Post
Topic
Board Announcements (Altcoins)
Re: NXT :: descendant of Bitcoin - Updated Information
by
Eadeqa
on 07/02/2014, 18:53:07 UTC
Critical bug disclosure

Few days ago the guy who found a vulnerability in Blockchain.Info and picked the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm.

Can someone explain how he found out the passphrase of the genesis account?

    "It was a bright cold day in April, and the clocks were striking thirteen."

It has 14 words and some punctuation. Ignoring the punctuation and using a simple 2000 words long dictionary (and this is tiny! There are 1013913 words in the English language) we get 2000^14 possible passphrases, or about 10^46 possibilities, if we go by characters from the alphabet, it has 26^72 ~ 10^101 possibilities. A password written in base 58 and 26 characters long is also about 10^46 possibilities. In comparison, a random 8 character long password takes 3 hours to crack on a desktop pc. 9 char -> 3days, 10 char -> 1 year, 11 char -> 48 years. 26 char -> An octillion years.

Now it is a given that the entropy of a random password is much higher than that of a phrase from a novel, but I still can't see how he could crack the passphrase unless the entire thing was already in his dictionary! Let's not forget he was using a python script which is notably slow!

Google for "It was a bright cold day in April, and the clocks were striking thirteen" (with quotes)

shows 506,000 results

https://www.google.com/search?num=100&newwindow=1&rlz=1C1CHMO_enUS560US560&espv=210&es_sm=122&q=%22It+was+a+bright+cold+day+in+April%2C+and+the+clocks+were+striking+thirteen%22&oq=%22It+was+a+bright+cold+day+in+April%2C+and+the+clocks+were+striking+thirteen%22&gs_l=serp.12..0i7i30l3j0j0i30l4j0i8i30j0i30.4660.4660.0.6104.1.1.0.0.0.0.93.93.1.1.0....0...1c.1.34.serp..0.1.93.GxjJ0e2D-xw


so it wasn't a random collection of words, but well known phrase. First sentence from George Orwell's book

http://ebooks.adelaide.edu.au/o/orwell/george/o79n/chapter1.1.html