📅 Original date posted:2014-07-16
📝 Original message:If I first remove \u0000, so the non-normalized passphrase is
"\u03D2\u0301\U00010400\U0001F4A9", and then NFC normalize it, it
becomes "\u03D3\U00010400\U0001F4A9"
UTF-8 encoded this is: 0xcf93f0909080f09f92a9 (not the same as what
you got, Andreas!)
Encoding private key: 5Jajm8eQ22H3pGWLEVCXyvND8dQZhiQhoLJNKjYXk9roUFTMSZ4
with this passphrase, I get a BIP38 key of:
6PRW5o9FMb4hAYRQPmgcvVDTyDtr6R17VMXGLmvKjKVpGkYhBJ4uYuR9wZ
I recommend rather than simply removing control characters from the
password that instead the spec require that passwords containing
control characters are invalid. We don't want people trying to be
clever and putting them in thinking they are adding to the password
entropy.
Also for UI compatibility across many platforms, I'm also in favor
disallowing any character below U+0020 (space)
I can submit a PR once we figure out why Andreas's passphrase was
different than what I got.
Aaron Voisine
breadwallet.com
On Wed, Jul 16, 2014 at 4:04 AM, Andreas Schildbach
<andreas at schildbach.de> wrote:
> Damn, I just realized that I implement only the decoding side of BIP38.
> So I cannot propose a complete test vector. Here is what I have:
>
>
> Passphrase: ϓ␀𐐀💩 (\u03D2\u0301\u0000\U00010400\U0001F4A9; GREEK
> UPSILON WITH HOOK, COMBINING ACUTE ACCENT, NULL, DESERET CAPITAL LETTER
> LONG I, PILE OF POO)
>
> Passphrase bytes after removing ISO control characters and NFC
> normalization: 0xcf933034303066346139
>
> Bitcoin Address: 16ktGzmfrurhbhi6JGqsMWf7TyqK9HNAeF
>
> Unencrypted private key (WIF):
> 5Jajm8eQ22H3pGWLEVCXyvND8dQZhiQhoLJNKjYXk9roUFTMSZ4
>
>
> Can someone calculate the encrypted key from it (using whatever
> implementation) and I will verify it decodes properly in bitcoinj?
>
>
>
> On 07/16/2014 12:46 PM, Andreas Schildbach wrote:
>> I will change the bitcoinj implementation and propose a new test vector.
>>
>>
>>
>> On 07/16/2014 11:29 AM, Mike Hearn wrote:
>>> Yes sorry, you're right, the issue starts with the null code point.
>>> Python seems to have problems starting there too. It might work if we
>>> took that out.
>>>
>>>
>>> On Wed, Jul 16, 2014 at 11:17 AM, Andreas Schildbach
>>> <andreas at schildbach.de <mailto:andreas at schildbach.de>> wrote:
>>>
>>> Guys, you are always talking about the Unicode astral plane, but in fact
>>> its a plain old (ASCII) control character where this problem starts and
>>> likely ends: \u0000.
>>>
>>> Let's ban/filter ISO control characters and be done with it. Most
>>> control characters will never be enterable by any keyboard into a
>>> password field. Of course I assume that Character.isISOControl() works
>>> consistently across platforms.
>>>
>>> http://docs.oracle.com/javase/7/docs/api/java/lang/Character.html#isISOControl%28char%29
>>>
>>>
>>> On 07/16/2014 12:23 AM, Aaron Voisine wrote:
>>> > If the user creates a password on an iOS device with an astral
>>> > character and then can't enter that password on a JVM wallet, that
>>> > sucks. If JVMs really can't support unicode NFC then that's a strong
>>> > case to limit the spec to the subset of unicode that all popular
>>> > platforms can support, but it sounds like it might just be a JVM
>>> > string library bug that could hopefully be reported and fixed. I get
>>> > the same result as in the test case using apple's
>>> > CFStringNormalize(passphrase, kCFStringNormalizationFormC);
>>> >
>>> > Aaron Voisine
>>> > breadwallet.com <http://breadwallet.com>;
>>> >
>>> >
>>> > On Tue, Jul 15, 2014 at 11:20 AM, Mike Hearn <mike at plan99.net
>>> <mailto:mike at plan99.net>> wrote:
>>> >> Yes, we know, Andreas' code is indeed doing normalisation.
