Quote from: o_e_l_e_o on May 10, 2020, 11:45:39 PM

Quote from: PrimeNumber7 on May 10, 2020, 10:21:08 PM

This is not entirely true, see this thread. In addition to leaking your private key, it could leak additional information.

Perhaps I didn't explain myself clearly. My point wasn't "There is no method by which it could leak information", but rather "There is no method by which it could leak information that I can't detect before I choose to broadcast my transaction". If the wallet attempts to reuse a k value, as in your example, then I could detect that by reviewing the source code and realizing it is not using a deterministic process for generating the k value, or by generating multiple different transactions and comparing the R values. The amount of trust you need to place in an airgapped wallet is much lower than the trust you place in any "live" software or mobile wallet, which could steal all your coins immediately upon you importing your seed phrase.

My described scenario would not necessarily reuse a k value. It could possibly use one of thousands of k values that would appear "random" unless you produced and inspected thousands of transactions that you ultimately did not broadcast.

Quote from: LoyceV on May 11, 2020, 02:21:27 PM

Quote from: PrimeNumber7 on May 10, 2020, 08:22:03 PM

Quote from: LoyceV on May 10, 2020, 03:27:30 PM

You need to trust the software you're using. It's a lot more difficult to compromise a coin flip than it is to compromise a recently sold paper wallet website.

You have to trust software to spend your coin when you spend it. When you sign a message or transaction, you combine what should be a random value with your private key to generate the signature. If you know one, it is trivial to calculate the other with a given signature. Malicious software could possibly leak information via this random value.

That can't be a problem as long as you use the address only once, right?

No. The point of my hypothetical attack is to leak information that is more valuable than a single private key, such as a seed list. Your seed list might be able to calculate many private keys that hold a lot of coin, but each private key only contains a small amount of coin.

In my hypothetical example, there might be 12 combinations in the yyzzzzz portion of the k value that are produced at random, plus one additional message that indicates to an attacker that messages are being "sent", similar to a "ping". Once a single message hidden in the k value is detected, the hacker could look at change addresses for additional hidden messages in the k value.

Quote from: LoyceV on May 11, 2020, 02:21:27 PM

Quote

The scope of possible attacks is also greater when using a paper wallet than using an encrypted wallet.

So encrypt the paper wallet

I was actually referring to a wallet encrypted on a hard drive or computer. A paper wallet encrypted with the passphrase "LoyceV123" has less security than a private key encrypted on a hard drive/computer encrypted with the same passphrase. When you want to spend coin on a paper wallet, you need to load the private key, temporarily onto a computer to sign a transaction, and there are some things that could cause the private key to become compromised. Your private key could become compromised via your computer, and any of these things could happen regardless of if the private key is on a paper wallet or stored on a hard drive. There are additional things that could happen that could cause your private key to become compromised while you are transferring the private key from a paper wallet to your computer, and these things are not possible if your private key was stored on your hard drive.