OrangeSurf

Panicked or ambivalent about nonce key exfiltration? Don’t be - Focus effort into adding anti-klepto to a new version of PSBT instead of taking shots at each other or dismissing concerns.
What is the nonce key exfiltration attack?
When signing a bitcoin transaction a number is used to generate the signature, this number is used once, and is therefore called the nonce.
This should be a cryptographically secure random number, which is never reused.
Suppose an attacker compromises your signing device, and can get it to use a particular nonce, rather than a random number.
If they use part of your private key as the nonce, they can leak part of your private key out of your signing device with each transaction you sign and broadcast.
If you make enough transactions, they can reconstruct your whole private key, and steal your bitcoin, just by watching the bitcoin transactions being made and decoding each part of the private key. They don't need to compromise your computer, or physically access your device, and all the while your signing device appears to be working correctly, up until all your bitcoin is stolen.
There have recently been two new papers expanding on this attack.
- Dark Skippy by Lloyd Fournier, Nick Farrow of FrostsnapTech and Robin Linus of ZeroSync and BitVM.
- Engineering a backdoored bitcoin wallet by Adam Scott and Sean Andersen at block
I think it's great that these researchers have raised attention to this previously known attack vector.
Now, there are two types of reaction in my x feed on this issue, panic and ambivalence.
⚠️ Reaction 1 - Panicked
Nonce key exfil would enable theft at a distance, on all devices that update to malicious firmware & make 12 transactions. The attack doesn't require compromising the online device the signer talks to. The attack is not mitigated on most signing devices, and therefore large amounts of bitcoin are potentially vulnerable. The attack would be undetectable until the thieving begins
🤷‍♂️ Reaction 2 - Ambivalent
This attack requires getting malicious firmware onto a device. Competent signing device firmware devs secure firmware signing key(s) appropriately. Provided the firmware signing keys are not compromised this attack is mitigated because most signing devices check new firmware signatures before upgrading. Malicious firmware would enable many other attacks like generation of compromised wallets or exfiltration of keys in other ways (via screen, microSD or USB).
I think both Panic and Ambivalence are extreme.
❌ Panicked - Most hardware wallets verify firmware signatures so this attack requires either malicious firmware or a compromised firmware signing key / build pipeline and for many transactions to be signed with that firmware. Anti-klepto requires the online wallet to participate and adoption is limited. Creating panic leads uninformed users to rush to move their bitcoin to a new setup and this is when mistakes happen.
❌ Ambivalent - This attack is particularly nefarious because it can be done at a distance without needing to compromise any other user devices which makes it very scalable. If any firmware release is compromised all devices that run that version will be compromised. How secure is your signing key? How secure is your build pipeline? If anti-klepto was widely supported you would probably use it, so let's get it widely supported.
💡 Constructive - Focus effort into adding anti-klepto to a new version of PSBT instead of taking shots at each other or dismissing concerns.

2024-08-17 17:57:00

- reply

Channel peers closed on me, haven’t bothered to find new ones. Any suggestions?

