Douglas Stebila

Hierarchical deterministic Bitcoin wallets that tolerate key leakage

Abstract

A Bitcoin wallet is a set of private keys known to a user and which allow that user to spend any Bitcoin associated with those keys. In a hierarchical deterministic (HD) wallet, child private keys are generated pseudorandomly from a master private key, and the corresponding child public keys can be generated by anyone with knowledge of the master public key. These wallets have several interesting applications including Internet retail, trustless audit, and a treasurer allocating funds among departments. A specification of HD wallets has even been accepted as Bitcoin standard BIP32.

Unfortunately, in all existing HD wallets—including BIP32 wallets—an attacker can easily recover the master private key given the master public key and any child private key. This vulnerability precludes use cases such as a combined treasurer-auditor, and some in the Bitcoin community have suspected that this vulnerability cannot be avoided.

We propose a new HD wallet that is not subject to this vulnerability. Our HD wallet can tolerate the leakage of up to m private keys with a master public key size of O(m). We prove that breaking our HD wallet is at least as hard as the so-called 'one more' discrete logarithm problem.

Reference

Gus Gutoski, Douglas Stebila. Hierarchical deterministic Bitcoin wallets that tolerate key leakage. In Rainer Böhme, Tatsuaki Okamoto, editors, Proc. 19th International Conference on Financial Cryptography and Data Security (FC) 2015, LNCS, vol. 8975, pp. 497-504. Springer, January 2015. © IFCA.

Download

BibTeX

@inproceedings{FC:GutSte15,
 	Author = {Gus Gutoski and Douglas Stebila},
 	Booktitle = {Proc. 19th International Conference on Financial Cryptography and Data Security (FC) 2015},
 	Booktitleshort = {Proc. FC 2015},
 	Doi = {10.1007/978-3-662-47854-7\_31},
 	Editor = {Rainer B{"o}hme and Tatsuaki Okamoto},
 	Month = {January},
 	Pages = {497--504},
 	Publisher = {Springer},
 	Series = {LNCS},
 	Title = {Hierarchical deterministic {B}itcoin wallets that tolerate key leakage},
 	Volume = {8975},
 	Year = {2015}
 }

Funding

• Australian Research Council (ARC) Discovery Project grant DP130104304
• Research at the Perimeter Institute is supported by the Government of Canada through Industry Canada and by the Province of Ontario through the Ministry of Research and Innovation
• GG acknowledges support from CryptoWorks21