Quote from: cryptoking555 on December 31, 2017, 07:09:28 AM

The author seems to be implying there is a flaw with the RNG (I assume your reply assumes the RNG is not flawed).

The author is suggesting that IF there is a flaw in the RNG that YOU are using THEN "it becomes possible for someone to use multiple signatures from the same private key to compute that private key and steal your bitcoins".

If you don't re-use the address, then that is less of a concern. A poor RNG used when generating the signature is less significant if you don't re-use the address.

Under NORMAL use (where your RNG and signature generating software is not compromised), ECDSA is CURRENTLY sufficiently secure to re-use addresses.

However...

WHY would you INTENTIONALLY expose yourself to the POSSIBILITY that your RNG MIGHT not be as good as you'd like?

WHY would you INTENTIONALLY expose yourself to the POSSIBILITY that a weakness in ECDSA MIGHT be discovered in the future?

WHY would you INTENTIONALLY reduce your own privacy AND the privacy of those that you engage in transactions with?

Especially, when you can improve all 3 of those situations by simply generating a new address for EVERY transaction? A business wouldn't re-use an invoice number, why would you re-use a bitcoin address?

A bitcoin address is NOT an account number. A bitcoin address is something that you give to a single entity for a single purpose, so that you can identify when that entity has paid you for that purpose.

Lets imagine that I have a single address that I use for everything. Lets call it 1ThisIsReallyStupid.

Now, lets say John offers to buy something from me. I give John my address "1ThisIsReallyStupid" and tell John I'll ship it as soon as I see a payment. Now lets say Mike, who has purchased from me in the past, sends me a payment and an email saying "Hey Danny, I just sent you a payment, can you send me some more of your awesome product?". Unfortunately, I don't immediately see Mike's email, so I assume that the payment was from John. I ship John the product. Then I see Mike's email!

Oh noes!

John is now receiving product that he never paid for! How could I possibly have avoided this terrible problem???

Oh, wait. Lets hop back in our time machine to the first time I ever engaged in business with Mike...

"Mike, the address FOR THIS TRANSACTION is '1UniqueAddressForTransaction001'. As soon as proper payment is received at that address, I'll ship the product. Please contact me for a new address for any future shipments."

Now we can fast-forward to the present where John wants some product...

"John, the address FOR THIS TRANSACTION is '1UniqueAddressForTransaction002'. As soon as proper payment is received at that address, I'll ship the product. Please contact me for a new address for any future shipments."

Then Mike fails to follow instructions. He sends to the ONLY address for me that he has EVER known '1UniqueAddressForTransaction001'. and sends his email.

John's product does not get shipped, because '1UniqueAddressForTransaction002' is STILL UNFUNDED! Wow! Amazing how well that works.

I send a quick email to Mike:
"Mike, our order tracking system uses bitcoin addresses as invoice numbers. Your payment to '1UniqueAddressForTransaction001' will not trigger shipment on your new product order since that shipment requires the appropriate funds to be sent to '1AddressAlsoUniqueForTx003'. Would you like us to forward the funds from '1UniqueAddressForTransaction001' to '1AddressAlsoUniqueForTx003' on your behalf or would you like us to send those funds back to you (if so, please provide a bitcoin address to send to)? Note that (as indicated in our terms of service) re-sending funds that have been sent to an incorrect bitcoin address will incur a 0.002 BTC fee per transaction received by us."

Quote from: haltingprobability on December 31, 2017, 06:55:13 AM

The advice against address-reuse is based on the general risk of future breaks against ECDSA, which cannot be ruled out.

Actually, I think the advice against address-reuse is based on the concept that it reduces both your own privacy AND the privacy of everyone that you engage in transactions with.

The slight protection against "future breaks against ECDSA" is an added side-benefit, but not the most compelling reason.