WEBVTT - Automatic transcript; recognition may contain errors. Reviewed for technical wording and speaker labels. Times match the published episode. 00:00:20.780 --> 00:00:23.180 Live from Utrecht, this is Bitcoin. 00:00:23.920 --> 00:00:24.600 Explained. 00:00:25.000 --> 00:00:25.940 Sjors, we're back. 00:00:28.540 --> 00:00:34.360 I know what you've been waiting for. It's my voice of an angel. 00:00:35.050 --> 00:00:40.580 It's time for... Sjors stacks sats, Sjors stacks sats, Sjors 00:00:40.580 --> 00:00:42.000 stacks sats. 00:00:42.580 --> 00:00:47.740 OMG. So yeah, we have a couple, but they're not super distinct. One says from 00:00:47.740 --> 00:00:53.600 Farscapian, 32,000 sats. You guys are the best. That's always 00:00:53.600 --> 00:00:59.100 nice. And we have one that says the boost didn't work. Your node loses. 00:00:59.460 --> 00:01:01.480 And then they try it again. 00:01:02.790 --> 00:01:05.390 And then it did work. So the problem is I run my own... 00:01:05.390 --> 00:01:08.090 It doesn't work. How did you get it? How can you read it? 00:01:08.210 --> 00:01:13.580 So there's a difference between sending the boost and it actually... And I 00:01:13.580 --> 00:01:18.180 think... Yeah, what happens is the boost is split. So part of it goes to me, most 00:01:18.180 --> 00:01:22.900 of it, and then 1% or so goes to the Fountain app, probably. 00:01:23.870 --> 00:01:28.970 Depending on what podcast player is working. And it's not atomic. So the 1% to 00:01:28.970 --> 00:01:32.450 Fountain app will work, but if the payment to me doesn't work, then they only 00:01:32.450 --> 00:01:35.090 paid 1%, but they got to say their boost. 00:01:36.480 --> 00:01:37.100 I see. 00:01:37.300 --> 00:01:41.320 So that's not ideal. Ideally, it should completely work or completely fail. 00:01:41.320 --> 00:01:42.520 It should be atomic, yeah. 00:01:42.980 --> 00:01:47.140 But it's all new. And the problem is because I run my own node, not everybody is 00:01:47.140 --> 00:01:49.660 able to make a payment to my node, and so they might fail. 00:01:50.580 --> 00:01:56.370 Right. Okay, Sjors, stacks sats. Sjors, today we're going to 00:01:56.370 --> 00:01:58.330 discuss Milk Sad. 00:01:59.030 --> 00:01:59.670 Milk Sad. 00:01:59.950 --> 00:02:03.610 So Milk Sad is, what is Milk Sad? 00:02:04.080 --> 00:02:08.360 Well, it's the first two words of a very, very unsafe mnemonic. 00:02:09.990 --> 00:02:11.710 Yes, and... 00:02:11.710 --> 00:02:17.890 It's also the name of, the working name of a security disclosure that was in progress. 00:02:18.030 --> 00:02:19.730 For the same reason. 00:02:20.930 --> 00:02:25.330 Yes, well yeah they they found the security bug which is related to this Milk Sad 00:02:25.330 --> 00:02:28.190 and they needed a working name for it and they picked this working name and I 00:02:28.190 --> 00:02:29.310 guess it was it stuck. 00:02:29.720 --> 00:02:34.910 Right, and it has to do with Libbitcoin that was that was… 00:02:34.910 --> 00:02:39.190 So I'm not sure if this is the right way to put it I guess that's what we're 00:02:39.190 --> 00:02:45.190 gonna get on in this episode is it a bug in Libbitcoin 00:02:45.190 --> 00:02:46.370 is that what it is? 00:02:46.900 --> 00:02:52.300 Well, there seems to be a difference of opinion as to whether it's a bug or not. 00:02:52.480 --> 00:02:55.900 It's certainly a way to use Libbitcoin such that you lose money. 00:02:56.460 --> 00:03:00.480 But someone published a CVE about it. 00:03:00.680 --> 00:03:00.800 Yes. 00:03:00.800 --> 00:03:02.620 That's for sure. So what's a CVE? 00:03:02.840 --> 00:03:07.920 So a CVE is a, I forgot what the word stands for, but it has, I think it's like 00:03:07.920 --> 00:03:13.920 vulnerability, blah, blah, blah. It's basically a list, a public list of 00:03:13.920 --> 00:03:15.200 known security issues. 00:03:16.250 --> 00:03:21.250 Right. So there was a security issue with Libbitcoin. I guess that would be a 00:03:21.250 --> 00:03:23.550 pretty objective, fair way to put it there. 00:03:23.750 --> 00:03:27.150 Yeah, I definitely think so. I mean, one other way you could put it is like it's 00:03:27.150 --> 00:03:30.690 a security vulnerability involving Libbitcoin. 