OrangeSurf

What is the nonce key exfiltration attack?
When signing a bitcoin transaction a number is used to generate the signature, this number is used once, and is therefore called the nonce.
This should be a cryptographically secure random number, which is never reused.
Suppose an attacker compromises your signing device, and can get it to use a particular nonce, rather than a random number.
If they use part of your private key as the nonce, they can leak part of your private key out of your signing device with each transaction you sign and broadcast.
If you make enough transactions, they can reconstruct your whole private key, and steal your bitcoin, just by watching the bitcoin transactions being made and decoding each part of the private key.
They don't need to compromise your computer, or physically access your device, and all the while your signing device appears to be working correctly, up until all your bitcoin is stolen.
There have recently been two new papers expanding on this attack.
- Dark Skippy by Lloyd Fournier, Nick Farrow of FrostsnapTech and Robin Linus of ZeroSync and BitVM.
- Engineering a backdoored bitcoin wallet by Adam Scott and Sean Andersen at block
I think it's great that these researchers have raised attention to this previously known attack vector.
Now, there are two types of reaction in my x feed on this issue, panic and ambivalence.
⚠️ Reaction 1 - Panicked
Nonce key exfil would enable theft at a distance, on all devices that update to malicious firmware & make 12 transactions. The attack doesn't require compromising the online device the signer talks to. The attack is not mitigated on most signing devices, and therefore large amounts of bitcoin are potentially vulnerable. The attack would be undetectable until the thieving begins
🤷‍♂️ Reaction 2 - Ambivalent
This attack requires getting malicious firmware onto a device. Competent signing device firmware devs secure firmware signing key(s) appropriately. Provided the firmware signing keys are not compromised this attack is mitigated because most signing devices check new firmware signatures before upgrading. Malicious firmware would enable many other attacks like generation of compromised wallets or exfiltration of keys in other ways (via screen, microSD or USB).
I think both Panic and Ambivalence are extreme.
❌ Panicked - Most hardware wallets verify firmware signatures so this attack requires either malicious firmware or a compromised firmware signing key / build pipeline and for many transactions to be signed with that firmware. Anti-klepto requires the online wallet to participate and adoption is limited. Creating panic leads uninformed users to rush to move their bitcoin to a new setup and this is when mistakes happen.
❌ Ambivalent - This attack is particularly nefarious because it can be done at a distance without needing to compromise any other user devices which makes it very scalable. If any firmware release is compromised all devices that run that version will be compromised. How secure is your signing key? How secure is your build pipeline? If anti-klepto was widely supported you would probably use it, so let's get it widely supported.
💡 Constructive - Focus effort into adding anti-klepto to a new version of PSBT instead of taking shots at each other or dismissing concerns.

2024-08-13 14:40:45

Using the public @npub18d4…6lt3 accelerator API you can now fetch a lightning invoice to boost any transaction.
Integrate into your app / service today.
https://m.primal.net/JyUE.mp4

2024-08-03 15:43:20

- reply

Testnet4.com

2024-08-02 16:34:32

Bitcoin Core #30275 changed the default mode of the estimatesmartfee RPC command from conservative to economical.
https://github.com/bitcoin/bitcoin/pull/30275

2024-08-02 12:34:10

Bitcoin Core #30275 changed the default mode of the estimatesmartfee RPC command from conservative to economical.
https://github.com/bitcoin/bitcoin/pull/30275

2024-08-01 14:40:17

- reply

Yes many use cases, I listed some here. I’m glad we are building one which is transparent
https://mempool.space/accelerator#why-not-use-rbf-or-cpfp

2024-08-01 08:12:37

- reply

You should always use RBF or CPFP if you can, and if it makes sense for your use case.

2024-08-01 08:10:44

Replace By Fee (RBF)
The sender in an unconfirmed transaction creates a new, higher fee transaction spending some of the same inputs as the transaction being replaced. Often the new transaction will be confirmed instead of the original transaction.
Child Pays for Parent (CPFP)
 The recipient in an unconfirmed transaction spends their unconfirmed transaction output, increasing the effective fee of the original transaction. A miner can't confirm the new (child) transaction without also confirming the original (parent) transaction.