2024-08-16 12:49:01

What is the nonce key exfiltration attack?
When signing a bitcoin transaction a number is used to generate the signature, this number is used once, and is therefore called the nonce.
This should be a cryptographically secure random number, which is never reused.
Suppose an attacker compromises your signing device, and can get it to use a particular nonce, rather than a random number.
If they use part of your private key as the nonce, they can leak part of your private key out of your signing device with each transaction you sign and broadcast.
If you make enough transactions, they can reconstruct your whole private key, and steal your bitcoin, just by watching the bitcoin transactions being made and decoding each part of the private key.
They don't need to compromise your computer, or physically access your device, and all the while your signing device appears to be working correctly, up until all your bitcoin is stolen.
There have recently been two new papers expanding on this attack.
- Dark Skippy by Lloyd Fournier, Nick Farrow of FrostsnapTech and Robin Linus of ZeroSync and BitVM.
- Engineering a backdoored bitcoin wallet by Adam Scott and Sean Andersen at block
I think it's great that these researchers have raised attention to this previously known attack vector.
Now, there are two types of reaction in my x feed on this issue, panic and ambivalence.
⚠️ Reaction 1 - Panicked
Nonce key exfil would enable theft at a distance, on all devices that update to malicious firmware & make 12 transactions. The attack doesn't require compromising the online device the signer talks to. The attack is not mitigated on most signing devices, and therefore large amounts of bitcoin are potentially vulnerable. The attack would be undetectable until the thieving begins
🤷‍♂️ Reaction 2 - Ambivalent
This attack requires getting malicious firmware onto a device. Competent signing device firmware devs secure firmware signing key(s) appropriately. Provided the firmware signing keys are not compromised this attack is mitigated because most signing devices check new firmware signatures before upgrading. Malicious firmware would enable many other attacks like generation of compromised wallets or exfiltration of keys in other ways (via screen, microSD or USB).
I think both Panic and Ambivalence are extreme.
❌ Panicked - Most hardware wallets verify firmware signatures so this attack requires either malicious firmware or a compromised firmware signing key / build pipeline and for many transactions to be signed with that firmware. Anti-klepto requires the online wallet to participate and adoption is limited. Creating panic leads uninformed users to rush to move their bitcoin to a new setup and this is when mistakes happen.
❌ Ambivalent - This attack is particularly nefarious because it can be done at a distance without needing to compromise any other user devices which makes it very scalable. If any firmware release is compromised all devices that run that version will be compromised. How secure is your signing key? How secure is your build pipeline? If anti-klepto was widely supported you would probably use it, so let's get it widely supported.
💡 Constructive - Focus effort into adding anti-klepto to a new version of PSBT instead of taking shots at each other or dismissing concerns.

2024-08-13 14:40:45

Using the public @npub18d4…6lt3 accelerator API you can now fetch a lightning invoice to boost any transaction.
Integrate into your app / service today.
https://m.primal.net/JyUE.mp4

2024-07-26 12:36:00

A very limited batch of the display stand I designed for @npub1s0v…pq6j Passport is available for purchase at BTC2024 in Nashville for $20.
Pick one up at booth 211. If you are not at the event and want to get your hands on one register your interest at the link below or send me a message.
https://tips.orange.surf/apps/37e8jKpHw5g7fmS5csD5bBLeg53r/pos
https://m.primal.net/JfCr.png

2024-07-24 08:23:47

- reply

Sorry to hear that you are disillusioned.
IMO the current state of hardware wallets is actually great (if you can put the bickering aside).
There are many design directions being explored by teams with different priorities making products that target different users and use cases.

2024-07-13 12:25:30

This transaction spent 2 months languishing in the mempool.
Just got confirmed 24 minutes after using @mempool accelerator
https://mempool.space/tx/cba384b5e5e948a7dc888a144739489f6c623ec7d37bb0fe69f650837b5ec82c
https://m.primal.net/JPKi.png

2024-06-06 06:23:45

- reply

@npub1m7q…m4gz

2024-06-06 06:21:47

Follow mempool research on nostr!
npub1m7qjg4hsa2q32rtekewpdn54guh508tlh6ztml7ssluj6vgflensy6m4gz

2024-05-11 19:04:39

- reply

Thank you!

2024-05-10 21:40:22

https://orange.surf/dude-wheres-my-block/

2024-05-10 16:24:58

Braiins just had a huge streak of bad luck with ZERO blocks found in 551 attempts! 🎲🚫 What are the odds?
https://orange.surf/dude-wheres-my-block/

2024-04-23 20:05:26

Update to 840556 https://image.nostr.build/67650d487e620577cff5878490367dcd433268c446504d5ac4aa07915ac67454.jpg

