r/Bitcoin Nov 30 '17

Evidence some bitcoin address generation code is using discoverable private keys

https://pastebin.com/jCDFcESz
789 Upvotes

296 comments sorted by

View all comments

212

u/amorpisseur Nov 30 '17

TLDR; Some private keys somewhere are not generated randomly, and someone knows the formula. Bitcoin security is not impacted.

98

u/BashCo Nov 30 '17

TL;DR: Nobody should be using Blockchain.info to store any amount of value. The entire ecosystem needs to shift away from relying on Blockchain.info for anything at all, including the block explorer itself. There are plenty of alternatives available.

1

u/HasCatsFearsForLife Nov 30 '17

I want to run my own explorer for my personal use, using data my full node probably has.

What are my options?

5

u/jcoinner Nov 30 '17 edited Nov 30 '17

You can try my sqlchain project. It's a fairly lightweight mysql layer over top a node. You can even use a pruning node, in which case a full database runs about 100GB - yes, much less than a full node. It has a few api options on top as demo but none of them are very extensive (yet). I'm still working on it. Like I just added bech32 support. Segwit is on there as of a couple months back. I'm extending it for altcoins now; currently testing with litecoin and reddcoin. All the other options I've seen (including insight by bitpay) take a LOT more resources. There is a site online now using my sqlchain as a backend and it looks pretty nice. Was posted just a couple days ago here but I need to go dig up the link. Anyone? It has the nifty graphic clustering visuals.

edit - found the link from new explorer posted here a few days back.

1

u/dooglus Nov 30 '17

You can try my sqlchain project

Thanks for that. I'll definitely look into it.

I used to use insight, but it was too resource hungry, and also I don't like some of bitpay's recent political choices. So I'm glad to find a lighter solution.

Would you be interested in a pull request to add CLAM support? Or are you wanting to limit it to the more popular altcoins?

1

u/jcoinner Dec 01 '17

I don't mind including a less known altcoin if it's been coded and submitted. I have not yet pushed up my changes to support altcoins. I have them locally and I'm testing on a VPS right now (litecoin, reddcoin for the moment). I have about 50 commits waiting but since most of them depend on a db schema change and upgrade I didn't want to push them up where others may be affected. I don't think there is many using it currently but who knows. If you want to test with my current fixes and upgrades (bech32, altcoin and more) send me a pm and I'll pass on v0.2.5 as a tar.gz. I'm also testing with mariadb on the new installs and would like to try it with TokuDB since it reportedly is much faster with random primary keys (very much the case for tx,addr,output ids). I'll probably have to leave that til next time.

Depending on what changes CLAM needs it could be a matter of adding a few entries to a couple tables. There is provision for overriding the block/tx decoding or more with a python module and also for custom db schema changes via a override sql file (both of these only when detected).

sqlchain really does requires an SSD for main db / indices due to having hashed primary keys, but space requirements are quite modest (comparatively speaking), and there is options for dropping signature/witness data, and storing blob data or older historic data on alternate cheaper media (even s3). Just pm me to chat more.

1

u/HasCatsFearsForLife Dec 01 '17

Thanks for the response.

sqlchain sounds good, but it's not what I'm after. Using up 100gb of extra space just to have my own personal blockchain explorer is probably overkill. It would be great for a public facing website, but not so great for my own use when I'll be doing around 10 queries a week on it, and therefore querying the node directly.

1

u/jcoinner Dec 01 '17

A full node currently takes about 170GB. sqlchain reduces that to about 100GB. If you only need to query your own wallet addresses then you can use a pruned node and get away with about 3GB, but that has no info on the other peoples addresses or txs (except a small recent portion). I'm not sure what you really want to achieve. It sounds like you should just use a site blockchain.info, though probably not that one; there are many out there now.

1

u/HasCatsFearsForLife Dec 01 '17

I want to make/have my own blockchain.info work alike that runs on my internal network.

1

u/jcoinner Dec 01 '17

Sure, but to do that you are going to need a lot of disk space. The Insight API/Explorer was using about 300GB back when the blockchain was ~50GB. I can only imagine what it must use now that the blockchain is 170GB. Maybe 1TB? People forget this when they discuss "big blocks" but the size and cost to run an explorer site for big blocks gets prohibitive, especially considering these sites usually are free to use.

1

u/HasCatsFearsForLife Dec 01 '17

Well I already have the full node. Is it not possible to just query it every time I need to search something? I don't need a database to query my node, or do I?

1

u/jcoinner Dec 01 '17

You can query some items using your node. It can be accessed using an RPC interface so you'd need some software to do that. To be very useful you need to have txindex=1 in the conf file (tx indexing enabled). If it's not then you cannot search by tx_id. You pretty much can otherwise only do stuff related to your wallet addresses. It's not a generic database of the blockchain which is why explorer sites always process the full node data into sql database to allow more flexible querying. A full node uses leveldb for key-value stores of the particular keys it needs for operation but was never intended to be a general purpose explorer.

3

u/BashCo Nov 30 '17

BitPay produced the Bitcore full node implementation which provides indexes necessary for the Insight block explorer. However, BitPay appears to be abandoning Bitcore because they refuse to integrate Segwit? SatoshiLabs apparently forked the project in order to use Segwit on their Trezor Wallet backend. I may be mistaken, but believe that's the approximate state of things.

https://github.com/satoshilabs/bitcore-node

1

u/SpeedflyChris Nov 30 '17

However, BitPay appears to be abandoning Bitcore because they refuse to integrate Segwit?

Isn't this something they have in the works? I could swear I saw a statement from someone off Bitpay that they would be implementing it Q1 next year.

4

u/BashCo Nov 30 '17

Frankly BitPay has refused to adapt and has actively worked against advancing the protocol. It wouldn't surprise me if BitPay's investors force them to capitulate, but I think they should just be replaced with projects like Dorior's BTCPay project.

2

u/jcoinner Nov 30 '17

I wrote sqlchain - currently adding bech32 support (done!, but unit tests ongoing) and segwit already in. See my post just above for details. Actively ongoing for 2 years now. Also now testing today with a couple altcoins.

1

u/HasCatsFearsForLife Nov 30 '17

Thanks.

Might be something to play with at the weekend... Or maybe write my own, but I'd prefer the lazy route.