Ninjastic
PostEdited versionsQuotes to this post
Post
Topic
Board Electrum
Re: [ANNOUNCE] Electrum - Lightweight Bitcoin Client
by
ColderThanIce
on 04/08/2015, 12:57:22 UTC
Quote from: HPt on August 04, 2015, 11:16:37 AM
Quote from: HPt on July 31, 2015, 10:18:24 AM
Quote from: mustyoshi on July 30, 2015, 04:04:35 AM
Quote from: HPt on July 30, 2015, 12:05:44 AM
I just realized that the Master Public Keys of the three wallets I just created with Electrum 2.3.2 all start with "xpub661MyMwAqRbc...".
"xpub" certainly is a marker for identifying the String as a Master Public Key. However, do the other coinciding letters have to be always the same or do they result from a lack of entropy in the generation process?
Check the private keys to be sure.
Where do I find the private master key?
In any case: Either every master public key has to begin with "xpub661MyMwAqRbc..." or there is some lack of entropy when generating the seed. In the latter case this would be an issue with Electrum. Other programs require the user to move the mouse or hit keys on the keyboard in order to supply entropy; Electrum on the other hand generates the seed without user interaction. So, I wonder how Electrum ensures a truly random seed.
Quote from: ColderThanIce on August 03, 2015, 08:34:32 PM
Quote from: BadAss.Sx on August 03, 2015, 08:32:09 PM
Wallet - Master Public keys gives you the MPK (mac that is)
It does as well on Windows, but HPt was asking how to get the master private key. At first I thought he was asking about the pub key and thought the same as you.  Wink
I asked for the private master key, because mustyoshi suggested to check it. But, as I wrote, my concern is about the fact that the master public keys that I generated start all the same. I would be happy if someone could clarify which part of the master master public key string ought to be random and which part contains some other information (such as the "xpub" part). If the part that starts the same actually should be random then electrum has an entropy issue. Another (unlikely) possibility would be that my electrum version is compromised. (I use the Windows version 2.3.2 which I downloaded from the official website as version 2.4; as OmegaStarScream pointed out this is a bit strange.)

I generated a couple of new wallets and here are their master public keys:

xpub661MyMwAqRbcGEUSdYvF2MDjcfdm79asccSYHq3jMAPWwkJiLbRtv4rWAS4St6cjupyh72iH85GggEPuRuA5ifA7UE1 KJz9r6sobkqzNZBa

xpub661MyMwAqRbcFKQySfiyDSpZ72zjry4WEbSDpXek7ADXFcS5oSExMku4z4FhX7sQEyJgaUeN48xMCpuTtRvBHH2cr8N TaL6fBHkrFeNryEV

Both begin with xpub661MyMwAqRbc but after that they're completely randomized. So the first 16 characters are always the same, but the last 95 characters should be random.

As for your Electrum install being potentially compromised: The reason that you downloaded 2.3.2 when the site says that the latest release was version 2.4 is because there currently isn't a compiled 2.4 version of Electrum for Windows, or OSX. Only Linux offers an easy install of 2.4. If you want to be extra sure that your Electrum install isn't compromised, then you can verify the checksum of the installer with what ThomasV has signed with his PGP as what the checksum should be. If ThomasV's PGP signed message of the checksum is valid, and the checksum matches that of the file you downloaded, then you can be sure you aren't using a compromised version of Electrum.