[ANNOUNCE] Electrum - Lightweight Bitcoin Client

[BitcoinSitesOrg]

Hello ThomasV and all Electrum users!
Check out review of Electrum wallet on BitcoinSites.Org: bitcoinsites.org/electrum/!
Your wallet's rating is five stars !

[Michael_S]

Hi,

it seems that version 1.9.5 has a bug in the support of the command line command "mktx". Same happens also with "payto". In version 1.7.4 it worked well with "mktx". I did not check intermediate versions, so I don't know when the bug occurred between 1.7.5 and 1.9.5.

Here's what I am doing:
I am using  a deseeded wallet, containing both deterministic as well as a few imported key (but probably that is not important).

Any of the following commands...

Code:

$ electrum mktx -w electrum_deseeded_wallet.dat -F 1mySourceAddrOfMyDeseededWallet -c 1mySourceAddrOfMyDeseededWallet 1theTargetAddressOfMyUnsignedTransaction 0.0002
$ electrum -w electrum_deseeded_wallet.dat mktx -F 1mySourceAddrOfMyDeseededWallet -c 1mySourceAddrOfMyDeseededWallet 1theTargetAddressOfMyUnsignedTransaction 0.0002
$ electrum -w electrum_deseeded_wallet.dat -F 1mySourceAddrOfMyDeseededWallet -c 1mySourceAddrOfMyDeseededWallet mktx 1theTargetAddressOfMyUnsignedTransaction 0.0002
$ electrum mktx -w electrum_deseeded_wallet.dat 1theTargetAddressOfMyUnsignedTransaction 0.0002
$ electrum -w electrum_deseeded_wallet.dat mktx 1theTargetAddressOfMyUnsignedTransaction 0.0002

(of course I used proper valid addresses instead of the place holders above)

...gives the same error, as follows:

Code:

Traceback (most recent call last):
  File "/usr/local/bin/electrum", line 291, in <module>
    seed = wallet.get_seed(None)
  File "/usr/local/lib/python2.7/dist-packages/electrum/wallet.py", line 687, in get_seed
    self.accounts[0].check_seed(seed)
  File "/usr/local/lib/python2.7/dist-packages/electrum/account.py", line 112, in check_seed
    raise Exception('Invalid password')

This makes no sense, because in the case of the deseeded wallet I am not supposed to provide any password (and in 1.7.4 it worked as expected).

FYI: I am using Xubuntu 13.10 that comes with python version 2.7.5+ from 19 Sept 2013.

For comparison: When using a seeded wallet...:

Code:

$ electrum mktx 1theTargetAddressOfThisTransaction 0.0009

or

Code:

$ electrum mktx -w electrum_seeded_wallet.dat 1theTargetAddressOfThisTransaction 0.0009

...it works as expected.

[Michael_S]

oh, one more thing: In 1.9.5, importing private keys via command line did succeed, but the on-screen outputs did say that it had failed.

And generally, I had troubles installing 1.8.1 or 1.9.1 (I wanted to check when the bug described in previous post showed up first), so now I reverted back to version 1.7.4, which seems to run stable, the installation did not give any error messages.

As said, I am running latest (x)ubuntu 13.10.

[nioc]

I would like to have more than one Electrum wallet on my computer.  How would I do this?

[Tachikoma]

Multiple versions of Electrum? Or multiple wallets? The -w flag will give you the option to specify a wallet from the command line. File-> Open should work as well.

[adamas]

I tried to make an offline tx using the 1.9.5 portable build with the on/offline wallet method. The deseed command (console) doesn't work!
Then I tried the recover the (watch only) wallet with the MPK method: Not possible to use a previously imported key, the imported address has disappeared.

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

[Bounty] 0.06 BTC for a short, straightforward and easy to understand tutorial on how to create and broadcast offline transactions (no bounty for just copying already existing tuts). It should include 2-3 different easy approaches (procedures), using electrum, blockchain.info/pushtx and/or else.
Bounty goes to the first practical tut - PM only!

[Michael_S]

I tried to make an offline tx using the 1.9.5 portable build with the on/offline wallet method. The deseed command (console) doesn't work!
Then I tried the recover the (watch only) wallet with the MPK method: Not possible to use a previously imported key, the imported address has disappeared.

