Bitcoin Forum

The new Electrum (http://ecdsa.org/electrum/) Bitcoin client uses a deterministic wallet. This allows users to recover their complete list of addresses and transaction history from a secret seed.  (except for labels, which are not stored in the blockchain)

For the moment this feature allows users to restore their wallet in case of loss, or to easily transport their wallet on another machine. However, it does not automatically synchronize a wallet that is being used on two different machines. I would like to add this functionality. This would very much ressemble "cloud" services.

The idea, of course, is to use the blockchain as the only source of information; we do not want users to be tied to a third-party storage.

In order to achieve this, the client needs to watch the next addresses that are going to be used in its deterministic sequence. The Electrum wallet actually uses two distinct sequences: one for receiving addresses, one for change addresses. The sequence of receiving addresses might contain gaps (unused addresses), and the maximal size of these gaps is a parameter set by the user. The sequence of change addresses does not have gaps.

The problem of synchronization between two wallets is the following: If bitcoins are received at one of the addresses that are at the end of the current sequence, then the client needs to extend that sequence, in order to know whether the next addresses have been involved in transactions. For this, the client needs to generate new private keys, and therefore it needs the user's password.

So, we are left with the following dilemma: should the client pre-generate the next 100 addresses of its sequence and store them, or should it occasionally ask the user for his password when the wallet receives some bitcoins? both solutions seem awkward to me. Is there a third solution?

UPDATE: this question has been answered below. Version 0.34 of Electrum implements a "type 2" wallet and multiple instances of the same wallets are synchronized automatically.

What exactly is a sequence ?
Is it something like a process that can make a new address A(n+1) from A(n) that is valid for a fixed, maximum number of n ?

If it is, is there any mileage of having a "sequence sequence" / a "synchronisation sequence" so that one client can effectively say:

"I have run out of addresses I can create from my current sequence, can we move onto the next one please?"
and then any other client can see the switch to a new sequence and move in step.

If there is a finite length you can safely create in a sequence you will, of course, run to the end of a "synchronisation sequence" but that will be O(n^2) and hence not too frequent.

Yes: Use a different type of deterministic wallet - one that takes advantage of the properties of ECC keys:
https://bitcointalk.org/index.php?topic=19137.0

In a nutshell: that allows you to determine a large number of future public keys by just using a master public key that is based off the master
private key. Yes, reading that made my head explode.

Also....

WARNING: This Bitcoin client does not check that an address is valid before sending to it. Use copy and paste ONLY until this is resolved.

For more info:
https://bitcointalk.org/index.php?topic=52035.msg621172#msg621172

I think deterministic wallet is a bad idea.

Think about online bank, do they use your passphrase to generate keys? of course not, that's stupid.

Keys are keys, and passphrase are passphrase,  your keys are stored in USB-keys, and protected by passphrase and the thrid-party ---BANK.

well, this was resolved before your post...

nice. thanks for that link

I see a potential problem with any phase based deterministic wallet.  It reduces the namespace of an attacker trying to force an address collision by searching for English phrases in the same way that a dictionary attack works against common passwords.  It's more than conceivable to have an accidental collision as well, if two fans of classical lit both choose "Call me Ishmael" or more than one Tolkien fan chooses the same quote from TLOTR.  Hell, an attacker who was just using the King James version of the Bible would get quite a few hits from Christians using their favorite verses.  It would be better to do it in reverse, by having the client generate a random number sequence and translating that into a set of English words that can be printed, saved as an encrypted file to be stored elsewhere, or memorized.

the Electrum client generates a 128 bits random sequence and translates it into a set of English words...
see https://bitcointalk.org/index.php?topic=51397.0

Oh, sorry.

I was thinking more along these lines, and wondering if a passphrase plus a salt created by a standardized questionaire of usually secret personal info could be used, of the kind of questions that don't change.  For example, one such question could be "How old were you when you lost your virginity?" with multiple choice answers including each age from 12 to 24, and an option like "does not apply/refuse to answer" so that the multiple choice questionaire could take all such answers, as well as the numbers of the answers that users refuse to answer, and create a salt that could produce a unique.  The questions would have to be high in number, and of a standardized order so that a user could concievablely reproduce the wallet.dat while be unique enough that it won't produce wallets that could collide.  It would have a bias, as all such questionaires do, but it should a long enough of a questionaire that such a bias isn't predictable and of such personal info that users aren't going to answer such a questionaire outside of the context of the client.

