Cos(余弦)😶🌫️ (@evilcos) “所以 @secondfiapp 把 Ed25519 签名中的机密 k 值变相暴露了？ 正确做法： k = SHA512” — TopicDigg
Cos(余弦)😶🌫️
@evilcos
Founder of @SlowMist_Team // 分身一号/捉虫大师/救火运动员 // 🕖灾备频道
加入 November 2008
1.5K 正在关注 123.9K 粉丝
所以 @secondfiapp 把 Ed25519 签名中的机密 k 值变相暴露了？
正确做法：
k = SHA512(secret_prefix || message) mod L
SecondFi 做法：
k = SHA512(M) mod L
只要用户签过一笔交易（这里是 tx_hash），M 任何人可以得到，于是 k 值也就知道，接着根据公式：
S = k + H(R || A || M) · a mod L
简单说，大写的全可以公开已知，k 也已知，a 这个等同于有私钥能力的机密信息也就可以轻易解出了…攻击者拿到 a 即有能力完成对应资产的转移。
开眼了。
显示更多
One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid this is. And nonce reuse is historically the stupidest thing so they got crossed in my heads.
I got the other one right, so I'll repeat it now:
These guys rolled their own crypto so fucking hard that anyone could get your private key from public information.
Cardano should stop obsessing over whether this is a Cardano hack and realize that THIS IS INSANE. Fucking up the nonces is common with ECDSA. It is NOT EdDSA/Ed25519. This shit was intentionally DESIGNED to eliminate the footguns that are common with EDCSA.
It took WORK for the developers of this wallet to accomplish this. Using the standard crypto libs—which are used by all wallets in a sane universe—would NOT result in this issue.
If you are building a wallet and cant get the bare minimum correct, you deserve to die a violent and bloody death.
NO ONE should not expect someone who cannot even walk to be able to run, jump, skip, hop, etc. And ALL of those skills are necessary when building a wallet in this adversarial ass space.
This must be the end of Emurgo/SecondFi/Yoroi. If you forgive and forget, you are sealing your own fate and being willfully fucking retarded.
显示更多