00:03:32.240 --> 00:03:36.460 That kind of leaves it open of whose fault it is. And it is a bit complicated. 00:03:36.880 --> 00:03:42.600 Right. In any case, something happens and we're going to talk about it. Yeah. 00:03:42.800 --> 00:03:47.960 And it has to do with Libbitcoin. That one is for sure. It has something to do 00:03:47.960 --> 00:03:48.620 with Libbitcoin. 00:03:48.880 --> 00:03:49.220 That's right. 00:03:49.340 --> 00:03:52.640 Or is there still nuance left there? No, this definitely has something to do with 00:03:52.640 --> 00:03:56.960 Libbitcoin. So what is Libbitcoin, Sjors? Let's start there. 00:03:57.180 --> 00:04:01.360 It's a library that is able to... It does a bunch of things. One of the things 00:04:01.360 --> 00:04:05.020 it's able to do is... It's a node, so it can sync the whole Bitcoin blockchain. 00:04:05.240 --> 00:04:09.540 But it's also a collection of tools that you can use without using the node. For 00:04:09.540 --> 00:04:15.520 example, to create a wallet or to do blockchain 00:04:15.520 --> 00:04:16.720 exploration stuff, I think. 00:04:17.040 --> 00:04:22.350 Yeah, so it's a software library. It's not an actual library. Yeah, 00:04:23.110 --> 00:04:24.410 Definitely not an actual library. 00:04:26.450 --> 00:04:32.430 And so it was quite popular. I think it peaked sort of in 2015 when most people 00:04:32.430 --> 00:04:36.930 were working on it. And I think it was at the time also used for certain stealth 00:04:36.930 --> 00:04:37.950 wallet projects. 00:04:38.540 --> 00:04:44.240 Yeah, it was started by Amir Taaki and it was sort of the first non-Bitcoin Core 00:04:44.240 --> 00:04:48.800 implementation of Bitcoin. And then at some point Amir himself used it for 00:04:48.800 --> 00:04:53.420 DarkWallet, which was sort of the first really privacy-focused Bitcoin wallet, 00:04:53.640 --> 00:04:59.320 which is now defunct. But it's basically a collection of tools that you can use 00:04:59.320 --> 00:05:05.060 if you're building Bitcoin applications or anything. If you're writing Bitcoin 00:05:05.060 --> 00:05:10.210 software, you can take stuff from... the Libbitcoin library, right, is that a 00:05:10.210 --> 00:05:10.690 good summary? 00:05:10.690 --> 00:05:14.350 Exactly, and when I say it peaked is because if you look at GitHub you can see a 00:05:14.350 --> 00:05:18.430 history of when there was most of the activity, most of the commits etc, and that 00:05:18.430 --> 00:05:23.930 really was many many many years ago. And over the last years it has been somewhat 00:05:23.930 --> 00:05:27.750 maintained but not super actively, right so right now if you wanted to pick a 00:05:27.750 --> 00:05:31.590 library to use for any Bitcoin project you may want to look for other projects. 00:05:32.030 --> 00:05:36.530 Yeah, right now, Eric Voskuil is the lead maintainer of Libbitcoin. He took over 00:05:36.530 --> 00:05:38.370 from Amir, I think, in 2015. 00:05:38.690 --> 00:05:39.710 Yeah, that's a long time ago, too. 00:05:40.490 --> 00:05:44.330 Yeah, and when you say it was at its peak, so it sounds like what you mean is 00:05:44.330 --> 00:05:46.310 peak of development activity. 00:05:46.690 --> 00:05:46.830 Yeah. 00:05:46.970 --> 00:05:49.030 Not necessarily usage. 00:05:49.290 --> 00:05:50.050 Usage we don't know. 00:05:50.150 --> 00:05:50.850 Yeah, right. 00:05:51.230 --> 00:05:55.050 Other than from this bug, which might give some indication, but it's like not 00:05:55.050 --> 00:05:57.350 even the main usage of it, so it doesn't really say anything. 00:05:57.840 --> 00:06:02.300 Okay, now you just call it a bug. So you think it's a bug, Sjors? 00:06:03.750 --> 00:06:07.830 Yeah, I think so. How are we going to call it during the episode, throughout the 00:06:07.830 --> 00:06:08.670 rest of the episode? 00:06:08.970 --> 00:06:12.530 Either a bug or an extremely poorly named command. 