Would an ECC break or CRQC be able to reveal relatioships between addresses in a wallet?
The very early bitcoin wallets used HKDF-type constructions (for every address belonging to a wallet) but then all crypto wallets moved to a construction where every address shared an ECC mathematical relationship - for good reasons such as the ability to create view-only wallets.
My question is what happens if ECC is broken or a cryptographically relevant quantum computer arrives, will it be able to discover relationships between addresses in a wallet given one or more address belonging to a wallet?
For example, it will be able to obtain the private keys of any revealed public key belonging to a particular wallet, would it then be able to derive the master private key of the wallet? Would it be able to attribute other public keys to the same wallet?
Top Answer/Comment:
My question is what happens if ECC is broken or a cryptographically relevant quantum computer arrives, will it be able to discover relationships between addresses in a wallet given one or more address belonging to a wallet?
If different public keys are children derived from a certain parent public key (BIP-32 style), then given the parent public and private key and its chain code you can calculate child public and private keys. However, without the chain code it would be impossible to calculate because the chain code is the HMAC key used in BIP-32.
But even if you get the chaincode for some reason, doing it the other way around (recovering the parent key from its children) would not be possible with just the children public and private key since it would need to reverse a HMAC-SHA512 (BIP-32)
For example, it will be able to obtain the private keys of any revealed public key belonging to a particular wallet, would it then be able to derive the master private key of the wallet? Would it be able to attribute other public keys to the same wallet?
If a quantum computer can derive the private key from a given public key, it would still not be possible to derive the master private key, since—as explained earlier—it is impossible to calculate the parent keys. All the children keys would also be secure as long as the attacker does not have the chaincode to calculate the children.
상단 광고의 [X] 버튼을 누르면 내용이 보입니다