Post
Topic
Board Development & Technical Discussion
Re: How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys
by
stv
on 05/12/2014, 17:17:25 UTC
Deterministic choice of “k” unfortunately does not solve the issue, because you cannot verify that choice without knowledge of the private key. Since the whole point of an offline/embedded wallet is that the key never leaves the wallet, there is no way for a user to verify that “k” has been chosen according to RFC6979 or anything alike. Since “k” has to be secret, there is no way to solve this. This is discussed in the paper as well.

Classic ECDSA:
Knowledge of “k” implies knowledge of (private key) “d”, but not the other way around.

Deterministic ECDSA:
Knowledge of “k” equals knowledge of “d” and vice versa.