00:06:12.810 --> 00:06:18.210 Okay, we're just going to call it a bug then. I think that's an easy word to use. 00:06:18.430 --> 00:06:22.230 I think Eric Voskuil will not be happy with that, but I think that's the word 00:06:22.230 --> 00:06:26.910 we're going to use. So what is this bug? What's the bug? 00:06:27.370 --> 00:06:32.850 Okay, so basically there's a command at the moment called bx seed, where bx is 00:06:32.850 --> 00:06:37.230 the name of the computer program, the library, and seed says, well, what do you 00:06:37.230 --> 00:06:38.390 think that command means? 00:06:39.920 --> 00:06:45.640 I think it means a Bitcoin seed, but I don't know what the command itself does. 00:06:46.040 --> 00:06:48.680 Yeah, so it basically generates a Bitcoin seed. 00:06:48.920 --> 00:06:49.160 Right. 00:06:49.720 --> 00:06:54.850 Except that it does so in an extremely insecure way. And then somewhere in the 00:06:54.850 --> 00:06:59.550 documentation with some wording that you might, if you read it, means don't use 00:06:59.550 --> 00:07:01.070 this, but not really. 00:07:01.430 --> 00:07:02.250 Okay, wait. 00:07:02.670 --> 00:07:07.390 So basically it generates a seed, but the problem is the seed is based on an 00:07:07.390 --> 00:07:09.850 insecure pseudorandom number generator. 00:07:10.530 --> 00:07:15.890 Let me break this down to see if I understand correctly. So Libbitcoin is a 00:07:15.890 --> 00:07:21.400 Bitcoin library. So there's all kinds of different parts of Bitcoin. 00:07:22.400 --> 00:07:27.120 Yeah, I think it has commands to change say if you start with a seed has maybe a 00:07:27.120 --> 00:07:30.440 way to turn it into a private key or in a public key or in an address. Or 00:07:30.440 --> 00:07:35.840 Yeah you're writing a software application, and you say I need this Bitcoin, I 00:07:35.840 --> 00:07:40.940 need to check if blocks are valid, well maybe that's a very big thing, but I need 00:07:40.940 --> 00:07:45.620 to do something. Let's get it from this library. And what you're if I'm 00:07:45.620 --> 00:07:49.660 understanding you correctly, one of the things you could get from this library is 00:07:50.300 --> 00:07:52.160 I need to generate a seed. 00:07:52.160 --> 00:07:52.540 Yes. 00:07:52.540 --> 00:07:57.320 Okay so that was the specific thing that was in the library that was the name of 00:07:57.320 --> 00:08:02.740 the specific thing in the library that was you would put it in your software if 00:08:02.740 --> 00:08:03.320 you needed to? 00:08:03.320 --> 00:08:06.180 I don't know if people would put it in the software they would just type the 00:08:06.180 --> 00:08:09.980 commands as they were creating their own as they were manually processing 00:08:09.980 --> 00:08:10.700 something in Bitcoin. 00:08:12.220 --> 00:08:16.860 Right. I mean, this is where my lack of, I've never developed like a wallet or 00:08:16.860 --> 00:08:21.280 anything else. So I'm still sort of struggling with how libraries work. 00:08:21.480 --> 00:08:24.200 Yeah, in this case, I think a library is generally something that's used by 00:08:24.200 --> 00:08:28.680 another computer program. And I think in this case, I think this is more like a 00:08:28.680 --> 00:08:34.140 tool set. It's like a bunch of commands, utilities that you as a user would 00:08:34.140 --> 00:08:39.000 manually use to process something. So you just type something like, well, this command. 00:08:39.230 --> 00:08:45.190 Okay you're at the entire library is on your computer, and then it's sort of some 00:08:45.190 --> 00:08:48.870 other software program you're using sort of refers to that library or you 00:08:48.870 --> 00:08:53.330 yourself refer to it, or you yourself and then it sort of goes to the library and 00:08:53.330 --> 00:08:57.970 uses that yeah it am I put it saying right? Okay so now I understand that part I 00:08:57.970 --> 00:09:03.610 think. And this thing in this library was sort of specifically labeled 00:09:03.610 --> 00:09:05.170 generate a seed 00:09:05.170 --> 00:09:06.330 It was labeled seed. 00:09:06.330 --> 00:09:08.410 It was labeled seed, Okay. 00:09:08.410 --> 00:09:11.590 It wasn't labeled super unsafe seed don't use this. 00:09:11.590 --> 00:09:17.350 Right, okay, then, the next question is 00:09:17.350 --> 00:09:22.610 why... So you're saying it was super unsafe to use. So why was it super unsafe to use? 00:09:22.690 --> 00:09:27.030 Yeah, and