From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194] helo=mx.sourceforge.net) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1WPC6A-0000zt-I9 for bitcoin-development@lists.sourceforge.net; Sun, 16 Mar 2014 14:31:34 +0000 Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmx.de designates 212.227.17.21 as permitted sender) client-ip=212.227.17.21; envelope-from=thomasv1@gmx.de; helo=mout.gmx.net; Received: from mout.gmx.net ([212.227.17.21]) by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.76) id 1WPC69-00087T-Au for bitcoin-development@lists.sourceforge.net; Sun, 16 Mar 2014 14:31:34 +0000 Received: from [192.168.1.27] ([84.101.32.222]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0Lj61K-1WzuUK1jag-00dEKQ for ; Sun, 16 Mar 2014 15:31:27 +0100 Message-ID: <5325B5BC.3030501@gmx.de> Date: Sun, 16 Mar 2014 15:31:24 +0100 From: Thomas Voegtlin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Bitcoin Development References: <5325A61B.6050802@gmx.de> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Provags-ID: V03:K0:A8Rf5HMcwzTRgGOUxfV3cg+4MoaLqjjzZEW1MPd070KvCpMU6+g Juu4nA7hVGsLWsatjEJQ5NEyYWkUR/uO2F6+tsWQH9U35uCOIcaeLsLQ0gDCGr/XmdcT0U/ OBSQ5jI2kMYLR+Wfg1uR0eVPMqi7miHHtM75b4wce2ApUaaby1Gow2SKfrxWOa6O8TbJ3ax C0lYvMrgYGuH1MLLBoX9A== X-Spam-Score: -1.2 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.227.17.21 listed in list.dnswl.org] -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (thomasv1[at]gmx.de) -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (thomasv1[at]gmx.de) X-Headers-End: 1WPC69-00087T-Au Subject: Re: [Bitcoin-development] Electrum 1.9.8 release X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Mar 2014 14:31:34 -0000 thanks for your feedback! I was not aware that that implementation was flawed. I will see how I can fix that code and get back to you. Thomas Le 16/03/2014 14:54, Gregory Maxwell a écrit : > On Sun, Mar 16, 2014 at 6:24 AM, Thomas Voegtlin wrote: >> The encryption algorithm is ECIES, and code was was borrowed from >> https://github.com/jackjack-jj/jeeq. In order to know the public >> key corresponding to a Bitcoin address in your wallet, you can use >> the 'getpubkeys' command. The 'decrypt' command assumes that the >> wallet has the private key corresponding to the public key passed as >> argument. > The cryptosystem in that repository appears to be insecure in several > ways and is not actually implementing ECIES. > > The most important of which is that instead of using a > cryptographically strong mac tied to the ephemeral secret it uses a > trivial 16 bit check value. This means that that I can decode an > arbitrary message encrypted to a third person if they allow me to make > no more than 65536 queries to a decryption oracle to decrypt some > other message. > > Also, in the event that a random query to a decryption oracle yields a > result (1:2^16 times) the result directly reveals the ECDH value > because it is only additively combined with the message value. If the > implementation does not check if the nonce point is on the curve (an > easy implementation mistake) the result can yield a point on the twist > instead of the curve which is far more vulnerable to recovery of the > private key. ECIES uses a KDF instead of using the ECDH result > directly to avoid this. > > There may be other problems (or mitigating factors) as it was very > hard for me to follow what it was actually doing. > > (The particular implementation has a number of other issues, like > apparently not using a cryptographically strong RNG for its EC nonce.. > but I assume you didn't copy that particular flaw)