I am going to say it right here and right now: This is the future.

I don't seem to be able to make a second payment until the first is in the block chain ...

Deterministic wallets are much more elegant as far as backup regimes. Personally, I'd prefer to have a two part seed = (random + memorized). But the only real show stopper the Satoshi/C++ client presents me is regarding bandwidth. I'm often in situations where even one MB is prohibitively expensive for bitcoin to be practical. Can Electrum quickly and cheaply discover a wallet balance and send and verify a transaction from cold startup?

Thanks. I'm looking through the API to get an overview of the separation of concerns/tiers. It'd be nice to see a schema:

==============
Generic Servers:
blockchain instance
==============
Interface:
address balance check --> any server
signed transactions --> any server
==============
Client:
private seed,
cache of private keys
public address/transaction labels
==============

On the main page I read:

On debian I see a python-pycryptopp package that should do the job for pycrypto I guess.

But what is the equivalent of ecdsa on debian?

pycrypto is no longer used.
see the announcement in the main thread: https://bitcointalk.org/index.php?topic=50936.msg635247#msg635247

Would it be possible to generate the seed from camera input, perhaps using facial recognition data?

of course, but must make the original data solid, constant,

little difference will totally change the hash.

Teoretically it's possible (OpenCV library provides face detection algorithms with python binding).

But I cannot imagine it will work in reality. I mean - to be secure enough to generate the same seed for the same face (aging, beard, face injuries, ...) and generate enough entropy for different faces.

Yes, that's what I thought. I've been looking for methods of collapsing the complexity after acquisition, but so far the only solutions result in a decrease of data quality/resolution.

Thinking out loud here: it would probably be more appropriate currently to offer facial recognition at the device or application level for unlocking access to a pre-generated seed.

Thanks to both for your input!

Someone could always take your picture and steal your key as your face isn't private. It could be used as the salt though.

I think he gets your point and that's why he said the application would give you access to the seed instead of generating it.
I think he wants to use facial recognition but he wants to store the seed within the app (so you can still lose it).

Yes, you're right.

Hi!

 How hard is to implement a version of Electrum for Litecoin and Namecoin (this with 1-click registration domains built-in)?

Best!
Thiago

ThomasV, do you have any future plans on an Android client? Your implementation shows a lot of promises for phone devices.

I will not develop an android client, but I have started to implement BCCAPI-type functions in the server.
The goal is to be able to use a slightly modified version of BitcoinSpinner directly with the Electrum network.

Hello Thomas!

I really liked your Electrum client - small and immediately usable! The QR showing feature is very useful for mobile clients!

There is a small bug which prevents from restoring the wallet, but I have fixed it and sent you a merge request.

It would be nice to see QR-code printing (for later offline use) and QR-code recognition from the webcam!

thanks! I merged it, and immediately released version 0.36b

Thanks, great answer. I just read about BitcoinSpinner and it is open source so it shouldn't be that much work to modify it. I hope whoever does it implements deterministic key generation as well. That way I could use the same wallet seed on my phone and my computer and get a shared wallet without need for synchronization.

I haven't been able to try your client yet since I'm away from my linux computer and the windows version doesn't seem to work for me (everything seems to work except I'm not able to get any recieve adresses), but it seems very appealing to me and I can't wait to try it. Regardless, I have a few feature requests.

1. I think the send tab should have a "choose contact" button. It could be a bit confusing to have two different tabs for sending bitcoins depending on wether you know the reciever or not. I think it would make more sense if the main purpose of the contacts tab only was to manage contacts. Chossing a contact from the contacts tab should bring you to the send tab.

2. Also, you should be able to just write the nick name of a friend from the contact book in order to send money (maybe this is already the case, I haven't ben able to try this feature). No need to mess around with adresses. If I write "friend" and "friend" is associated with an adress the client should recognize it. Auto-completion for this would also be neat.

3. Multiple wallets would be a great feature for those like me that want shared wallets. If I have 3 wallets on my computer, one could be my savings account, one could be shared with my girl friend and one could use the same seed as my android phone. With a nice UI, this would make money management really easy.