the nuance there is that it started out as probably reasonably safe and 00:09:27.030 --> 00:09:30.570 it became unsafe later on. So we'll get into, I guess, in the history of that. 00:09:30.670 --> 00:09:36.530 But the unsafety lies in that there's only 2 to the power 32 possible 00:09:36.530 --> 00:09:41.160 seeds that it can generate. So about 4 billion different seeds that it can 00:09:41.160 --> 00:09:46.890 generate. Which is not a lot. Normally, your seed will have 128 bits in it, 00:09:47.050 --> 00:09:52.810 which is 2 to the power of 128. That is probably more possible seeds than the 00:09:52.810 --> 00:09:57.760 number of molecules in the universe, which I think is like 10 to the power of 00:09:57.760 --> 00:10:03.490 100. Anyway, but in this case, it only generates 4 billion possible 00:10:03.490 --> 00:10:09.430 seeds. And then if you know that given a seed, so given the 12 words or 24 words, 00:10:10.590 --> 00:10:15.790 you know how to get to the first normal Bitcoin address, right? You do a bunch of 00:10:15.790 --> 00:10:21.370 derivations. Then you can basically take every possible seed and calculate the 00:10:21.370 --> 00:10:24.610 first address and the first private key of that address and just look at the 00:10:24.610 --> 00:10:26.030 blockchain and see if there's coins there. 00:10:27.490 --> 00:10:31.010 So that would take probably... 00:10:31.010 --> 00:10:32.750 A couple of hours on the laptop. 00:10:33.090 --> 00:10:35.130 On a regular laptop you can, right. 00:10:35.490 --> 00:10:37.930 Then if you want to be a little bit more sophisticated, let's say you want to 00:10:37.930 --> 00:10:42.040 find the first 100 addresses. Maybe it takes a few days but… 00:10:42.040 --> 00:10:47.960 Okay, so to spell out the problem, it would mean, it would 00:10:47.960 --> 00:10:53.910 basically mean that anyone can just calculate any Bitcoin 00:10:53.910 --> 00:10:59.890 address that anyone could have possibly generated using that 00:10:59.890 --> 00:11:00.850 command right? 00:11:00.850 --> 00:11:01.650 Yeah. 00:11:02.380 --> 00:11:06.120 And this is what happened recently, I think. 00:11:06.660 --> 00:11:10.660 Yeah, so what's interesting is that, yeah, so it was discovered because some 00:11:10.660 --> 00:11:14.920 people lost their money very suddenly and they talked to some security experts 00:11:14.920 --> 00:11:18.380 and there were two different people and it turned out when they looked at how 00:11:18.380 --> 00:11:21.020 they made their wallet originally, they were using that command. 00:11:21.360 --> 00:11:26.580 To be clear, I mean, this is obvious probably to anyone listening, but this is 00:11:26.580 --> 00:11:32.340 basically the worst thing that can [unclear]— be 00:11:32.340 --> 00:11:34.800 in a Bitcoin wallet. 00:11:35.140 --> 00:11:39.960 It falls in a, yeah, so these would probably be people who made their own wallet, 00:11:40.280 --> 00:11:44.000 right? Not people using a normal wallet software out there, but they thought, 00:11:44.080 --> 00:11:47.520 hey, I'm going to try and make my own wallet. I'm going to make my own keys. 00:11:47.760 --> 00:11:51.640 Maybe they use the hardware wallet and they didn't trust the hardware wallet 00:11:51.640 --> 00:11:57.260 itself to generate a reliable random number. And so they would use this tool to 00:11:57.260 --> 00:12:00.180 create the seed and then they would manually enter the seed into the hardware 00:12:00.180 --> 00:12:05.050 wallet. I think the case that the article demonstrates was from somebody who did 00:12:05.050 --> 00:12:08.950 that. Like, they had an air-gapped computer, so they knew pretty sure that 00:12:08.950 --> 00:12:12.990 whatever seed was generated was not exposed to the internet, and they manually 00:12:12.990 --> 00:12:16.510 entered it into a hardware wallet and then nuked the air-gapped computer. 00:12:17.780 --> 00:12:18.880 Right. Okay. 00:12:19.060 --> 00:12:23.140 But if your seed is unsafe, then it doesn't matter that you use a hardware wallet. 00:12:24.400 --> 00:12:29.280 Yeah, exactly. That's why this is the worst thing that can be in a Bitcoin wallet. 