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

[Bounty] 0.06 BTC for a short, straightforward and easy to understand tutorial on how to create and broadcast offline transactions (no bounty for just copying already existing tuts). It should include 2-3 different easy approaches (procedures), using electrum, blockchain.info/pushtx and/or else.
Bounty goes to the first practical tut - PM only!

I have made two such descriptions and claim the bounty for descriptions for two different ways - one using Electrum, the other using no Bitcoin client SW at all - will send sent you a PM!

Update: For the curious bitcoin community: My Tutorial (two tutorials for the two methods mentioned) is here:
http://dl.dropbox.com/u/18219492/Bitcoin/TutorialsSecure_OfflineTransactions.zip
All-in-one-Tutorial - I recommend this one: Here (simple plain HTML file).
Please feel free to include the "Electrum workflow" description with text & illustration to the Electrum documentations.

PS: For Armory I just found a nice (but long 71 slides!) presentation here (odp format or pdf format), with a nice description of the basic offline-signed transaction workflow on a single slide, slide #51 "Doing an Offline Transaction" (setup described on slide #50).

[adamas]

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

I tried to start the portable client from the command line by typing "electrum deseed" - doesn't start! ("electrum" without the deseed command works)

How about just deleting the private key of the imported address in the wallet file? This should make it "watch only".

[Michael_S]

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

I tried to start the portable client from the command line by typing "electrum deseed" - doesn't start! ("electrum" without the deseed command works)

How about just deleting the private key of the imported address in the wallet file? This should make it "watch only".

...or you deseed the wallet using Electrum 1.7.4...

[adamas]

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

I tried to start the portable client from the command line by typing "electrum deseed" - doesn't start! ("electrum" without the deseed command works)

How about just deleting the private key of the imported address in the wallet file? This should make it "watch only".

...or you deseed the wallet using Electrum 1.7.4...

 Does it work with the port build? Where can I download it?
 PM sent to you!

[Michael_S]

Now I wonder: Is this only a portable build issue? Is the "deseed" command not working anymore?

I tried to start the portable client from the command line by typing "electrum deseed" - doesn't start! ("electrum" without the deseed command works)

How about just deleting the private key of the imported address in the wallet file? This should make it "watch only".

...or you deseed the wallet using Electrum 1.7.4...

 Does it work with the port build? Where can I download it?
 PM sent to you!

Oh, well, I am using Linux only, so no experience with the windows portable version. I guess you can get the version 1.7.4 from ThomasV...

And I also guess that Thomas & Team will work on fixing the 1.9.5 bugs that the two of us have reported here ("deseed", "import", "electrum mktx"). Maybe all these bugs are common for windows (you) and Linux (me).

[adamas]

I think the easiest way to deseed a wallet (with imported keys) is just to open it in a text editor an delete the priv key(s), close and start again.

[Michael_S]

I think the easiest way to deseed a wallet (with imported keys) is just to open it in a text editor an delete the priv key(s), close and start again.

Hmm, perhaps that works for the imported keys. But for the deterministic keys (="native" Electrum keys), I assume that the "private seed" has to be replaced by the corresponding "public seed" (don't know if this is the correct terminology) , such that the infinite number of deterministic public keys can be generated in the Electrum instance on the Online PC.

So I would assume that if you just delete the private keys, then the "private seed" is still in the wallet file.

So to my understanding the term "deseeded" is a bit misleading, I think what actually happens when you create a "deseeded" wallet file is that you actually create a "de-privatised" wallet file (i.e. private keys removed, and deterministic "private seed" replaced by the "public seed", so some kind of "seed" is still inside).

Maybe some dev can confirm my understanding, I am just writing "out of my common sense" and from what I quickly read about BIP0032 deterministic keys, I am not a programmer of Electrum myself.

[Michael_S]

Hi ThomasV and all,

I am just realising that the workflow for Electrum offline transactions might have a vulnerability for attacks. This attack vector does not apply to the method "perform offline transactions without any client SW installed" that I describe in my Tutorial. About Armory - I do not know...