>>> >>
>>> >> However it appears the output bytes end up being different. What
>>> I get back
>>> >> is:
>>> >>
>>> >> cf930001303430300166346139
>>> >>
>>> >> vs
>>> >>
>>> >> cf9300f0909080f09f92a9
>>> >>
>>> >> from the spec.
>>> >>
>>> >> I'm not sure why. It appears this is due to the character from
>>> the astral
>>> >> planes. Java is old and uses 16 bit characters internally - it
>>> wouldn't
>>> >> surprise me if there's some weirdness that means it doesn't/won't
>>> support
>>> >> this kind of thing.
>>> >>
>>> >> I recommend instead that any implementation that wishes to be
>>> compatible
>>> >> with JVM based wallets (I suspect Android is the same) just
>>> refuse any
>>> >> passphrase that includes characters outside the BMP. At least
>>> unless someone
>>> >> can find a fix. I somehow doubt this will really hurt anyone.
>>> >>
>>> >>
>>> ------------------------------------------------------------------------------
>>> >> Want fast and easy access to all the code in your enterprise?
>>> Index and
>>> >> search up to 200,000 lines of code with a free copy of Black Duck
>>> >> Code Sight - the same software that powers the world's largest code
>>> >> search on Ohloh, the Black Duck Open Hub! Try it now.
>>> >> http://p.sf.net/sfu/bds
>>> >> _______________________________________________
>>> >> Bitcoin-development mailing list
>>> >> Bitcoin-development at lists.sourceforge.net
>>> <mailto:Bitcoin-development at lists.sourceforge.net>
>>> >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>> >>
>>> >
>>> >
>>> ------------------------------------------------------------------------------
>>> > Want fast and easy access to all the code in your enterprise?
>>> Index and
>>> > search up to 200,000 lines of code with a free copy of Black Duck
>>> > Code Sight - the same software that powers the world's largest code
>>> > search on Ohloh, the Black Duck Open Hub! Try it now.
>>> > http://p.sf.net/sfu/bds
>>> >
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Want fast and easy access to all the code in your enterprise? Index and
>>> search up to 200,000 lines of code with a free copy of Black Duck
>>> Code Sight - the same software that powers the world's largest code
>>> search on Ohloh, the Black Duck Open Hub! Try it now.
>>> http://p.sf.net/sfu/bds
>>> _______________________________________________
>>> Bitcoin-development mailing list
>>> Bitcoin-development at lists.sourceforge.net
>>> <mailto:Bitcoin-development at lists.sourceforge.net>
>>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Want fast and easy access to all the code in your enterprise? Index and
>>> search up to 200,000 lines of code with a free copy of Black Duck
>>> Code Sight - the same software that powers the world's largest code
>>> search on Ohloh, the Black Duck Open Hub! Try it now.
>>> http://p.sf.net/sfu/bds
>>>
>>>
>>>
>>> _______________________________________________
>>> Bitcoin-development mailing list
>>> Bitcoin-development at lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Want fast and easy access to all the code in your enterprise? Index and
>> search up to 200,000 lines of code with a free copy of Black Duck
>> Code Sight - the same software that powers the world's largest code
>> search on Ohloh, the Black Duck Open Hub! Try it now.