00:12:29.480 --> 00:12:33.300 Yeah, and these things have happened in the past in different variations, right? 00:12:33.360 --> 00:12:36.700 There was the problem of brain wallets, for example, where people would just 00:12:36.700 --> 00:12:41.120 randomly pick a few words and there's just not enough words. People are not good 00:12:41.120 --> 00:12:44.520 enough at really creating random words. And so people will automatically, anytime 00:12:44.520 --> 00:12:48.060 somebody comes up with that same idea, somebody will automatically sweep the 00:12:48.060 --> 00:12:52.700 blockchain. Now, specifically here, this was most similar to something that 00:12:52.700 --> 00:12:57.040 happened to Trust Wallet. Trust Wallet, as you understand, is a wallet you should 00:12:57.040 --> 00:13:02.520 trust and definitely not verify. And so people did trust it. 00:13:02.800 --> 00:13:06.700 And so what happened there is they were using, again, they were using this 00:13:06.700 --> 00:13:11.980 insecure random number generator. I think it was called Mers… Twist, some twist. 00:13:12.100 --> 00:13:17.540 I forgot which twist. And that was pretty much the exact same mistake as what was 00:13:17.540 --> 00:13:18.500 happening in Libbitcoin. 00:13:19.000 --> 00:13:23.300 But not... The same thing. It wasn't Libbitcoin they used, right? 00:13:23.380 --> 00:13:27.100 No, no, exactly. Trust did not use Libbitcoin. They just used the same random 00:13:27.100 --> 00:13:27.780 number generator. 00:13:30.280 --> 00:13:30.720 However... 00:13:30.720 --> 00:13:31.980 Well, not random. 00:13:32.480 --> 00:13:35.720 Yeah, but they said pseudo-random number generator. So the idea of a 00:13:35.720 --> 00:13:40.380 pseudo-random number generator is that it produces numbers that look random, but 00:13:40.380 --> 00:13:44.720 fundamentally they're not random. And that's not necessarily bad. Computers 00:13:44.720 --> 00:13:47.460 sometimes do that, but not with 32 bits. 00:13:49.080 --> 00:13:53.940 But the thing is, if you use with Trust Wallet, basically the same idea, somebody 00:13:53.940 --> 00:13:57.780 could guess all the private keys and Ledger Donjon, the organization within 00:13:57.780 --> 00:13:58.580 Ledger, did that. 00:13:59.120 --> 00:13:59.720 Right. 00:13:59.700 --> 00:14:05.600 So it uses the same algorithm, but with a slight difference in how it's 00:14:05.600 --> 00:14:09.100 applied to the seed eventually. And that's why, even though it's the same 00:14:09.100 --> 00:14:09.960 mistake, 00:14:11.200 --> 00:14:16.120 the Libbitcoin coins were not found in that way. Because I think it's something 00:14:16.120 --> 00:14:19.780 like you use the first part of the seed instead of the last part of the seed, 00:14:19.860 --> 00:14:20.480 something like that. 00:14:21.020 --> 00:14:25.750 Okay, so let's get into... First of all, 00:14:26.490 --> 00:14:32.470 let's just get into the background now, I think. Because you said there's a 00:14:32.470 --> 00:14:36.770 lot of nuance in the background, or it used to be secure and then it wasn't? 00:14:37.230 --> 00:14:42.050 Yeah, so one of the things is that this command was changed. 00:14:43.010 --> 00:14:46.590 So maybe we first want to explain why people were using this in the first place, 00:14:46.590 --> 00:14:50.950 because that is part of the problem. There's the book called Mastering Bitcoin, 00:14:51.550 --> 00:14:57.310 which is pretty good. But it had, I think inside the 00:14:57.310 --> 00:15:01.230 chapter that was explaining how addresses worked, it also showed some commands of 00:15:01.230 --> 00:15:05.490 how to make a private key. And one way to make a private key is using Bitcoin 00:15:05.490 --> 00:15:09.410 Core. And then the second one is, oh, you can also use this other tool, which is 00:15:09.410 --> 00:15:14.350 the Libbitcoin or its predecessor. And this was published in 2014 I think because 00:15:14.350 --> 00:15:15.710 it was in the second edition of the book. 00:15:17.840 --> 00:15:22.360 And at the time, this command seemed to be still safe. 00:15:22.560 --> 00:15:25.340 You mean the Libbitcoin version that was in the book? 00:15:25.500 --> 00:15:29.400 Yeah, or at least reasonably safe. I