Hi,

I am not too technical, so maybe this question does not make sense.

I am confused because I can't understand what would happen if someone would manage to hack "deterministic key generation" algorithm and therefore get access to all the seeds?

Do you still need to enter your "passphrase" after you restore your wallet?

Tnx.

that's the goal indeed

this is strange. care to give more details?

this is how it works in the standard bitcoin client. I find it awkward, because you end up having a dialog that shows exactly the same thing as your list of contacts

I agree. these are good ideas.note that you can already handle multiple wallets with electrum, although not simultaneously.

there are two secrets: your encryption password and your key generation seed.
to access your wallet, you need access to:
your seed OR ( your password AND your encrypted wallet file)

which one do you refer to when you write "passphrase"?

Sure. I know I have a wallet seed at least, because if I press the s button in the corner i get my seed together with my mnemonic code. I have also managed to encrypt the wallet with a password which seem to work fine as well. It's the recieve tab that doesn't seem to work. If I look at your screen shot of this tab you have a "New adress" button in the bottom left corner. I don't. I have a "QR" button and a "Copy to clipboard" button, nothing else. The field where my adresses are supposed to be is completely empty and without the "New adress" button I don't seem to be able to generate any adresses.

that's normal. the screenshot is old.
that's not normal. any error message in the console when you create your wallet?

I have had some problems creating wallets (at least before the last update). Sometimes it just printed one address and then it gets stuck.

In addition, it sometimes freezes when I want the balance. The GUI seems to work in those cases. (This has happend after the update as well.)

Hi,

thanks for reply.

So... i have my wallet and it is encrypted with my "passphrase". I have to enter it if i want to send BTCs.

What i wanted to ask is: does "passphrase" matters if somebody hacks (or otherwise gets) my secret seed?

My concern is... if someone hacks "deterministic key generation" algorithm... then every electra user is in danger, right?

Tnx.

The generation algorithm isn't what needs to be hacked.  The seed private key would have to be hacked.  This doesn't even really make sense if you know how public/private keys work. 

If private keys could be discovered in some way then all of bitcoin (and banks and more) are at risk, not just electrum users.

Hello

I have succesfully run Electrum on my ARM Ubuntu system.

Many thanks for this work so far.

But my understanding of "the client" topic is still marginal.
I would like to run p2pool on that ARM system wich needs a bitcoin client to supply the chain.
(Recompiling the original client for ARM has been unsucsessfull on my side so far)

Do you consider Electrum suffiecient for p2pool or is it missing some parts that would be nessesary.

I hope those aren't to dumb questions.

Thanks in advance

no, this will not be sufficient.
if you could not compile the original client, perhaps you should try libbitcoin?

Thank you for the quick answer Thomas

I will have a look into libbitcoin.

([offtopic] Maybe someone else could try on an ARM compilation of the original client)

I would simply be a cool thing to have a 4 W p2pool full integrated host. :)

I'm looking to do an ARM build on a raspberry_pi once they are released, which should be any day...

marked

Update:

I have successfully compiled the bitcoind original headless client for the ARM.
I currently working on making the whole p2pool system running.
The rasberry pi would need a new compilation as it uses a different processor.

Maybe i make a new thread afther i have successfully completed the system
and offer a downloadable SD card image.

Sorry for all the offtopic here.Will move to a own thread.

the raspberry pi has a downloadable qemu package so you can do dev work now on I think debian, ubuntu and fedora remix.

can you PM me the thread if I haven't picked it up? thanks.

marked, awaiting the 29/02/2012 0600UTC raspberrypi.org announcement.

I just added added a new item to the Electrum feature list:

Electrum is ubiquitous: You can use the same wallet on several computers. All instances of your wallet are automatically synchronized, thanks to "type 2" deterministic key generation. In fact, your wallet is "in the cloud", and that cloud is the Bitcoin blockchain!

Hello,

I've been using Electrum for few weeks now and it is my favorite desktop wallet! I'd like to thank developers for this great peace of software!

I have few questions if someone can help me out:

1. i don't understand why new addresses automatically appear in "Receive" tab.

2. Is it normal that "description" string (while sending BTCs) does not become "label" string in "Contacts" tab?
Official client works this way and I quite like that feature.