2024-07-31 21:30:49

Am I alone in preferring mobile wallets that do one thing well? I would happily have at least 7 wallets
- Managing Lightning Channels
- Making Lightning Payments
- Receiving Lightning Payments
- Making Onchain Payments
- Generating invoices to cold storage
- Generating invoices to a hot wallet
- Receiving Silent Payments

2024-07-31 20:28:34

Ideally you would run multiple bitcoin core nodes of differing versions and your wallet would connect to all and report discrepancies. Update to the latest release AND run tried and tested versions.
Who is building this?

2024-07-29 17:54:12

“the US Gov isn’t dumping, it’s just going to the strategic bitcoin reserve”
https://mempool.space/tx/876d9ef6bb2bcd8a1e8a176212ad58764454ebb3c6db77334f8a7ad69e954d86
https://m.primal.net/JiFz.jpg

2024-07-29 14:25:04

"no, wait, testnet4 branch isn't merged into core yet, you cant just start mining and integrating it into wallets and services"
cypherpunks write code
https://testnet4.com

2024-07-27 21:56:21

FYI you can start using testnet4 today!
Visit testnet4.com to find
- An explorer and faucet for free coins (@`mempool`)
- The first wallet to integrate (Sparrow Wallet)
- Github Issues tracking integration in bitcoin core, rustBitcoin, bdk and fulcrum
Bitcoin's testnet provides a risk-free environment for miners, developers, and users to experiment with Bitcoin software. Unlike the main Bitcoin network, where real value is at stake, the testnet has its own coins (tBTC) which hold no real-world value. This means anyone can test without the fear of financial loss.
To be useful for testing, users and developers need to be able to easily acquire testnet coins, this was no longer possible with the old testnet3 network. Coin issuance had almost completely dried up and the coins were starting to trade on secondary markets.
In response to these issues, a transition to a new testnet (testnet4) is underway. This new version promises a more stable and accessible environment for testing, with ample tBTC available via faucets.
https://testnet4.com

2024-07-27 21:20:23

So, a strategic bitcoin reserve?
https://strategicbitcoinreserve.com

2024-07-27 16:20:29

Why would you use Mempool Accelerator when you can use RBF or CPFP? Read here:
https://mempool.space/accelerator#why-not-use-rbf-or-cpfp

2024-07-26 14:41:25

- reply

Denominated in fiat, payment in bitcoin.

2024-07-26 12:36:00

A very limited batch of the display stand I designed for @npub1s0v…pq6j Passport is available for purchase at BTC2024 in Nashville for $20.
Pick one up at booth 211. If you are not at the event and want to get your hands on one register your interest at the link below or send me a message.
https://tips.orange.surf/apps/37e8jKpHw5g7fmS5csD5bBLeg53r/pos
https://m.primal.net/JfCr.png

2024-07-24 08:23:47

- reply

Sorry to hear that you are disillusioned.
IMO the current state of hardware wallets is actually great (if you can put the bickering aside).
There are many design directions being explored by teams with different priorities making products that target different users and use cases.

2024-07-24 07:19:29

The cryptographic integrity of messages posted on nostr is a huge step forwards compared to platforms like x.
What progress has been made regarding key rotation?

2024-07-24 07:12:12

Foundry announces Foundry Donate enabling their miners to automatically donate a proportion of their mining rewards to Brink or OpenSats.
https://www.prnewswire.com/news-releases/foundry-announces-foundry-donate-initiative-to-support-open-source-bitcoin-community-302203616.html

2024-07-24 07:05:38

Bitaxe solo mining tutorial.
Great video production quality, excited to see more from these guys.
https://www.youtube.com/watch?v=InfDHmFQcsE

2024-07-13 13:05:13

#note1llg…jfrt
https://m.primal.net/JPMT.jpg

2024-07-13 12:25:30

This transaction spent 2 months languishing in the mempool.
Just got confirmed 24 minutes after using @mempool accelerator
https://mempool.space/tx/cba384b5e5e948a7dc888a144739489f6c623ec7d37bb0fe69f650837b5ec82c
https://m.primal.net/JPKi.png

2024-07-13 12:08:27

Transaction confirmed just 33 seconds after using @npub18d4…6lt3 Accelerator!
If you have any questions reply 👇
https://m.primal.net/JPJy.png

2024-07-04 17:59:16

Why are empty blocks happening?
https://stephanlivera.com/episode/588/

2024-06-06 06:23:45

- reply

@npub1m7q…m4gz

2024-06-06 06:21:47

Follow mempool research on nostr!
npub1m7qjg4hsa2q32rtekewpdn54guh508tlh6ztml7ssluj6vgflensy6m4gz

2024-06-05 14:51:20

We just published the first mempool research report
📜 The Empty Block Report 📜
https://research.mempool.space/empty-block-report/

2024-05-11 19:04:39

- reply

Thank you!