think they're still investigating. That 00:15:29.400 --> 00:15:32.680 might not have been perfectly safe either, but not as unsafe as it is now. 00:15:32.920 --> 00:15:38.900 Okay, who's investigating that, and why was it maybe not even safe back then? Do you know this? 00:15:39.020 --> 00:15:40.980 So the Milk Sad people are looking into it. 00:15:41.140 --> 00:15:42.520 Oh, the same people that filed this CVE? 00:15:42.520 --> 00:15:46.540 Yeah, they're trying to see, like, okay, this bug is clearly, like... When it 00:15:46.540 --> 00:15:49.820 became unsafe, you can see all the thefts happening. But it's possible that it 00:15:49.820 --> 00:15:53.820 was already unsafe, just less unsafe. And so they're trying to see whether that 00:15:53.820 --> 00:15:54.680 was also compromised. 00:15:55.140 --> 00:15:59.660 Okay, but that sounds like it's just speculation. There's no evidence for that. 00:15:59.960 --> 00:16:05.620 Okay, so... Presumably, or don't assume maybe, but it seemed 00:16:05.620 --> 00:16:08.280 safe at least initially, what was in the book at first. 00:16:09.040 --> 00:16:09.360 Yes. 00:16:09.740 --> 00:16:11.260 Okay, go on. 00:16:11.400 --> 00:16:15.400 Yeah, but there you can already say like, okay, if you're recommending something 00:16:15.400 --> 00:16:19.180 in a book, maybe you want to put a really, really strong warning above it. I 00:16:19.180 --> 00:16:23.060 think there was a warning above it in very general terms, like when you generate 00:16:23.060 --> 00:16:27.480 random keys, be careful. But I think even above every command, you probably want 00:16:27.480 --> 00:16:31.390 to say like, never use this. Because people go on Google and it's like, how do I 00:16:31.390 --> 00:16:35.310 make a Bitcoin wallet? And Google will just return some page in a book and you 00:16:35.310 --> 00:16:38.150 only look at the command and you don't look at the context and you type the 00:16:38.150 --> 00:16:43.130 command. So you cannot be aggressive enough in saying, don't use this. And 00:16:43.130 --> 00:16:46.130 especially if it's sitting right next to a command that uses Bitcoin Core, 00:16:46.390 --> 00:16:48.850 because that might give more of the idea. 00:16:49.510 --> 00:16:55.310 Yeah, just because there was a lot of Twitter drama around this and I didn't read 00:16:55.310 --> 00:16:55.830 all of it. 00:16:57.260 --> 00:17:02.540 I guess one thing that I think Voskuil mentioned in this context is that from his 00:17:02.540 --> 00:17:05.780 part, it was not intended to be a recommendation or anything like that. 00:17:05.780 --> 00:17:09.480 Yeah, that's very possible. So it's possible that Andreas wrote the book. He 00:17:09.480 --> 00:17:13.680 found this other way to do it using the Libbitcoin, added it to the book as just 00:17:13.680 --> 00:17:18.460 an example. I wasn't expecting people to use this for a serious wallet. Eric 00:17:18.460 --> 00:17:22.520 Voskuil, of course, wasn't writing that book, so he had no way to know. Now, what 00:17:22.520 --> 00:17:26.140 happened a bit later, and this is what has confused a few people, is that the 00:17:26.140 --> 00:17:30.910 Libbitcoin was changed. So the commands were moved around. So the original 00:17:30.910 --> 00:17:31.990 command was now different. 00:17:33.350 --> 00:17:38.650 And this change was not the thing that made it unsafe, basically. This was just a 00:17:38.650 --> 00:17:42.170 neutral change. It's just you have one command before, and now it's like you use 00:17:42.170 --> 00:17:43.030 a slightly different command. 00:17:44.340 --> 00:17:46.060 For the same purpose? 00:17:46.320 --> 00:17:51.560 For the same purpose. So the command bx seed now was something like sx newkey. 00:17:52.200 --> 00:17:55.680 It was just the same idea, just slightly different words to do the same thing. 00:17:57.080 --> 00:18:03.170 Okay, wait. Okay, so the name, but was the current name already in the library as well? 00:18:05.160 --> 00:18:09.950 No, so the library itself was changed. So what happened is this book was written 00:18:09.950 --> 00:18:14.150 based on an old version of the library. The library was changed. And then Eric 00:18:14.150 --> 00:18:18.550 went back to the book, basically, to the GitHub repository where the book is, 00:18:18.630 --> 00:18:23.130 because the book is open source, and basically changed all the commands to use 00:18:23.130 --> 00:18:24.510 the new version of the library. 