Bitcoin BIP461 proposal enhances detection of key leakage

Bitcoin improvement proposal BIP461 aims to improve the detection of hidden wallet key leaks by defining a common signing procedure for ECDSA. The proposal, authored by Liam Gilligan, was merged into the BIPs repository on September 16 and remains in Draft status. It allows independent compliant signers to produce identical signatures for the same secret key and message hash, establishing a benchmark for identifying deviations that may indicate key leakage. ECDSA allows signers to make choices during signature creation, which can be exploited by malicious firmware to conceal key material. BIP461 addresses this by specifying a deterministic signing procedure. The proposal requires identical inputs and the same standard for comparison, which involves exposing the secret key to another independent signer. Different results for the same key and message hash indicate non-compliance with BIP461. The algorithm limits signatures to a maximum of 70 bytes in standard DER encoding. The Dark Skippy disclosure highlighted that corrupted firmware could embed seed material in transaction signatures, although researchers noted they had not observed this technique in practice. While BIP461 does not directly standardize a remedy for Schnorr signing used in Taproot, it provides a framework for compliance checks. A reviewer noted that test vectors and a reference implementation are needed for BIP461 to advance to Complete status. The proposal's effectiveness relies on compliant implementations and the ability to detect deviations.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.