From 51600f79980cf31286a3367b14dda989afc124d3 Mon Sep 17 00:00:00 2001 From: Christian Reitter Date: Tue, 13 Feb 2024 15:26:59 +0100 Subject: [PATCH] Add some basic files, fix links --- faq.md | 2 +- favicon.ico | Bin 0 -> 15086 bytes index.md | 2 +- robots.txt | 1 + 4 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 favicon.ico create mode 100644 robots.txt diff --git a/faq.md b/faq.md index 5705849..827703d 100644 --- a/faq.md +++ b/faq.md @@ -57,7 +57,7 @@ The identified problem is limited to the entropy generation functionality. We're --- ### Is the vulnerability currently fixed in `libbitcoin-explorer`? -We are not aware of a fix. At the time of disclosure, our understanding is that the Libbitcoin team considers this not to be a vulnerability. See [this section](disclosure.html#libbitcoin-vendor-response) in our disclosure. +We are not aware of a fix. At the time of disclosure, our understanding is that the Libbitcoin team considers this not to be a vulnerability. See [this section](/disclosure.html#libbitcoin-vendor-response) in our disclosure. **Update**: `libbitcoin-explorer` [3.8.0](https://github.com/libbitcoin/libbitcoin-explorer/releases/tag/v3.8.0) fixed the issue by removing the problematic entropy generation command. diff --git a/favicon.ico b/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..d79f508aaf0ab6a605d5dbe1adf56fb209714c03 GIT binary patch literal 15086 zcmdU0X;f9$lD_FAD|xTGU-U;OyqI@@pYo1E5lIhxPS4N~MF2Iv zE{;!(-5>q8fB*h(J32a=QCr;5%=p?LO}C@(Cyf6>czf8{*~JbRFyOAMtE+(&g&j8!@b(s+4@X;LZ%F0Ucv3&V*golU2 zU@(BMy(xUOhMTeO-=75^pOF|kY#5SLw&CH!hk~bnBp+?Uopk_HNLR)Tal%&~_V6EK zkLe@q5a92Jl+=F=A8p0WIvz085lO*TxV2V^W#jD-KA|6;Y_dSs0!svb_2=@@8tw|# z6OuRM9yiPpDIu1)9d7}3vN=@L!p8R#O|{h=8v6ZsqXja*vBZ?&cJTKf^M}nxdvH(i zcEt8sO5BY%gJ%B-Xpe@Vp73&$@Jqj$Crzp)9&Io~#(XPG_9i~Yyk0)Yw{>G5C-;Mr zKau1e7&sM^hC3pCjs@-|SU{WQ3-xXf=&tU8w)k7rC-rUuzZq2N1EBk97c{w3X^zbB z>jn$#nP-KGZRev~OTM45+Y;`dr%ah5e4Pn*MI|yxPo@#>sUsY*YpxOxHdsP?C;*zA zDbU|7g670x=*D9c=2LXR8$CGSHZaV8*xwbalqdBN|G7rz|MitU)>F;YoNWn z75e*Uq5XR@^bd;#uKFaiCge}}Q?2RwBp6f`P#>NMRa$?j_6`Nx2lMe@y#><0w!*lf z_Al|lm>3&lWUP&OplknXZ*O0?ZQC|fS62(%)2B_vjFApxb4t=#!oABCy7RG6=glMx zRfP8f)GU9(Z>WC`-RGQ)P&;HVw#3s!((jDHP=D_N^}(^w zKR7RN>mUCJ_0d_-KP@8}dKvNGE)e>rySkUKTQrY9)kg5h@~+?3&%~>0-*Cdd4Tj&I zk{)hF{dc{gIW`B{!X;3rTH($*3#82IixHmogx{%I{Pqq`MO$atK$k*xwc8WA@?+3m z+63*7+ek;w8F7>CneemxNq2R(j)3_xRNa9p)5nC1^(UN~aX#4pIK%M#XVRZ?lD#WE zXS5S(&Uh@#ihrwfrjm?)f~H_0%|~x&Q_PVVYy-yFoc!