3. Why there is no icon for "password" in bottom right corner (XP port)? I see one in Ubuntu.

4. Is there any plan for OSX version? That would be great!

@ThomasV: will this new feature allow 2 or more Electrum clients to be open at the same time and also to be used at the same time or would that cause problems?

Thank you.

thanks! I will try to help you.
your wallet generates new addresses everytime one of the last five addresses of its list is used.
this in order to ensure that all instances of a given wallet are synchronized.
(you can increase this parameter if you think that 5 in not enough, by editing the wallet file.)
Problems occur when a given address is used in several transactions.
However, we could display a the description as "default label" for adresses that have no label. would that suit your need?
this is probably a bug.
can you post a screenshot?
also, do you use the binary version, or the python source?
I believe that the python source code can be used on OSX. please share your experience if you have tried and encountered problems.
it is not a new feature, it has been there for a long time.
yes, you can open multiple clients at the same time. you can open the same wallet on different computers, or different wallets on the same computer.

Thanks Thomas!

That would be perfect!

I use binary on XP. It is the same with Cameyo or BTCurious build.
There is also no program icon (but there is a nice icon in startup menu).

http://www.minimal.si/dl/web/electrumpwd.jpg

I am not a programmer, so i would need step by step guide to try my luck : )

the lock icon is a svg, while other icons are png; this might have to do with it.

I love that electrum can be used as a simple text only client (something I need) without needing to have a long running process there. The one thing I couldn't immediately do (though I'm sure it wouldn't be hard to fix if not yet supported) is being able to import public addresses to monitor, without having to also store their priv keys.

Did I just miss the way to do this?

no, you did not miss the way to do it :-)
ovidiusoft was willing to implement monitored addresses, but I think he's been too busy lately.
for the moment I am concentrating on ithe client/server protocol.

I need a good excuse to look at the source code, so I might take a stab at that if I get a little off time.

that would be fantastic

Hi,

I noticed one small thing. If bitcoin amount is exact integer (1, 2, 3, ...) the amount is shown as "1." or "-2." instead of "1.0" or "-2.0".

I noticed that some servers arent updating. For example i made a payment that should appear in my wallet but even after 10 confirmations at blockchain.info nothing showed up. I then chose a new server electrum.pdmc.net and it showed 206892 blocks. And my money. I then switched back to electrum.novit.ro and it showed 206844 blocks. And my transactions isnt included obviously.

I dont know if the new server is forcing a transaction fee so if i will keep him but that servers arent updated doesnt work in my opinion, so a solution has to be found i think.

Thanks!
Sebastian

Quick questions:

How can I use a wallet with a name other than electrum.dat and on a custom location?

Is your wallet encryption as safe as a TrueCrypt volume?

Do you plan an official "portable" release?

Thank you.

You can run electrum with a parameter:
electrum --wallet=/wallets/mywallet.dat

It isn't possible with the windows version, it doesn't support command line.

That's something the developers are working on atm...

How long can it take for a transaction to show up in an Electrum wallet? I purchased a gift card from kevwang95 for BTC1.5 to this payment address: http://blockchain.info/address/1LHmGT39uLJYSfeKVbgUP5vAgrhf1GaqMK

I sent the payment at 9:09PM EST, and the blockchain shows two confirmations. kevwang95 says that he doesn't see the transaction in his history tab in Electrum, and the balance is 0.

I don't have much experience with Electrum, so I just want to make sure he gets the payment for the sale. Does it take a while for it to show up in Electrum?

EDIT: kevwang95 sent me this screenshot (https://i.imgur.com/4mkMIik.jpg) of Electrum showing that the payment still hasn't shown up after 2 1/2 hours. It looks to me like he copied the correct address, which is the one I sent the payment to. Blockchain currently shows 13 confirmations, and my wallet has full confirmation of the payment being sent. I'm thinking there's some sort of glitch or technical issue with his client, but I don't have any experience in using it. If anyone can reply with some help to give him, or if they can PM him directly, I'd greatly appreciate it.

there was a server-side problem. I restarted my server, and the transactioni should show up now.

He messaged me this morning saying the transaction went through. Thanks!

Awesome, thank you.