2024-04-21 10:52:33

Update to 840195
https://m.primal.net/HyLf.png

2024-04-20 20:49:41

the blockchain is healing
https://m.primal.net/Hxzm.png

2024-04-20 14:17:18

Updatehttps://m.primal.net/HxpX.png

2024-04-20 09:36:24

Update
https://m.primal.net/Hxll.png

2024-04-20 02:08:43

Welcome to the 5th Epoch https://image.nostr.build/2c8b0aa15a2df034a42b85923e0ffabbd71317cbbec17a57d49f92193e4a60eb.jpg

2024-04-16 18:59:14

At least 97.7 % of hashrate (monthly average) is now running FullRBF based on FullRBF'd transactions from within the past 24 hours.
https://gist.github.com/orangesurf/6483e26e78632ab60e588d56f79e0050

2024-04-10 08:33:12

@npub1qtv…7dze what's the difference between 'old hashrate' (light blue) and 'hashrate' (dark blue)
https://m.primal.net/HtIb.png

2024-04-09 11:19:46

This is what a freedom looks like. #note1jde…zryr

2024-04-08 20:39:40

- reply

Thank you very much for sharing this

2024-03-23 04:26:06

- reply

Use simplex instead

2024-03-13 02:27:20

- reply

Full video https://www.youtube.com/watch?v=Zrv1EDIqHkY

2024-03-13 02:27:03

big prime energy
https://m.primal.net/HkLo.mp4

2024-03-11 06:59:53

- reply

check the "legit" list here
https://bitaxe.org/legit.html

2024-03-07 19:05:35

- reply

wow, anything special about your node which would cause such a high useage?

2024-03-07 09:41:35

- reply

So, wait...
Until you get a confirmation you haven't consolidated anything 😉

2024-03-07 08:43:49

Flat 13's.
What's your call, consolidation now or wait for lower (single digit) bid rates
https://m.primal.net/HiWd.png

2024-03-07 08:09:48

- reply

Things have changed so much since I first ran branle in Apr 2022. Glad to be back 🫡

2024-03-07 05:52:00

- reply

That's awesome. Love to hear it
Can you share a photo?

2024-03-06 22:10:06

3 days on nostr, finding lots of new people to follow. it's much busier than I realised, hope to keep discovering more interesting content.

2024-03-06 21:53:13

- reply

https://m.primal.net/HiQX.jpg

2024-03-06 14:40:32

- reply

Thank you, this is fantastic. I verify when I help friends install sparrow but they are normally afraid to update because they fear the command line.
Now they can update with confidence.
https://m.primal.net/HiKN.png

2024-03-06 07:03:03

- reply

Vasili Alexandrovich Arkhipov
In 1962 the USSR sent a nuclear armed submarine to the international waters off Cuba. The sub was located by the US Navy and depth charges were dropped to force the sub to surface.
At depth the crew had been out of communication with Moscow for days and feared that war had broken out.
The captain wanted to launch a nuclear torpedo.
Launch required a 3 of 3 signoff from the captain, the political officer and Arkhipov (the executive officer, who was chief of staff of the brigade).
Arkhipov refused to authorise the attack, and persuaded the captain to surface and await orders.
Had Arkhipov not refused, there is a high probability that the USSR would have made a nuclear strike against the US Navy, which could quickly have led to thermonuclear war which would have killed billions.

2024-03-05 20:08:28

- reply

Delete this

2024-03-05 19:36:42

research e-gold before running an ecash mint

2024-03-04 18:17:34

Chart watching. Not that chart.
https://m.primal.net/Hhgx.png

2024-03-04 16:27:23

best of day 2 of nostr.
zapping the zap.stream dev while streaming a live zap.stream of him developing zap.stream

2024-03-04 09:39:15

- reply

how much for the ICO?

2024-03-04 09:01:43

- reply

👍 mempool based estimation is the way

2024-03-03 22:15:14

how do you pick your fee rate anon?

