BTC RDSA signature vulnerability found.

[reflekse]

Hello all,

I have thought long and hard on how to approach this. I have discovered a vulnerability that significantly affects the security of primarily satoshi-era wallets. I won't elaborate too much until I am in contact with a trusted BTC developer. I would ask they prove their identity through some PGP signature as well if they have one. Please point me in the right direction. This is serious. Thank you.

[eternalgloom]

Oh, really?

There is officially no dedicated signature algorithm scheme called RDSA within Bitcoin's security mechanism!

Since Satoshi era Bitcoin has utilized ECDSA with secp256k1 curve.

Next major upgrade for Bitcoin, Schnorr signature are introduced through Taproot.

I am not aware of any connection whatsoever between Bitcoin and RDSA.

[DaveF]

And anyone who wants to can easily find info on how to reach out to the developers. It's not like they are hiding.
They don't have to prove anything about who they are if you contact them.

OP is either clueless or a troll.

-Dave

[BitMaxz]

Why not explain here about the vulnerability instead of looking for a BTC developer? We might be able to give you a solution about this vulnerability.

Or if you want to reach them, why not go directly to their GitHub page instead? They might notice you.

Here: https://github.com/bitcoin/bitcoin/issues

[TheButterZone]

Or https://web.libera.chat/#bitcoin-dev

[Orvexa]

Without revealing the exploit, can you identify the wallet software and versions you believe are affected? “Satoshi-era wallets” is a broad description. Clarifying whether your claim concerns a particular implementation or the signature scheme itself would help readers understand its scope while you arrange a private report.

[Geofingerprintgeo]

I think you may have mixed up your acronyms. Bitcoin does not use RDSA. Since the very beginning, Bitcoin has used ECDSA with the secp256k1 curve. Later, Schnorr signatures were introduced via Taproot. RDSA is a variant of DSA that was proposed in academic circles around 2002, but it has never been part of Bitcoin's protocol. So claiming a vulnerability in "BTC RDSA" is technically incorrect and will only confuse people.

[PrivacyG]

Why not explain here about the vulnerability instead of looking for a BTC developer? We might be able to give you a solution about this vulnerability.

OP says they found a significant vulnerability that affects some Wallets and you are telling them it is better to publicly explain how it works than to contact some body who can patch it up?  Are you serious?

[alani123]

You can find Jameson Lopp's PGP key and several contact mediums on his keybase account:
https://keybase.io/lopp

[Sticky Bomb]

Why not explain here about the vulnerability instead of looking for a BTC developer? We might be able to give you a solution about this vulnerability.

OP says they found a significant vulnerability that affects some Wallets and you are telling them it is better to publicly explain how it works than to contact some body who can patch it up?  Are you serious?

I believe he typed faster than he was thinking, I could only imagine how many black hats who were praying and hoping that OP listens to his advice and spills the beans in public. Such sensitive information should only find it's way to a public domain when the bug is fixed and the threat neutralized, that's if at all such publicity is necessary.

[BitMaxz]

I believe he typed faster than he was thinking, I could only imagine how many black hats who were praying and hoping that OP listens to his advice and spills the beans in public. Such sensitive information should only find it's way to a public domain when the bug is fixed and the threat neutralized, that's if at all such publicity is necessary.

That's not actually fast typing. I am trying to know if the vulnerability is true or not because there are many newbies trying to scam developers or someone about the vulnerability without basis.

I also wonder if it might be just an issue, not actually the vulnerability that the community can provide some solution to. Note this is a newbie approach; we do not know if this guy is telling the truth or not or trying to scam someone and get engaged and PMs about the vulnerability.

[ABCbits]

Or if you want to reach them, why not go directly to their GitHub page instead? They might notice you.

Here: https://github.com/bitcoin/bitcoin/issues

Or https://web.libera.chat/#bitcoin-dev

For any serious security disclose, AFAIK this contact should be more appropriate.

RESPONSIBLE DISCLOSURE
To report security issues: security@bitcoincore.org (not for support).