&HH^#3??j!V*Wv;t*ROq?T zb(Z^+D}+D9D1Xvf)&t#*9H9rSTiOfjgbvpxnPYK)9p?Gj;rV6@v3{wNX>B_&hA;-u zy!}2;lD-K(SpSGGo)dnb?s}HspVz-+!p0cegnyR@^uJyd?_e7fdN1(H) z?`seFCm}f&DRilr4@evqVKA@jh=>qPuh-+ojT=}SpMcRLhhy$&Tbu~9 zMAa7KzUU=BNQYGWM?zb=#ptU@pW2OohZEV_b)o;7QxPzztBrO`wyMnYQ?-id-e>oXV1o*Idj10d@vus$oQD=XM>aBmZ)yb2kXzp1TjW) zW~I>|wNroUx7$Pi>?(9+>11<$FwnZgxU07hKv9Gh7W$Dt8|sBHfxA@5n+ZOD{v7-E z?Zc!=lQ4AXP`J3bVDjY2^gXj*+~a5DeE89PEEr>hqUCZvNPoz;Y0gF)ee^5HpZznh zmD=-hv}d$JRhm0aEVsh^(bo8?72G~PKG?8f1Fl}Zipa=FUh_?SFmKFbV?M@=^2Q>6 z8=Q_%qUJku+TXDsVp})**mmm=?NxLI^H90N1NqC8_A7qQXP%F&zvBl61;+FG}pPw)6Au}^m%ni>G&sD2@_qZvAy|a46#Sru4GW ze=`xeKWR$8C46n^fBWq>L`6j*fcBC%Z{9QwX$v1WZrsHDZ@vLzYz{x|t&6sA-!9(! zI&qtT(h2Y5XUv!()&e)OTw_1@5|IvGIC0{Hu;*R7 zcA0!F%b(Y8)-(S0zJLEda&vQqEa}@9o}Qkp{~6TYZT$Vkzv zQ&UqhWXKTVPg%AcFP%Ggu81eGjj+%4_VxzFuo*Xhdp)LpP*d0&@P9(jTnGybLrqOh z>mXk73D%kO=g(vQ{P_ac;K751JuqEfBhu2+kdcvrxVShBA3mIM*EGnTx|hG*<^0gI z4ivw-o0ynr+Kas+%$J5qxEC#2B>X7%6DLj-dsJ!P$NScc7cXMjvSk=FXpn^4m2m$> zje3qjCjqv{);XlReyL9|B;Ffro<7Z#QHt;6PTf!~% zjGuhbDc&P4UAk1hUcOO!BH?Y^6aIIpCDWQvLH>I$@$yfBTh0gJ|1WBNslAlLkw5om zog3{?p#W4}0q)D+GxnixiQb@4EamGeg`z9>@i||69q(@G9Yo_D zB^?wy-b}vc5wEx0_?)ltJ$|O8cf88I2D+9+Bave7PxA8ez&ZcKE#J{M@j_5`Ox}q@L z0!bm(NS$p>F-UX7PIt!2@Q&eVitaNLzY$n9-35h_HmKe^68ddQq|LRa#&Kmc)NZw+ zn64$Fr#WNAE8rl%{|Uu2HcRs>(Onx8iP#_)oQ|?Z&4CFb_O2~i4-Mr#)4sM5jq{qE zf7BPpp(dGPcUX%x`>b1lG)S z#aYS))g7G+!;M3tj)ZfHniC5}zEDnIc45}mXM|F}Vio(qhF}XjY!WSd!;31A5UF^}LhshiDwYBf; zLkYvhPK0kSb#sIA5s0um*Lx z!8k|xi&?(*nC9bzW1&i84tcu`<>Y1gSI#kg*Q+6CUj}u?P^tqnr@9G;5~kTC{ruU2 zN3I9px(glCr>3PEteP}8oR02KHa39#&vGn}h{USs7$mHXL*#T%M zZ{7@!$7yKKT=vs7#IK3LiXcxEgjrB7x&a5}+SEs8K!4{X)M-wl4z79nW>jZ36Z&5c zLU())sY^G|c5%Nl{I>=2q$3xrK^!O95YS4MZ$s#PKec>MTr)YjID zJQsg+^4^;aZZ%ut4EI>71;P$IgW&HqY)eIi8B!v_+^a+m{vEL{`KwGzw;nhhmu(V zZf&M(0zfBRgT?W>oSYmHV`tfLoU}2H4Qrzj9_WQ3?v5o&+x{l~H#aluJj~m>uKfHKfHHaiamc-(x*=!6aDVpyLYB~tPl$ym>#LGugA%gCxwo3+?(f!X%S76|E2Zl->DY;6xS3K z6cnJnbWOzQglnleH_mw)uB~7_;CSSoJ$pnvmEu*LGtacKv7uf3?+0NBB0ExZj^tGj z{^sZW3+JZ-0|P~kH_J0NHdg#59&70vZy&W@zf(4z_3hjDFLZxHN(%WrovvLFSjL>2 z;kpverH6)wB0W7_*eCN&ziTL;l1blYZq%BMds|vs{wJ-?xvU3mIplPi_L(zh1ooXf zcM2V%8uuE?6=c%>+>P|DS-Nsr(6e9o`T1S>;fEiZh0qjT)@^Q#f#OIt^j(l?ZEf9V zx^fIO&SU1xnU5blc<=&-*632~LGWv9YwJdH+$MhIbft6JhrUJnID=$b&pwv*N}69u z&T@Vwy6us(M60=;z9HTpIB?)v@pnu9QRjnSBPwW~KRU;CJ8a^eU`0GUWSR5Q2Tt|Hd{dR4u9ZB!