Could someone solve for your private keys by sending many transactions to the same address?

I've read that it's never safe to use the same bitcoin address more than once because there is a small chance that someone could solve for your private keys (though I don't have a solid-enough background in encryption to understand all of the implications of this concept). In any case, even if you did generate a different address for every incoming transaction, what would stop an attacker from simply sending many transactions to the first address they see in an attempt to crack your private key?

JSideris

Posted 2015-11-22T15:25:11.870

Reputation: 157

I think that what you read is wrong, or you have misunderstood it. Can you give a link / reference to where you read this? – Nate Eldredge – 2015-11-22T15:51:15.937

@NateEldredge https://en.bitcoin.it/wiki/Address_reuse#Security

– JSideris – 2015-11-22T16:04:48.447

I believe you are thinking of the leaking of a private key when building a transaction with reused r-values. There is no chance someone can solve your private key from an attacker sending you coins. https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517

– m1xolyd1an – 2015-11-22T16:20:03.443

@m1xolyd1an Yes this is the issue to which I was referring. That was a pretty good explanation on how the vulnerability works - I get how the calculation is done. Am I to understand that using the same address to receive bitcoins more than once is, per se, not insecure, but that this vulnerability has to do with the way transactions are signed? – JSideris – 2015-11-22T17:06:08.570

Yes the reused r-value vulnerability is from creating many transactions from the same address AND a wallet service fault of re-using r values. @Bizorke – m1xolyd1an – 2015-11-22T17:21:09.023

1@Bizorke: I think it's also important to emphasize that the signature vulnerability is not inherent to ECDSA, as far as I know; it requires a flawed implementation. The "reused r values" only works if you are using a broken random number generator, and the side channel attack requires that the attacker have access to your computer (possibly a different account). I'm not aware of any inherent risks of creating many transactions from a single address. – Nate Eldredge – 2015-11-22T19:08:21.263

1Modern software uses RFC6979 which doesn't use any supplied entropy for the ECDSA nonce anyway. If the RNG is so broken it's making duplicates there's going to be other problems though. – Anonymous – 2015-11-23T01:26:38.220

Answers

So there are attacks where if you sign enough times with the same private key, the attacker, with access to a side-channel can figure out your key.

So if you were signing with your private key a lot of times, this would make your private key slightly less secure. If you're receiving bitcoins to your address, you're not signing with your private key, so this isn't an issue.

The more important consideration here is that you lose privacy with address reuse.

Jimmy Song

Posted 2015-11-22T15:25:11.870

Reputation: 7 067

Note that a "side channel" is often talking about some level of access. Bitcoin Core also does not use OpenSSL for signing transactions so this particular bug is likely a complete non-issue. – Anonymous – 2015-11-22T22:33:31.567

Several cryptographic schemes have such kind of flaw, that is, if an attacker intercepts several messages from one single private key source, it becomes easier to decipher the message. During the World War II this were done several times by the allies in order to break the Nazis and the Japaneses codes.

Fortunately, bitcoin rely on cryptographic schemes (mainly SHA256) that doesn't have any know flaw (unless brute force) yet. This means that, if you don't provide your private key to no one else, you can do as many transactions you like with one single address account that an attacker would not be better of to break your account.

Mark Messa

Posted 2015-11-22T15:25:11.870

Reputation: 474

-2

It does make your address slightly less secure once you send from it. If the address is only used to receive Bitcoin though, it is secure, and there is no significant risk to your private keys.

EDIT Added: Sending lets the world know the public address. This increases risk (albeit to insignificant levels) but still IMO many times higher risk than not disclosing this information at all, because now any attacker is closer to finding the private key.

So as just one reason (there are more)... given that there is clearly non-zero risk that technology could be developed to compute private keys more easily from public addresses, publicizing public addresses increases risk. See link below.

Reddit thread discussing quantum-safety

Brad Thomas

Posted 2015-11-22T15:25:11.870

Reputation: 336

Can you quantify the "slightly"? As far as I know, these risks are only significant if you are using a flawed implementation. It would seem to be a serious problem with ECDSA if publishing any reasonable number of signatures would make it feasible for an attacker to recover the private key. – Nate Eldredge – 2015-11-22T19:09:55.217

2This is misleading, because it's conflating address correlation (see which keys are related) and address compromise (take money from you). – Nick ODell – 2015-11-22T20:42:45.163

I do not understand your criticism Nick, can you explain. As for quantification Nate, I don't have time to calculate that, not certain why the exact number is relevant to answering the question. – Brad Thomas – 2015-11-22T23:38:07.310

@BradThomas Sure. It does make your address slightly less secure once you send from it. If you mean in the sense that it reduces address privacy, that's true, but misleading, since the OP asked about something else. If you mean that in the sense that repeated signings can allow someone to compromise your private keys, that's false. If there's some other aspect of my criticism you'd like clarification on, please let me know. (P.S. Remember to @mention someone to notify them of your response.) – Nick ODell – 2015-11-23T21:45:50.707

@Nick, thank you for your clarification. I think I could have been clearer what I meant in my answer, so I have updated it – Brad Thomas – 2015-11-23T23:37:06.780

Link for reference: https://www.reddit.com/r/Bitcoin/comments/3wfmg2/satoshis_unmoved_coins_are_the_worlds_biggest/

– Brad Thomas – 2015-12-12T05:16:02.723