2024-05-10 21:40:22

https://orange.surf/dude-wheres-my-block/

2024-05-10 16:24:58

Braiins just had a huge streak of bad luck with ZERO blocks found in 551 attempts! 🎲🚫 What are the odds?
https://orange.surf/dude-wheres-my-block/

2024-05-07 23:30:04

FPPS transfers profit volatility from hashers to the pool operator.
Building on the great work by BitMEXResearch I explore how pool size correlates to the reserve funds required to obtain a particular statistical chance of survival.
https://orange.surf/pool-reserves/

2024-04-23 20:05:26

Update to 840556 https://image.nostr.build/67650d487e620577cff5878490367dcd433268c446504d5ac4aa07915ac67454.jpg

2024-04-22 23:18:55

pick your opt-in numbering system hill to die on
https://m.primal.net/HynN.png

2024-04-21 10:52:33

Update to 840195
https://m.primal.net/HyLf.png

2024-04-20 20:49:41

the blockchain is healing
https://m.primal.net/Hxzm.png

2024-04-20 14:17:18

Updatehttps://m.primal.net/HxpX.png

2024-04-20 09:36:24

Update
https://m.primal.net/Hxll.png

2024-04-20 02:08:43

Welcome to the 5th Epoch https://image.nostr.build/2c8b0aa15a2df034a42b85923e0ffabbd71317cbbec17a57d49f92193e4a60eb.jpg

2024-04-16 18:59:14

At least 97.7 % of hashrate (monthly average) is now running FullRBF based on FullRBF'd transactions from within the past 24 hours.
https://gist.github.com/orangesurf/6483e26e78632ab60e588d56f79e0050

2024-04-10 08:33:12

@npub1qtv…7dze what's the difference between 'old hashrate' (light blue) and 'hashrate' (dark blue)
https://m.primal.net/HtIb.png

2024-04-09 11:19:46

This is what a freedom looks like. #note1jde…zryr

2024-04-08 20:39:40

- reply

Thank you very much for sharing this

2024-03-18 14:08:06

- reply

easiest (but not easy) may be coercion of large mining pools.
You would hope that the unconstrained miners pointing hashrate at the coerced pools would pull their hash and direct it at other pools, quickly halting the 51% attack, though that requires monitoring to detect shenanigans
other contenders
- hardware backdoors to allow remote hash halting
- stuxnet style mining worm
https://m.primal.net/HmEE.jpg

2024-03-13 02:27:20

- reply

Full video https://www.youtube.com/watch?v=Zrv1EDIqHkY

2024-03-13 02:27:03

big prime energy
https://m.primal.net/HkLo.mp4

2024-03-11 18:06:34

I enjoyed this chat. It had something for everyone.
https://www.youtube.com/watch?v=Nzvh4AODtWc

2024-03-11 14:40:14

- reply

262,800 blocks

2024-03-11 06:59:53

- reply

check the "legit" list here
https://bitaxe.org/legit.html

2024-03-07 19:05:35

- reply

wow, anything special about your node which would cause such a high useage?

2024-03-07 09:41:35

- reply

So, wait...
Until you get a confirmation you haven't consolidated anything 😉

2024-03-07 08:43:49

Flat 13's.
What's your call, consolidation now or wait for lower (single digit) bid rates
https://m.primal.net/HiWd.png

2024-03-07 08:27:59

- reply

few
https://m.primal.net/HiWY.mp4

2024-03-07 08:25:59

- reply

Pear is licensed under Apache V2
https://github.com/holepunchto/pear?tab=Apache-2.0-1-ov-file#readme

2024-03-07 08:09:48

- reply

Things have changed so much since I first ran branle in Apr 2022. Glad to be back 🫡

2024-03-07 05:52:00

- reply

That's awesome. Love to hear it
Can you share a photo?