I will refer to this 3-step workflow as follows:
Step 1: Create unsigned transaction on Online PC
Step 2: Verify (??) and Sign transaction on Offline PC
Step 3: Broadcast signed transaction on Online PC

Here's the potential problem that I see:

• In step 1, some hypothetical malicious SW on the Online PC may manipulate the unsigned transaction by for example replacing the change address of my own wallet by an address of which the attacker owns the private key (this might be complicated for a malware to achieve since it would need to interfere with the way Electrum works, but theoretically this is well possible, and the difficulty to relize this attack is not to be debated here).
• Then in step 2, if the user does not explicitly memorize all his change addresses, he will not see that the second output of the unsigned transaction he is about to sign goes to a foreign address rather than to the own change address.
• In the method "offline transactions without client SW installed" this attack vector is not possible because the transaction is fully created on the Offline PC in step 2, not in step 1 on the Online PC. The step 1 is here only used to get the blockchain's transaction history for the address that I want to send from.

Question: Is my understanding true? OR does the Electrum offline instance in step 2 EXPLICTLY check whether the 2nd output of the transaction to be signed is an own change address (or the input address itself) or not. Actually, Electrum could do this check. And it could rise an alarm to the user if neither of the two output addresses belongs to the user's wallet. If not yet implemented, I propose to implement this to substantially improve Electrum's security for offline transactions.

Does anybody know whether Armory performs this check on its instance running on the Offline PC? (see slide #51, item (4) of this presentation)?!

Note: Of course, in the future, when supporting, multi-output transactions, such a transaction with two "foreign" outputs and no change address could be fully legit (albeit pretty unlikely), maybe the user does want to transmit exaxtly x BTC to address A and y BTC to address B, such that by accident there is no change left. In this case my proposed check in step 2 would raise a "false alarm". But that's ok, this would be an exceptional and very unlikely event, and the user could re-check and think twice and then sign in step 2 if he is really sure that the transaction is correct. For now Electrum does not support this anyway (at least not that I know), so this "false alarm" problem is something for the future.

[ThomasV]

...

you are right. currently, the offline wallet does not check that the change output actually is a change address.
thanks for pointing it; it should be relatively easy to fix.

[nimda]

This is a good idea. I haven't used Electrum in a while, but allowing the offline computer to display which outputs go to an address for which it has the private keys is a good idea.

[nioc]

Multiple versions of Electrum? Or multiple wallets? The -w flag will give you the option to specify a wallet from the command line. File-> Open should work as well.

Let me preface by saying my computer literacy is limited.  I checked the Electrum FAQ and did not see this covered.

My intention is to divide my btc so that if something bad should happen I do not lose them all.  I have read about offline wallets as well as discussion here but I feel I won't really know understand them until I actually use one.  My first thought was to have multiple versions of Electrum as I did not know about the option for multiple wallets.  I have version 1.8 and see that File>Open brings me to the .dat file.  I would have no idea what to do after that to create another wallet.  I don't know what -w flag is.

I was considering dividing the btc at least 3 ways.  What would you recommend?  Thank you.

[Michael_S]

...

you are right. currently, the offline wallet does not check that the change output actually is a change address.
thanks for pointing it; it should be relatively easy to fix.

Thanks, great. BTW - I just got confirmed from Alan that Armory has this check already included.

[Abdussamad]

Multiple versions of Electrum? Or multiple wallets? The -w flag will give you the option to specify a wallet from the command line. File-> Open should work as well.

Let me preface by saying my computer literacy is limited.  I checked the Electrum FAQ and did not see this covered.

My intention is to divide my btc so that if something bad should happen I do not lose them all.  I have read about offline wallets as well as discussion here but I feel I won't really know understand them until I actually use one.  My first thought was to have multiple versions of Electrum as I did not know about the option for multiple wallets.  I have version 1.8 and see that File>Open brings me to the .dat file.  I would have no idea what to do after that to create another wallet.  I don't know what -w flag is.

I was considering dividing the btc at least 3 ways.  What would you recommend?  Thank you.

What operating system are you using? The -w flag is used on the command line. So for windows you have to bring up the command prompt and for Mac OSx and linux startup a terminal/console program. The do the following:

cd [some directory where the wallet file will be stored]

For example /home/user/.electrum

cd /home/user/.electrum

The run electrum with the -w flag:

electrum -w my_new_wallet

[nioc]

XP

Seems like you are giving me instruction on how to use "command line" to set up another wallet within Electrum.  I have never used command line as suggested by my preface.  I assume using File>Open does the same thing? 

That still leaves the main question of what would be best to do.  Is it correct to assume that it is better not to have all your btc in one place?  If so, is there any difference in safety or security between having multiple wallets in Electrum as opposed to having multiple versions of Electrum?