00:18:25.650 --> 00:18:30.510 Okay, so that would mean that, sorry, what was this part of the library code that 00:18:30.510 --> 00:18:33.510 this episode is about? bx seed or something? 00:18:33.630 --> 00:18:37.110 Yeah, bx seed, that's the command. And it was a slightly different command before. 00:18:39.960 --> 00:18:44.600 So was bx seed in the library back in 2013, whatever? 00:18:45.440 --> 00:18:49.540 No, at the time it was called sx newkey, but it was the same thing. It was 00:18:49.540 --> 00:18:53.260 basically the same, essentially the same code, just with a different name. The 00:18:53.260 --> 00:18:56.320 library had a different name, the command had a different name, but it was doing the same thing. 00:18:56.400 --> 00:18:57.440 And what was in the book? 00:18:57.860 --> 00:19:00.160 It was using the original one, the sx newkey. 00:19:00.600 --> 00:19:04.020 Okay, yes. But that was already insecure then, right? 00:19:04.750 --> 00:19:06.290 Not as insecure as it is now. 00:19:07.110 --> 00:19:11.050 I mean, I guess I don't understand why, but hopefully our listeners do. 00:19:11.230 --> 00:19:16.380 When Andreas wrote the book initially in 2014, the command was probably secure or 00:19:16.380 --> 00:19:17.480 at least not as insecure. 00:19:18.870 --> 00:19:19.330 Yeah? 00:19:19.570 --> 00:19:19.850 Yes. 00:19:20.790 --> 00:19:25.730 Then, as far as we know, nothing was stolen back in those days. Then the library 00:19:25.730 --> 00:19:30.330 was changed, just the change of the commands. That did not change anything about 00:19:30.330 --> 00:19:35.230 the safety. That happened later. So what happened is because the library was 00:19:35.230 --> 00:19:39.830 changed, Eric would go to the book and say, hey, this library has changed. Please 00:19:39.830 --> 00:19:40.950 use these new commands now. 00:19:42.350 --> 00:19:47.380 And there was otherwise a completely neutral change. But I think some people 00:19:47.380 --> 00:19:52.700 interpreted it as if he added that library to the book himself. But it wasn't 00:19:52.700 --> 00:19:55.580 Eric adding the library to the book. Andreas did that in the original version. 00:19:56.390 --> 00:19:59.130 Eric was just saying, okay, if you're using my library, that's great, but it's 00:19:59.130 --> 00:20:00.830 changing, so use these new commands. 00:20:01.030 --> 00:20:05.050 I guess my question or what I'm trying to get at, and maybe you were answering 00:20:05.050 --> 00:20:11.000 something completely different, is why does this insecure code exist in 00:20:11.000 --> 00:20:14.700 the first place? What is it for? Why would that even be a thing? 00:20:14.880 --> 00:20:17.600 Well, this happened later, right? So what happened later is... 00:20:17.600 --> 00:20:18.440 You're getting there? 00:20:18.600 --> 00:20:18.780 Yeah. 00:20:18.920 --> 00:20:19.460 Okay, great. 00:20:19.640 --> 00:20:24.100 Another new version of the library came out. And that one made it unsafe. So the 00:20:24.100 --> 00:20:28.980 command didn't change, bx seed, still bx seed, but now suddenly it was changing. 00:20:29.220 --> 00:20:31.300 It was producing these 32-bit random things. 00:20:33.340 --> 00:20:38.300 So basically you have a book that's pointing to a library and people are using 00:20:38.300 --> 00:20:41.920 that command because everybody reads that book, you know, and then at some point 00:20:41.920 --> 00:20:45.060 something changes in the library. And so new people who are new in reading the 00:20:45.060 --> 00:20:49.100 book will actually do something that's unsafe, even though people who read the 00:20:49.100 --> 00:20:51.480 book two years earlier would have been fine, probably. 