[Suggestion] Verify private keys internally before use
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.6k
- Forks
- 3.5k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 61
Description
In 2015 gmaxwell had this to say about bitcoin core's private key generation process:
Just incorrect key generation? Attempt signing with all the keys and verify the results. (Bitcoin core does this internally. And I strongly recommend it, it's a little terrifying that nothing else does. It's too easy to have a bitflip cause the creation of an invalid key, and too easy to defend against)
Source: https://bitcointalk.org/index.php?topic=912337.msg10018157#msg10018157
I suggest electrum do the same. Sign and verify messages with private keys before using them to protect against faulty hardware.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies no files, entry points, or tests. Start by tracing private-key generation and signing paths, then review the existing cryptographic tests and determine the verification behavior and scope required before private keys are used. Done should include an agreed implementation approach and coverage for faulty-key detection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100