[ANNOUNCE] Android key rotation

[molecular]

very quick。

It would be a huge problem if it wasn't quick enough.

So, I think it's a huge problem, check the date of this post:
http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html

This was known for even longer. The news was discovery of weakness in apache harmony RNG used by android.

[1714095812]

1714095812

[1714095812]

1714095812

[1714095812]

1714095812

[1714095812]

1714095812

[1714095812]

1714095812

[niko]

@casascius: do you know about this page: http://www.random.org/bytes/ ? that could also be a source, which could replace the mouse-moving-timestamp thing because it comes from an external source.

Sure, though I have every reason to believe their bytes are truly random, for security purposes, I don't.  When I generate keys, the machine doesn't have internet access anyway, so I suppose it's just an alternative (sub)string to paste as a response to the "keyboard mash" if I want to copy it in with a flash drive etc.

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

You may be missing the point here. There is more than enough entropy available in a phone or a PC. The problem is with human errors when coding and otherwise implementing the RNG. In this case, lazy Google employees who copy-pasted broken Apache code without reviewing it, and didn't even bother fixing it or rewriting the documentation when some of the flaws were made public half a year ago.
Building your own hardware, by yourself, will likely lead to more errors.

[casascius]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

[phatsphere]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

instead of *radio*active material, you can use *radio*waves. just tune in a lower kHz frequency where a lot of noise from the earth's atmosphere is audible. that's one of the sources providers like random.org use. i guess it's pretty easy to get this running and then pulling the bytes from the A/D converter of your soundcard.

[justusranvier]

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

Pick up some banana from the grocery store next time.

[P_Shep]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

dismantle a smoke detector

[stereotype]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

dismantle a smoke detector

Or a bowl of brazil nuts

[ralree]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

Actually, you can just push a transistor into avalanche - it only take a few discrete components:

http://holdenc.altervista.org/avalanche/

[TippingPoint]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

dismantle a smoke detector

Or a bowl of brazil nuts

Formerly known as ...

[Lauda]

dismantle a smoke detector

Or a bowl of brazil nuts

Formerly known as ...

the hero of?

[niko]

dismantle a smoke detector

Or a bowl of brazil nuts

Formerly known as ...

the hero of?

Quit generating randomness, and get back to the topic. I read in the news that Google has acknowledged the problem, and recommends developers use dev/(u)rand. Good luck patching Android with third parties between Google and your phone.

[justusranvier]

Good luck patching Android with third parties between Google and your phone.

It bet Cyanogenmod users get access to the patches first.

[allbiznessman]

So, does this only affect Android wallets (Private Keys) generated by the Android wallet apps, or would my BTC address which I already had and then added to the blockchain wallet app also be affected? I hope not, cause I like keeping the same address for Public use, and then moving the BTC into my private addresses, never revealing public keys or addresses.

[Rannasha]

So, does this only affect Android wallets (Private Keys) generated by the Android wallet apps, or would my BTC address which I already had and then added to the blockchain wallet app also be affected? I hope not, cause I like keeping the same address for Public use, and then moving the BTC into my private addresses, never revealing public keys or addresses.

It only affects addresses/keys that are generated on Android.

[Carlton Banks]

You should make your own hardware for pulling random data for your coins. Something like a geiger counter near a radiation source. Now that would be truly the best source for truly random data.

(Unless if you distrust the laws of physics  )

I would have, but at the time, I was fresh out of radioactive material. Maybe next time.

Lol, how long before the FBI kicks your door in? Didn't everyone get the memo that making online jokes about possessing WMD's are indistinguishable from sincere admissions? 

[niko]

So, does this only affect Android wallets (Private Keys) generated by the Android wallet apps, or would my BTC address which I already had and then added to the blockchain wallet app also be affected? I hope not, cause I like keeping the same address for Public use, and then moving the BTC into my private addresses, never revealing public keys or addresses.

It only affects addresses/keys that are generated on Android.

This is incorrect. The problem also affects imported keys if they were ever used to send funds from an android client.

[Gator-hex]

a component of Android responsible for generating secure random numbers contains critical weaknesses

or did someone just forget to seed it properly?

"Everytime I give a seed and try to generate 100 numbers, they all are the same. Please help."
http://stackoverflow.com/questions/12458383/java-random-numbers-using-a-seed

 

[BurtW]

a component of Android responsible for generating secure random numbers contains critical weaknesses

or did someone just forget to seed it properly?

"Everytime I give a seed and try to generate 100 numbers, they all are the same. Please help."
http://stackoverflow.com/questions/12458383/java-random-numbers-using-a-seed

 

The referenced posting is unrelated.  It concerns a person not understanding the Random() function and the fact that every time you use the same seed for that function you get the same sequence.

They are using Random() we are discussing SecureRandom(), two different functions.

However, as far as I can tell the problem with the SecureRandom() function did have to do with seeding, it is just not the same seeding issue discussed in the link.

[molecular]

Let's talk bitcoin episode about the issue. http://www.youtube.com/watch?v=4zTocJflyS8

Contains interesting interview with Andreas Pettersen ((co-)author of mycelium wallet)

Apparently under certain circumstances (some fallbacks) the entropy of the android RNG drops to just 9 bits.

Did anyone find more information about what exactly is going wrong?

[casascius]

I would feel much better if bitcoin wallets generated new addresses using the following method:

SHA256(something_from_SecureRandom + some_user_supplied_constant + some_incrementing_counter + current_system_time/tickcount)

The "some_user_supplied_constant" could be nothing more than a string collected from the user upon first invocation of the program, and perhaps even saved to a config file.  It serves the same purpose as salt.  Because the user supplies it, it's pretty easy to verify that it isn't predictable.  It will have relatively poor entropy, but would successfully serve the purpose of making mass cracking of insecure random numbers pretty much impossible, as well as verifiably ensuring that there is some portion of the input that is truly unpredictable by an outside attacker.