#NKgLgZL*_LWDmoL z?jI7@fnljJL{m<21q#h@ScXF~;pZ#C0*)ymkeB8||%Fz2@6A`aW@__q?z^@e5_+(y6|vGJEGHoZK`8*`fV# zB(yII6Z~*s$2wl?D(OAx#`km*@A>e<|9F4tvanbhSCzYK6AHJ^!M(#vp*t0ZOR@c^ zHq;WjVf(zb^~o6&T|P7K-(}xIn=+=U zznO!og5@aLG!jQr!mu?l0VzqFk(W$+)i`H7-`EqHJ%hmiL$L1~tFq6CHn&U~UwJ49 z7m@>UIB6Mj4`t$Tb}kMbI*eGV`N-I}ANhIN$lJOEr3qfBOm#x$0^|7JmUdmDgWSpv zZeEC-gFG$=Tsy_Sf%COo3&v}AUfxmUv&$RrFL=Mj`=ldBj))os%1PFe&)-jDJ$m-+ z`B%9zPna-aH2Fdi?UTmwzL(eCqN1W&s-4+S^&}n?Q+Q#V>>cmW9x;^m7&@*&;cQk{5REw+#q^&G%l0IxwmDU^n!l<`gNxIh6Ku)`OvsF h`8C5*ilug?xGz~#=vytf0(z#LpQSNXP$=rD{Xf!nWnKUP literal 0 HcmV?d00001 diff --git a/index.md b/index.md index 4e8e9ae..0036de1 100644 --- a/index.md +++ b/index.md @@ -32,7 +32,7 @@ A practical explanation of how weak entropy can ruin your day - and your savings - Popular documentation like "[Mastering Bitcoin](https://bitcoinbook.info)" suggests the usage of `bx seed` for wallet generation. - Secure cryptography requires a source of large, non-guessable numbers. If the random number generator is weak, the resulting cryptographic usage is almost always compromised. - For technical people: in this case, practical wallet security is reduced from 128 bit, 192 bit or 256 bit to a mere 32 bit of unknown key information. -- A 32 bit key space is 2^32, or 4,294,967,296 different unique combinations of derived [BIP39]((https://en.bitcoin.it/wiki/BIP_0039)) mnemonic phrases or other key formats ([BIP32](https://en.bitcoin.it/wiki/BIP_0032)). Spoiler: That's not as many combinations as it sounds. +- A 32 bit key space is 2^32, or 4,294,967,296 different unique combinations of derived [BIP39](https://en.bitcoin.it/wiki/BIP_0039) mnemonic phrases or other key formats ([BIP32](https://en.bitcoin.it/wiki/BIP_0032)). Spoiler: That's not as many combinations as it sounds. - With enough optimizations, a decent gaming PC can do a brute-force search through 2^32 wallet combinations in less than a day. - Since `bx` has a configurable output length and can be used in several ways, there are a few variations the attacker needs to test for each case. This slows down practical attacks to a few days. - Once an attacker finds a match of a wallet candidate with an actual wallet used on a blockchain, they are in full possession of the private keys and can steal remaining funds, trace all previous wallet history and sign messages. diff --git a/robots.txt b/robots.txt new file mode 100644 index 0000000..4f9540b --- /dev/null +++ b/robots.txt @@ -0,0 +1 @@ +User-agent: * \ No newline at end of file