>> http://p.sf.net/sfu/bds
>>
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Aaron Voisine [ARCHIVE] /
npub18g…knkzl
2023-06-07 15:23:54
in reply to nevent1q…4v85
Author Public Key
npub18gjvug29c4yg46lmplq38e75gg6wn5mn8taytckcsr4jt8p74h3s5knkzlPublished at
2023-06-07 15:23:54Event JSON
{
"id": "7c08bb81d3c4abebd0b75a2354dc0a64050fefae426eb0441da5520278796a04",
"pubkey": "3a24ce2145c5488aebfb0fc113e7d44234e9d3733afa45e2d880eb259c3eade3",
"created_at": 1686151434,
"kind": 1,
"tags": [
[
"e",
"60726055f5690f49a0698605fd9e440f1a7b0fbf2e702b7f0382a84f86474ca9",
"",
"root"
],
[
"e",
"41f63386e39e184192e8ac11bc8d24714c4d50ecaec194d76a77002b5d3c7c61",
"",
"reply"
],
[
"p",
"3215b3d77dff1f84eeb5ad46fb1206a8d1657b3ea765a80b5489ece3a702d2bc"
]
],
"content": "📅 Original date posted:2014-07-16\n📝 Original message:If I first remove \\u0000, so the non-normalized passphrase is\n\"\\u03D2\\u0301\\U00010400\\U0001F4A9\", and then NFC normalize it, it\nbecomes \"\\u03D3\\U00010400\\U0001F4A9\"\n\nUTF-8 encoded this is: 0xcf93f0909080f09f92a9 (not the same as what\nyou got, Andreas!)\n\nEncoding private key: 5Jajm8eQ22H3pGWLEVCXyvND8dQZhiQhoLJNKjYXk9roUFTMSZ4\nwith this passphrase, I get a BIP38 key of:\n6PRW5o9FMb4hAYRQPmgcvVDTyDtr6R17VMXGLmvKjKVpGkYhBJ4uYuR9wZ\n\nI recommend rather than simply removing control characters from the\npassword that instead the spec require that passwords containing\ncontrol characters are invalid. We don't want people trying to be\nclever and putting them in thinking they are adding to the password\nentropy.\n\nAlso for UI compatibility across many platforms, I'm also in favor\ndisallowing any character below U+0020 (space)\n\nI can submit a PR once we figure out why Andreas's passphrase was\ndifferent than what I got.\n\nAaron Voisine\nbreadwallet.com\n\n\nOn Wed, Jul 16, 2014 at 4:04 AM, Andreas Schildbach\n\u003candreas at schildbach.de\u003e wrote:\n\u003e Damn, I just realized that I implement only the decoding side of BIP38.\n\u003e So I cannot propose a complete test vector. Here is what I have:\n\u003e\n\u003e\n\u003e Passphrase: ϓ␀𐐀💩 (\\u03D2\\u0301\\u0000\\U00010400\\U0001F4A9; GREEK\n\u003e UPSILON WITH HOOK, COMBINING ACUTE ACCENT, NULL, DESERET CAPITAL LETTER\n\u003e LONG I, PILE OF POO)\n\u003e\n\u003e Passphrase bytes after removing ISO control characters and NFC\n\u003e normalization: 0xcf933034303066346139\n\u003e\n\u003e Bitcoin Address: 16ktGzmfrurhbhi6JGqsMWf7TyqK9HNAeF\n\u003e\n\u003e Unencrypted private key (WIF):\n\u003e 5Jajm8eQ22H3pGWLEVCXyvND8dQZhiQhoLJNKjYXk9roUFTMSZ4\n\u003e\n\u003e\n\u003e Can someone calculate the encrypted key from it (using whatever\n\u003e implementation) and I will verify it decodes properly in bitcoinj?\n\u003e\n\u003e\n\u003e\n\u003e On 07/16/2014 12:46 PM, Andreas Schildbach wrote:\n\u003e\u003e I will change the bitcoinj implementation and propose a new test vector.\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e On 07/16/2014 11:29 AM, Mike Hearn wrote:\n\u003e\u003e\u003e Yes sorry, you're right, the issue starts with the null code point.\n\u003e\u003e\u003e Python seems to have problems starting there too. It might work if we\n\u003e\u003e\u003e took that out.\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e On Wed, Jul 16, 2014 at 11:17 AM, Andreas Schildbach\n\u003e\u003e\u003e \u003candreas at schildbach.de \u003cmailto:andreas at schildbach.de\u003e\u003e wrote:\n\u003e\u003e\u003e\n\u003e\u003e\u003e Guys, you are always talking about the Unicode astral plane, but in fact\n\u003e\u003e\u003e its a plain old (ASCII) control character where this problem starts and\n\u003e\u003e\u003e likely ends: \\u0000.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Let's ban/filter ISO control characters and be done with it. Most\n\u003e\u003e\u003e control characters will never be enterable by any keyboard into a\n\u003e\u003e\u003e password field. Of course I assume that Character.isISOControl() works\n\u003e\u003e\u003e consistently across platforms.