last occurred six hours ago. There are only very few now and the guess is that this is because of browser cache issues.  So clear your browser cache and reload the blockchain page.  

If you generated a new address on blockchain in the night from Dec. 7/8 (UTC) before the bug was fixed, you should consider this as broken.  
Even if it is not on my list.  The same holds for every address you sent money from during that period using the blockchain service.  If you accessed the website during that period, you may have gotten the buggy script in your browser cache, so you may still be affected if you later created a new address or sent money.  I'm not sure of the end of the time window.  The first buggy transaction occured Dec. 7 21:53:26 UTC.  

If you lost money during the last days you can reclaim it by writing to the blockchain support.  They can see whether your claim is valid and will refund you.  That said, I'm not affiliated with blockchain.info  (I just returned them their money).

For the record, I used these addresses:

1HuqM18GMVaLxTRGdmSgytzVYnhRzu7U68
1L7gfUxCY5bDmzp1xA6CjA3qXZwsbzWGbG
1HdqdZudnV681xapavSJp3LqaCcJn12eSE
1EjXAe3WRqipdQdP5qeESjZRhxLVfe6cJ7
17TifxwuGSor7woQ64gL57KJzwPAjSf3Qa

the money to these addresses have been returned.

I see that there are several different 1xy... addresses related with this incident.  These are not mine.

I hope that all remaining issues will be resolved soon.

MUCH respect man.... ever thought about starting up a coin?  I would buy based on this alone. . .

Huge respect for doing this. We need more people in the world like you.

Very honourable work there, johoe. Thanks from all

I take it that the reused-whatever bug is solved now? Or do we avoid blockchain for now?

Honesty seems to be not so common in these days and even less in the BTC world.
What you did is admirable.

You, Sir, surely deserve a positive feedback on your trust page.

He is only an honest guys , great  work *again* johoe  .

Right thing to do.Thumbs up johoe

Seems so. Either Satoshi or a very very early adopter who has CPU mined coins.

thanks johoe , i get my btc return 2 hours ago

i am more bileve you are satoshi

Same here.
Very, very honest.

Rare these days.

No affected by this, but just wanted to thank you for being a boss.

People like Johoe  are so rare, i can't believe what happened here...

maybe he/she is satoshi. 

Very honorable move. You truely deserve the respect!



... exactly my thoughts after reading the post.