2

I read the article by Obsidian Systems and the linked post on recovery attack. I am not an expert, so I am asking to provide some details on why new accounts should use bip25519 derivation scheme and if there is a security issue for those who still use (and bake) with ed25519.

1

Thanks for asking! See the answer I provided on this question - Kiln supporting bip32-ed25519 addreses. I'll copy it here for convenience:

Tezos has adopted this new derivation scheme because it improves security. Backstory: because this update involves BIP32 (Bitcoin Improvement Proposal 32), it is important to contrast how addresses are used in Bitcoin and Tezos:

Bitcoin: Users have a root address, from which you can derive a unique address from for each transaction so no two people are sending BTC to you using the same destination address. These are sometime called throwaway receipt addresses. Tezos: Users typically use the same exact address for all operations. Sometimes its the root address, most often it is the /0h/0h derivation path. These is the same as any of the uniquely derived BTC addresses you would use, it just uses Tezos’ path instead of Bitcoin’s. The changes to this derivation scheme are more important in the context of Bitcoin users than they are Tezos. The issue lies the math that BIP32 uses. It assumes that all points on a signing (elliptic) curve are valid, when really only half are valid ECDSA keys. These invalid keys depend on parts of your root key and typically only found using a derivation path with very large numbers or really deep derivations - for example: /7293843h/9372365h instead of /0h/0h. That’s also why this issue wasn’t caught until the derivation scheme was already in use.

If you attempt to use addresses on the invalid part of the curve and an attacker determines which of those addresses do not work, they could use this information to determine your private key. Note that this attack vector requires that you have shared many derived addresses from your root key, which is what makes this attack less likely on Tezos than on Bitcoin.

  • Thank you Mike for the reply. I have two questions: A) how can I set this new scheme when configuring a Ledger (X or S)? B) is it safe to say that the old "ed25519" addresses are not at risk? – Babell Dec 13 '19 at 16:01
  • @Babell please ask followup questions as separate questions, not as comments. You can refer to this question in your new questions. Thank you for your understanding. – Ezy Dec 15 '19 at 20:55
  • It was not a separate question, since it was basically the same question as "[if] there is a security issue for those who still use (and bake) with ed25519." – Babell Dec 19 '19 at 15:48
  • Everyone's personal tolerance for security is different, so I won't make blanket statements about this (you can never have 100% security, etc, etc). Personally, I would not feel the need to move an existing baker off its ed25519 address, but if I was starting a new baker I'd use the new derivation scheme. – mikereinhart Dec 20 '19 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.