I believe it's viewed as unsafe in Bitcoin because of the way transactions are signed. Is this also true for Ether addresses?
Add a comment
|
2 Answers
Currently, Ethereum uses elliptic curve cryptography (ECDSA), the same as Bitcoin. So whatever "unsafe" concerns there are with how Bitcoin transactions are signed, would be the same with Ethereum currently.
In Bitcoin and Ethereum, sending from an address will reveal the public key easily. Quantum computers compromise ECDSA and would make it easy to deduce the private key from the public key: this is usually the concern about revealing the public key. Lamport signatures are believed to be quantum resistant.
Update May 2019: Account abstraction described below has not been implemented due to complexity, and is planned as part of sharding.
Future release of Ethereum, will have Abstraction of transaction origin and signature:
The goal of these changes is to set the stage for abstraction of account security. Instead of having an in-protocol mechanism where ECDSA and the default nonce scheme are enshrined as the only "standard" way to secure an account, we take initial steps toward a model where in the long term all accounts are contracts, contracts can pay for gas, and users are free to define their own security model.
Accounts will be able to specify their own scheme for validating transactions. This opens the door for Lamport signatures (or other algorithms desired by the user) which improves security against quantum computers in Ethereum.
Custom cryptography: users can upgrade to ed25519 signatures, Lamport hash ladder signatures or whatever other scheme they want on their own terms; they do not need to stick with ECDSA.
-
Two questions: First, prob dumb: "sending from an address will reveal the public key" Does that mean an observer has to be "recording" it live or is it on or derivable from the chain forever? Second, prob also dumb: You say quantum will be able to deduce the private key. Does that include or exclude the user's password to the account? Commented Jul 4, 2017 at 3:35
-
@fivedogit the key can be derived from the transaction signature, so yep available on the blockchain forever. the password is fed into some algo and used to encrypt the private key while it's at rest on your computer -- so quantum computers won't be able to recover your password from the signature. They'd require access to your machine for that to be a threat, which is a totally different threat model :)– bekahCommented Jul 4, 2017 at 8:59
-
@bekah Thanks. So even though a quantum computer can't get the password, they'd have the private key and therefore wouldn't need the password to steal the funds, correct? So someone with a quantum computer and the password has no advantage over someone with a quantum computer and no password? Commented Jul 4, 2017 at 13:04
-
@fivedogit Password only protects your private key from an attacker who has physical/remote access to your device. Your password would be of no use when reversing (brute-force) a private key from public.– NeerajCommented Feb 5, 2020 at 17:09
The other answer saying that by using ECDSA means the security concerns are the same as with Bitcoin is not the full story.
Bitcoin uses a UTXO model whereas Ethereum uses accounts.
This means that when used as designed each Bitcoin address is only used once (sending the balance to brand new addresses). Ethereum accounts are used multiple times.
Each time you create a transaction you create an ECDSA signature. Once a signature hits the network it becomes public. Currently, they are secure, but if new hardware or vulnerabilities are discovered it may be possible - given enough time - to "reverse engineer" a private key from a signature.
Once a signature hits the blockchain, any malicious actor could theoretically begin a race to crack it if the hardware or vulnerabilities exist (and we may not immediately know this has started happening).
In the UTXO model, once the full balance has left an address (confirmations can occur within 10 minutes), there is no benefit of trying to break a signature and the coins are completely secure again. In an account model, it is standard practice to leave a balance in an account. This means that once a malicious actor possesses a signature for an account holding lots of coins, they have both the time and incentive to attempt to crack it. If they succeed, they can create signatures and transactions that pay those coins to themselves. The risk of theft is higher.
Currently, ECDSA has no known vulnerabilities and is considered secure so this is a hypothetical risk.
Accounts have a different security model to UTXO, its a tradeoff - convenience over security. That said, it is not accurate to say ECDSA in Bitcoin has the same risks as in Ethereum when used as designed.