2024-03-06 22:10:06

3 days on nostr, finding lots of new people to follow. it's much busier than I realised, hope to keep discovering more interesting content.

2024-03-06 21:53:13

- reply

https://m.primal.net/HiQX.jpg

2024-03-06 14:40:32

- reply

Thank you, this is fantastic. I verify when I help friends install sparrow but they are normally afraid to update because they fear the command line.
Now they can update with confidence.
https://m.primal.net/HiKN.png

2024-03-06 07:03:03

- reply

Vasili Alexandrovich Arkhipov
In 1962 the USSR sent a nuclear armed submarine to the international waters off Cuba. The sub was located by the US Navy and depth charges were dropped to force the sub to surface.
At depth the crew had been out of communication with Moscow for days and feared that war had broken out.
The captain wanted to launch a nuclear torpedo.
Launch required a 3 of 3 signoff from the captain, the political officer and Arkhipov (the executive officer, who was chief of staff of the brigade).
Arkhipov refused to authorise the attack, and persuaded the captain to surface and await orders.
Had Arkhipov not refused, there is a high probability that the USSR would have made a nuclear strike against the US Navy, which could quickly have led to thermonuclear war which would have killed billions.

2024-03-05 20:34:23

- reply

Based

2024-03-05 20:08:28

- reply

Delete this

2024-03-05 19:36:42

research e-gold before running an ecash mint

2024-03-04 20:04:24

"I wanted something that expressed the fun I had using the internet, as well as hit on the skill, and yes, endurance necessary to use it well.
I also needed something that would evoke a sense of randomness, chaos, and even danger. I wanted something fishy, net-like, nautical."
- The women who coined the expression 'Surfing the Internet'
🤙
https://www.surfertoday.com/surfing/the-woman-who-coined-the-expression-surfing-the-internet
https://gutenberg.org/cache/epub/49/pg49-images.html

2024-03-04 18:17:34

Chart watching. Not that chart.
https://m.primal.net/Hhgx.png

2024-03-04 16:27:23

best of day 2 of nostr.
zapping the zap.stream dev while streaming a live zap.stream of him developing zap.stream

2024-03-04 09:39:15

- reply

how much for the ICO?

2024-03-04 09:01:43

- reply

👍 mempool based estimation is the way

2024-03-04 09:00:54

- reply

What if you had to make a transaction more urgently?

2024-03-03 22:15:14

how do you pick your fee rate anon?

2024-03-03 10:34:53

- reply

Thank you for continuing to state this so clearly.
What changes do you hope to see at the protocol level?

2024-03-02 13:23:45

- reply

Which conferences still have a no photo policy?
Disappointed at the number of photos of the crowd in madeira.

2024-03-02 13:18:24

I have tried nostr on and off for many years.
It's time to try again.
Relay list refreshed, LFG

2024-02-22 22:20:35

Only the higher bid
Stops transactions not desired
Silence your protest.
https://m.primal.net/HeYz.png

2024-02-15 22:29:35

If you can write down 12 words you can enter 99 real dice rolls.
That said, tools which allow you to enter dice rolls should prevent you from accidentally entering too few rolls and generating an insecure seed.
The instructions are simple.
1. Enter 99 real dice rolls.
2. Optional: First enter 99 dice rolls on the signing device AND a tool like BitcoinQ_A's seed tool to check they match. IF they do match, RESET the signing device and enter 99 NEW dice rolls ONLY on the signing device (and NOT on any other device).
If you do the optional step of verifying you can sleep well at night without wondering whether the device random number generation was random, without needing to verify both the firmware and the hardware.
What about Coldcard, I read that users lost funds?
Although Coldcard is not FOSS you can view the source code to see exactly what the bug was and how it was fixed.
There was a warning since the dice rolls feature was added in 2019, but users could (and did) override this. https://github.com/Coldcard/firmware/blame/5527d5b399c4056089ab97363e71aaaa4ae53ae6/shared/seed.py#L343
An Enforcement & Distribution Check was added with firmware from v5.1.0, 2023-02-27 which is available only for the MK4 https://github.com/Coldcard/firmware/commit/2bbe27fa52e940bfef2a0a42b290c23e2d93b6db
https://m.primal.net/HdDQ.png
This is not a hypothetical problem. Here is a very unfortunate example of a user who made the error of ignoring the warning screen, which resulted in lost bitcoin. IMO fixes like this should be included in firmware updates for old models unless there is a technical limitation which makes this impractical.
https://m.primal.net/HdDP.png