\n\u003e\u003e\u003e\n\u003e\u003e\u003e http://docs.oracle.com/javase/7/docs/api/java/lang/Character.html#isISOControl%28char%29\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e On 07/16/2014 12:23 AM, Aaron Voisine wrote:\n\u003e\u003e\u003e \u003e If the user creates a password on an iOS device with an astral\n\u003e\u003e\u003e \u003e character and then can't enter that password on a JVM wallet, that\n\u003e\u003e\u003e \u003e sucks. If JVMs really can't support unicode NFC then that's a strong\n\u003e\u003e\u003e \u003e case to limit the spec to the subset of unicode that all popular\n\u003e\u003e\u003e \u003e platforms can support, but it sounds like it might just be a JVM\n\u003e\u003e\u003e \u003e string library bug that could hopefully be reported and fixed. I get\n\u003e\u003e\u003e \u003e the same result as in the test case using apple's\n\u003e\u003e\u003e \u003e CFStringNormalize(passphrase, kCFStringNormalizationFormC);\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e Aaron Voisine\n\u003e\u003e\u003e \u003e breadwallet.com \u003chttp://breadwallet.com\u003e\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e On Tue, Jul 15, 2014 at 11:20 AM, Mike Hearn \u003cmike at plan99.net\n\u003e\u003e\u003e \u003cmailto:mike at plan99.net\u003e\u003e wrote:\n\u003e\u003e\u003e \u003e\u003e Yes, we know, Andreas' code is indeed doing normalisation.\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e However it appears the output bytes end up being different. What\n\u003e\u003e\u003e I get back\n\u003e\u003e\u003e \u003e\u003e is:\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e cf930001303430300166346139\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e vs\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e cf9300f0909080f09f92a9\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e from the spec.\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e I'm not sure why. It appears this is due to the character from\n\u003e\u003e\u003e the astral\n\u003e\u003e\u003e \u003e\u003e planes. Java is old and uses 16 bit characters internally - it\n\u003e\u003e\u003e wouldn't\n\u003e\u003e\u003e \u003e\u003e surprise me if there's some weirdness that means it doesn't/won't\n\u003e\u003e\u003e support\n\u003e\u003e\u003e \u003e\u003e this kind of thing.\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e I recommend instead that any implementation that wishes to be\n\u003e\u003e\u003e compatible\n\u003e\u003e\u003e \u003e\u003e with JVM based wallets (I suspect Android is the same) just\n\u003e\u003e\u003e refuse any\n\u003e\u003e\u003e \u003e\u003e passphrase that includes characters outside the BMP. At least\n\u003e\u003e\u003e unless someone\n\u003e\u003e\u003e \u003e\u003e can find a fix. I somehow doubt this will really hurt anyone.\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e \u003e\u003e Want fast and easy access to all the code in your enterprise?\n\u003e\u003e\u003e Index and\n\u003e\u003e\u003e \u003e\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e\u003e \u003e\u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e\u003e \u003e\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e\u003e \u003e\u003e http://p.sf.net/sfu/bds\n\u003e\u003e\u003e \u003e\u003e _______________________________________________\n\u003e\u003e\u003e \u003e\u003e Bitcoin-development mailing list\n\u003e\u003e\u003e \u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e\u003e \u003cmailto:Bitcoin-development at lists.sourceforge.net\u003e\n\u003e\u003e\u003e \u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\u003e \u003e\u003e\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e \u003e Want fast and easy access to all the code in your enterprise?\n\u003e\u003e\u003e Index and\n\u003e\u003e\u003e \u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e\u003e \u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e\u003e \u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e\u003e \u003e http://p.sf.net/sfu/bds\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e\u003e\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e\u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e\u003e http://p.sf.net/sfu/bds\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e\u003e \u003cmailto:Bitcoin-development at lists.sourceforge.net\u003e\n\u003e\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e\u003e\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e\u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e\u003e http://p.sf.net/sfu/bds\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e http://p.sf.net/sfu/bds\n\u003e\u003e\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e Code Sight - the same software that powers the world's largest code\n\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e http://p.sf.net/sfu/bds\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development",
"sig": "c8e3985799a78d799229655473b8b3c73db08473b54f3fdfa5d0252e8a0f6729a41672c306740efba9c4bce4a70bceff5a864dd7d73c21028e9a4db13a21c86c"
}