2024-03-02 13:18:24

I have tried nostr on and off for many years.
It's time to try again.
Relay list refreshed, LFG

2024-02-15 13:09:55

- reply

zapped for UTC

2024-02-13 19:09:24

Before bitcoin core v0.7.0 the default transaction selection algorithm was to pack transactions sorted by transaction priority, where priority was equal to the coin age (in blocks) multiplied by the spent value, divided by the transaction size.
The default policy also set a minimum transaction fee that increased as the space in blocks grew closer to the blocksize limit.
https://m.primal.net/HccC.png

2024-02-13 04:23:27

There are plenty of Whirlpool Surge Cycles taking advantage of the drop in fee rates following a brief spike.
https://m.primal.net/HcTD.jpg
https://m.primal.net/HcTE.jpg

2024-02-12 13:53:37

What software / services in use today rely on the immutability of txids?

2024-02-12 12:31:32

Fee Rate over the past 6 weeks
1 day rolling average
https://m.primal.net/HcML.png
14 day rolling average
https://m.primal.net/HcMM.png

2024-02-01 07:40:47

Good job you didn't panic and consolidate at high fee rates over the past 6 weeks.
https://m.primal.net/HaFA.jpg

2024-01-06 23:20:58

Out of band payments to miners are the market mitigating an inefficiency which exists as a result of policy rules which are (rightly) designed to protect nodes from DOS attacks.
Personally I am very supportive of bitcoin developers efforts to resolve these inefficiencies in a decentralised way. I also think that there are often advantages afforded by centralised systems (which of course come with trade offs), which can be leveraged by those who opt-in to using them.
Without the need to make onchain transactions there is the potential to fee bump awkward transactions (which can't be bumped easily by other means today) without overpaying. Examples of such awkward transactions include;
- geographically separated multisig where the signing process may take many days / weeks from start to end
- channel close transactions with a fee rate below the purge rate
- tx's sent from wallets without RBF/CPFP tooling
Past and current transaction prioritisation tools leave much to be desired;
- opaque fees and terms
- limited access for users and miners / pools
- private acceleration bids (prior to confirmation) meaning counter bids cannot be made
- private acceleration fees (after confirmation) making it hard for miners in pools to audit whether out of band payments are being collected
I believe that a transparent alternative is possible with
- clear fees and terms
- wider access for users and miners / pools
- public acceleration data for both bids and fees
Because I believe this I am working to help deliver
@Mempool
Accelerator, which I hope will demonstrate that such a radically transparent alternative is possible.
The block audit feature was the first step in this journey, providing bitcoiners with the tools to detect likely OOB payments, including those made by mempool.
If you have a specific use case for Mempool Accelerator i'd love to hear about it.
email orangesurf at mempool dot space
matrix orangesurf:bitcoin.kyoto

2024-01-06 21:59:50

- reply

Ackchyually.... it's the D'cent Biometric
https://m.primal.net/HWpE.png

2024-01-05 21:33:10

- reply

Data over the past 2 years
https://m.primal.net/HWiH.png

2024-01-05 21:31:55

Current bitcoin fees in the context of historic rates.
https://m.primal.net/HWiG.png

2024-01-01 16:34:06

Calling all ordisrespectors / filter enjoyoors. In the interests of understanding your position here is my best effort to steelman why new bitcoin core policy rules should be updated to 'filter out spam'.
If you are an ordisrespector please add comments where you think missed something.
1. Bitcoin was intended for financial transactions, not arbitrary data storage.
2. The demand for arbitrary data storage is essentially infinite.
3. Spammers who want to use bitcoin for arbitrary data storage have deep pockets to pay for high fees.
4. Because of 1 & 2 & 3 active measures are required to stop the scarce blockspace being filled with non transaction data.
5. Bitcoin core policy rules can easily be updated to filter out specific types of current 'spam transactions'.
6. Most people run the latest bitcoin core with defaults.
7. If bitcoin core policy were to be updated in a new release the majority of node runners will update
8. If the vast majority of nodes update (7) it will be hard to relay 'spam' to miners over the p2p network.
9. Miners won't make enough extra revenue accepting out of band 'spam' transactions to make it worth their while.
10. Most of the 'spammers' will give up and move to other chains or stop
My opinion is that changing bitcoin core policy will not achieve your desired objectives, and I will reply to this thread with my thoughts on each of the 10 points once I have some feedback on whether this is a fair steelman.