2024-02-15 13:09:55

- reply

zapped for UTC

2024-02-13 19:09:24

Before bitcoin core v0.7.0 the default transaction selection algorithm was to pack transactions sorted by transaction priority, where priority was equal to the coin age (in blocks) multiplied by the spent value, divided by the transaction size.
The default policy also set a minimum transaction fee that increased as the space in blocks grew closer to the blocksize limit.
https://m.primal.net/HccC.png

2024-02-13 04:23:27

There are plenty of Whirlpool Surge Cycles taking advantage of the drop in fee rates following a brief spike.
https://m.primal.net/HcTD.jpg
https://m.primal.net/HcTE.jpg

2024-02-12 13:53:37

What software / services in use today rely on the immutability of txids?

2024-02-12 12:31:32

Fee Rate over the past 6 weeks
1 day rolling average
https://m.primal.net/HcML.png
14 day rolling average
https://m.primal.net/HcMM.png

2024-02-03 18:29:14

https://m.primal.net/HaaB.jpg

2024-02-03 17:43:21

- reply

trust the chart, give it time

2024-02-01 07:47:17

- reply

2 Year View & All Time View
https://m.primal.net/HaFC.jpg
https://m.primal.net/HaFD.jpg

2024-02-01 07:40:47

Good job you didn't panic and consolidate at high fee rates over the past 6 weeks.
https://m.primal.net/HaFA.jpg

2024-01-07 10:30:12

What is your favourite bitcoin wallet, app, product or service which leverages Bitcoin Timelocks?

2024-01-06 23:20:58

Out of band payments to miners are the market mitigating an inefficiency which exists as a result of policy rules which are (rightly) designed to protect nodes from DOS attacks.
Personally I am very supportive of bitcoin developers efforts to resolve these inefficiencies in a decentralised way. I also think that there are often advantages afforded by centralised systems (which of course come with trade offs), which can be leveraged by those who opt-in to using them.
Without the need to make onchain transactions there is the potential to fee bump awkward transactions (which can't be bumped easily by other means today) without overpaying. Examples of such awkward transactions include;
- geographically separated multisig where the signing process may take many days / weeks from start to end
- channel close transactions with a fee rate below the purge rate
- tx's sent from wallets without RBF/CPFP tooling
Past and current transaction prioritisation tools leave much to be desired;
- opaque fees and terms
- limited access for users and miners / pools
- private acceleration bids (prior to confirmation) meaning counter bids cannot be made
- private acceleration fees (after confirmation) making it hard for miners in pools to audit whether out of band payments are being collected
I believe that a transparent alternative is possible with
- clear fees and terms
- wider access for users and miners / pools
- public acceleration data for both bids and fees
Because I believe this I am working to help deliver
@Mempool
Accelerator, which I hope will demonstrate that such a radically transparent alternative is possible.
The block audit feature was the first step in this journey, providing bitcoiners with the tools to detect likely OOB payments, including those made by mempool.
If you have a specific use case for Mempool Accelerator i'd love to hear about it.
email orangesurf at mempool dot space
matrix orangesurf:bitcoin.kyoto

2024-01-06 21:59:50

- reply

Ackchyually.... it's the D'cent Biometric
https://m.primal.net/HWpE.png

2024-01-06 15:19:57

- reply

With wallet vendor
1) Onekey, Onekey Touch
2) Ledger, Ledger Nano S
3) Bitbox, Bitbox02
4) Dorj, Dorj T
5) D'CENT, D'CENT Biometric
6) Safepal, Safepal S1
7) KeepKey, Keepkey (Original)
8) Ledger, Ledger Nano X
9) Foundation Devices, Passport (Batch 2)
10) CoolWallet, CoolWallet S
11) SecurX, SecuX W20
12) Ledger, Ledger Stax
13) Trezor, Trezor Model T
14) Blockstream, Blockstream Jade Hardware Wallet
15) BC Vault, BC Vault ONE
16) Dorj, DorjOne-Plus
17) Ledger, Ledger Nano S Plus
18) Ellipal, ELLIPAL Titan 2)0 Cold Wallet
19) Trezor, Trezor Model One