Bitcoin Transaction Malleability explained posted February 2014
Wonderful blog post from Ken Shirriff again ! Read more here
comment on this storyHey! I'm David, the author of the Real-World Cryptography book. I was previously a crypto architect at O(1) Labs (working on the Mina cryptocurrency), before that I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.
Quick access to articles on this page:
more on the next page...
Wonderful blog post from Ken Shirriff again ! Read more here
comment on this storyThe transaction malleability problem which troubled Mtgox a few days ago has also made Bitstamp shutdown.
Apparently a large scale attack using this problem is going on on multiple exchanges.
Antonopoulos, who is the chief security officer of Blockchain.info, said a DDoS attack is taking Bitcoin’s transaction malleability problem and applying it to many transactions in the network, simultaneously.
It's interesting to watch actually, submit a transaction to the network at the moment and there's a rogue node that will mess with the padding of the signatures and rebroadcast it faster than the original. It confuses the reference client into duplicate display, which is what Gox is relying on for the failed/success display. That they're winning races over the normal related transactions isn't that unnatural as the transaction processing stuff has a 100ms sleep() in the middle of it.
From the discussion over at HN
PS : apparemment l'erreur a été corrigé il y a un an sur le client bitcoin officiel ici
comment on this storyMtgox, which is frozen while it is trying to fix its problems, has issued a press released explaining what is the problem
comment on this storyBitcoin transactions are subject to a design issue that has been largely ignored, while known to at least a part of the Bitcoin core developers and mentioned on the BitcoinTalk forums. This defect, known as "transaction malleability" makes it possible for a third party to alter the hash of any freshly issued transaction without invalidating the signature, hence resulting in a similar transaction under a different hash. Of course only one of the two transactions can be validated. However, if the party who altered the transaction is fast enough, for example with a direct connection to different mining pools, or has even a small amount of mining power, it can easily cause the transaction hash alteration to be committed to the blockchain.
The The Open Web Application Security Project (OWASP) has just released several handy cheat sheet about security in diverse languages, situations, platforms... you name it.
comment on this storycomment on this storyThis is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private repositories on Github.
Question on superuser.com : Why are people so bothered about truly random numbers instead of ones generated by a program?
comment on this storyKen Shirriff has posted an amazing post on his blog on how he managed to manually make (meaning, he didn't use the official bitcoin application) a transaction in the bitcoin ecosystem.
I'm reading through it as I'm typing this, and it's really well explained, you get to see exactly what he does in Python and there are pictures!
comment on this storyJean-Jacques Quisquater, a renowned Belgian professor in cryptography got his computer hacked, seems like NSA has something to do about it.
comment on this storyMy book Real-World Cryptography is finished and shipping! You can purchase it here.
If you don't know where to start, you might want to check these popular articles:
Here are the latest links posted:
You can also suggest a link.