Feeds

Android detective explains Bitcoin borkage breadcrumbs

A tale of twisted pseudo-random number generators

Choosing a cloud hosting partner with confidence

Over the weekend, it emerged that a flaw in Android's Java-derived pseudo-random number generator (PRNG) created a vulnerability that allowed the theft of Bitcoins.

The individual responsible identifying the nasty bug, Jean-Pierre Rupp, has now contacted The Register by e-mail to confirm how he was able to track down the problem.

Rupp says his investigations began as the result of a complaint from a friend, who suspected that his Android phone had been hacked. However, Rupp says, he considered a successful remote Bitcoin-theft hack was unlikely. This, Rupp told Vulture South, led him instead to speculate that “somebody found his private key through cryptanalysis on the Bitcoin blockchain (the public ledger where all transactions are kept).”

Rupp's investigations then led him to a similar complaint in July (here). His reply to that post (as user Xeno-Genesis) reported his friends experience and noted that he was investigating the problem.

“The common factor seemed to be Android, and I immediately thought about the possibility of a flaw in its pseudo-random number generator (PRNG),” Rupp told The Register.

Rupp identified this conference paper, also linked in The Register's earlier story, and brought it to the attention of Google security engineer Mike Hearn. “I also pointed to him that his BitcoinJ code was using that PRNG in the regular non-seeded way, which triggered the flaw,” Rupp told The Register.

“I originally suggested that private key collisions may have being found and exploited. Later on the weekend a reply to the Bitcoin forum post by johoe clarified that the issue with the PRNG was leading to collisions in the random number parameter /k/ that the elliptic curve signature algorithm needs in order to be secure, making it trivial to extract the private key from two transactions that used the same /k/,” Rupp told Vulture South.

Hearn has told The Register that one of the posts, referred to in yesterday's story relates to a different key-collision issue.

“Nils' [ Schneider] blog post isn't anything to do with this incident. If you read to the end, the bad transaction he found was generated using a prototype hardware wallet not an Android device. His blog post is a nice walkthrough of the maths involved with recovering a private key given two colliding signatures, but it has no relevance beyond that.”

The Register is happy to include this correction. We have also asked Google to comment on why developers were not warned earlier about issues with using SecureRandom, given the March publication date of the RSA conference paper. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.