2023-12-20 10:32:42

Justin Murray posted these photos of bitcoin miners on sale at an electronics market in Shenzhen.
https://m.primal.net/HUdK.png
https://m.primal.net/HUdL.png
https://m.primal.net/HUdM.png
https://m.primal.net/HUdN.png
https://m.primal.net/HUdO.png
https://twitter.com/jjustinmurrayy/status/1735877635824386265

2023-12-18 10:07:30

5 pools provide block templates for 85% of the hashrate.
https://m.primal.net/HUNi.png

2023-12-17 15:57:03

- reply

Remember to set relays for the zap response post
For example
wss://relay.primal.net
wss://relay.damus.io
wss://relay.snort.social
If you previously used an old version of the plugin uninstall and reinstall the latest (1.1.2)

2023-12-17 12:23:52

- reply

If a small amount of gold is real it can be used.
If a utxo is expected to remain unspendable it can't be used

2023-12-17 12:03:18

Self sovereign zaps to my tor LN node are now finally enabled
I tried to set up zaps without success 8 months ago. My LN Address worked but nostr clients didn't recognise that the payment had been made. Thanks to @npub1y24gz5gwucl79vtv4ctwpysl0r5m4xyzu2rgulnr44ks3t5mt92q4nz2ad this is now easy for btcpayserver users
1. Exposed your BTCPayServer publicly (guide here https://orange.surf/public-btcpay-umbrel-tailscale/)
2. Create a lightning address in BTCPayServer
3. Install the nostr BTCPayServer extension, enter the same name and your Nostr PubKey and PrivKey
Zaps will now work.

2023-12-17 08:38:21

- reply

Thank you for verifying, you are correct, I made a typo in the post. The chart and delta are correct, but the max value is 7.30606132 BTC (-0.43183364)

2023-12-17 00:00:32

- reply

jpeg transaction creators would just submit the transactions directly to the mining pools, bypassing the mempools of the nodes which reject.

2023-12-16 23:41:15

- reply

Yes, default core policy rules + FullRBF (in post)

2023-12-16 23:14:57

Miners determine which of the valid transactions in their mempool are selected for inclusion in a block.
Aside from the need for transactions to be valid, there are no consensus rules around transaction selection, miners are able to use whatever selection method they wish.
So how do block templates compare? Let's examine what happened prior to block 821498 (mined within the last hour).
The block mined by Antpool had a max total bid of 7.73789496 BTC. You can find this using bitcoin-cli getblockstats
My local instance of bitcoin core running the default policy rules + FullRBF had a max total bid of 7.71806816 BTC, lower than the mined block by 0.01982680 BTC.
The block templates provided by @npub18d4…6lt3
had a max total bid of 7.7334687 BTC, lower than the mined block by 0.00442626 BTC.
The block template provided by ocean npub1qtvl2em0llpnnllffhat8zltugwwz97x79gfmxfz4qk52n6zpk3qq87dze
had a max total bid of 6.6127135 BTC, lower than the mined block by 0.43183364 BTC
Filtering policy and sorting method vary by pool, but mining is highly competitive. For how long can mining pools who do not maximise fee revenue survive?
https://m.primal.net/HUED.png
The rate of my data logging (every few seconds) means it's inevitable that I don't capture the latest templates, so that accounts for a small part of the delta. You can see on the mempool block audit page that the expected mempool space template for the mempool block is 7.737 BTC , slightly higher than the 7.7335 BTC template I captured.
An additional source of the delta is that there were some transactions (in blue) which AntPool included which were not in
@mempool
's mempool and likely not in mine or oceans (I didn't save the block template so can't check).
These 6 transactions pay a total of 4,072,619 sats in fees. Plus there is a transaction that was included which had a marginal fee rate, paying a 73,828 sats.
A total of 4,146,447 sats
To create space to include these transactions 45 transactions were dropped, each paying 89,833 sats.
A total of 4,042,485 sats
Including these transactions resulted in a net increase for the in band fees of 103,962 sats (0.00103962 BTC)
Check the block audit at https://mempool.space/block/000000000000000000028bdf4456e7e2519b0ba4b6d52cea0cc18c726f60a578

2023-10-23 15:38:38

- reply

$1Bn

2023-10-21 17:39:03

the nostr, what are you grooving to?
https://tycho.bandcamp.com/album/awake

2023-09-09 11:35:20

- reply

Page is now fixed. satskull.com

2023-09-09 11:34:17

@npub1chx…rjdd is testnet mode within SBW on the roadmap? It would be very useful when teaching new bitcoiners.

2023-09-01 14:50:35

In Riga - Hit me up

2023-08-01 22:27:28

Anyone else struggle to find interesting content on nostr?
Which nostr clients have filters that prioritise showing content of quality?

2023-07-28 21:34:00

What is a #zappathon?

2023-07-22 06:48:15

GM, welcome @npub1may…hl50 to nostr
#plebchain

2023-07-20 07:40:48

- reply

View only currently?

2023-07-20 07:38:48

- reply

#plebchain I guess

2023-07-20 07:33:46

Reminder that you can download and print your own satskull for free
satakull.com
https://nostr.build/i/68d3867e74077157381d7d36fac23f54a077fcca54be35b566bd2acce73655f0.jpg

2023-07-14 22:41:21

- reply

Good job

2023-07-14 14:05:04

Is it possible to see a list of the relays your followers are connected to?

2023-07-13 19:13:45

V5 of the OrangeSurf Seedsigner Case is now released
https://github.com/orangesurf/orangesurf-seedsigner-case/raw/main/images/ssc-v5.png
Available in the UK now from Me
https://tips.orange.surf/apps/44dC6KKzWwanvmZwkSjDCkjBPvBo/pos
Available in the USA tomorrow from endorsed reseller CryptoCloaks
Design updated following the @seedsigner
community informing me that the right micro USB is power only.
Crowdfund Value for Value
https://tips.orange.surf/apps/akitb1oDHpfr1EyVbyiXtEGGgBF/crowdfund
Download Part1:
https://github.com/orangesurf/orangesurf-seedsigner-case/blob/main/stl/v05/coverPlate-v05.stl
Download Part2:
https://github.com/orangesurf/orangesurf-seedsigner-case/blob/main/stl/v05/outerCase-v05.stl
https://github.com/orangesurf/orangesurf-seedsigner-case/raw/main/images/ssc-iso.JPG
#plebchain

2023-07-13 06:32:04

@npub1mut…23vg Beta Thread
The unified receive screen is so clean.
https://nostr.build/i/6b084268991cc8e18c28e9debe70826c63fb53ee80d868f66abb8e8be8fcbdba.jpg

2023-07-12 09:56:18

Now on Geyser
https://geyser.fund/project/orangesurfseedsignercase
https://nostr.build/i/5e198f0cb263b2aa34a78af4ccd0f1a16e6a283bbaa48f1ea2982098959ee718.jpg

2023-04-10 12:59:12

Any 3D printing / design enthusiasts on nostr? #plebchain

2023-04-09 07:13:58

- reply

Just updated amethyst for the first time in months, I didn't realise that hashtags worked. What is plebchain?

2023-04-07 20:10:14

How do you discover new people / projects? Are there any nostr clients focused on discovery?

2023-03-19 20:34:51

- reply

Looks nice, good job

2023-03-02 00:23:11

- reply

Thanks, unsure why 294 is used as the threshold