00:20:53.350 --> 00:20:53.910 Okay. 00:20:53.910 --> 00:20:56.910 Because you know yeah, the book doesn't control what's on the internet so you just… 00:20:56.910 --> 00:21:02.830 Right I get that. Okay that makes sense. Why does this 00:21:02.830 --> 00:21:08.750 insecure code exist or I mean maybe I mean there's tons of… I'm just my question 00:21:08.750 --> 00:21:12.970 is basically is there a good reason for this to exist potentially? 00:21:12.970 --> 00:21:18.190 No, I mean I think when the code was originally when that particular pseudo 00:21:18.190 --> 00:21:22.390 random number generator was designed is probably 20 years ago I think people 00:21:22.390 --> 00:21:25.450 thought it was secure, and then security researchers found out it was not secure. 00:21:25.710 --> 00:21:27.610 And since then you should just never use it. 00:21:27.790 --> 00:21:32.810 So from what I understand, and of course you should correct me if I'm wrong, but 00:21:32.810 --> 00:21:38.610 I thought that basically the only randomness, which is then obviously 00:21:38.610 --> 00:21:41.410 not random was that it would only use like a timestamp. 00:21:41.750 --> 00:21:45.480 Yeah. Effectively. I think it uses. A timestamp. 00:21:45.580 --> 00:21:50.520 I guess at this point, we've discussed this before, so I think, so we don't need 00:21:50.520 --> 00:21:52.960 to get into detail exactly about all of this. 00:21:53.060 --> 00:21:56.840 But I think it's a timestamp in milliseconds or in millions of a second, actually. 00:21:57.100 --> 00:22:00.940 Yes, but that's the thing, right? So if you want to generate random numbers on 00:22:00.940 --> 00:22:02.940 the computer, the question is, how do you do that? 00:22:03.080 --> 00:22:03.320 Yes. 00:22:03.560 --> 00:22:07.900 And you usually use multiple inputs for that. 00:22:08.100 --> 00:22:09.020 Including a timestamp. 00:22:09.140 --> 00:22:12.880 Including a timestamp. But if you use only a timestamp, that's a problem because 00:22:12.880 --> 00:22:15.320 then... people can just try every time. 00:22:15.560 --> 00:22:16.780 Yeah, but I think in this case... 00:22:16.780 --> 00:22:19.280 Try every millisecond or whatever and find, right? 00:22:19.740 --> 00:22:23.120 Yes, but in this case, I don't think the problem was using a timestamp. The 00:22:23.120 --> 00:22:24.820 problem was only using 32 bits. 00:22:25.480 --> 00:22:27.380 Okay, and that's not the same thing necessarily. 00:22:27.460 --> 00:22:31.180 No matter what the 32 bits is, if the 32 bits is a timestamp, yeah, that's fine. 00:22:31.180 --> 00:22:35.580 But if the 32 bits was the name of your pet, it's still not enough. So it's about 00:22:35.580 --> 00:22:39.520 the amount of data that was being used. Now, the reason people were able to come 00:22:39.520 --> 00:22:43.980 up with the Milk Sad thing is because if you set the time to zero, you can set 00:22:43.980 --> 00:22:48.320 your clock to zero, which is somewhere in 1970. Then it will produce Milk Sad. 00:22:49.370 --> 00:22:53.570 But you can't just hack somebody's wallet by guessing at what time they created 00:22:53.570 --> 00:22:57.910 it. You just have to guess every possible number. 00:22:58.880 --> 00:23:04.320 So you'd have to do two things. You have to try every possible number and every 00:23:04.320 --> 00:23:05.000 possible time? 00:23:05.200 --> 00:23:08.340 No, you just try every possible number. And the fact that this number happens to 00:23:08.340 --> 00:23:12.880 represent a time... probably the time in milliseconds since, you know, midnight 00:23:12.880 --> 00:23:15.480 or something like that. It doesn't matter what it represents. 00:23:16.060 --> 00:23:21.950 Okay, back to my question. Is there, I guess your answer was no, but let me, so 00:23:21.950 --> 00:23:26.150 is there a good reason for this 32-bit 00:23:27.720 --> 00:23:30.700 code to exist? No, you say no. 00:23:30.920 --> 00:23:33.980 To exist somewhere in the universe. I mean, code has been written and people 00:23:33.980 --> 00:23:39.440 don't, you know, always delete it. But if it's 2015 or whenever this change is 00:23:39.440 --> 00:23:45.390 made, and you want to use some random number generator, you shouldn't use this. 00:23:47.220 --> 00:23:50.700 Now you could say, and I think that was the argument, well, this function was 00:23:50.700 --> 00:23:55.700 never meant to be safe, so I was allowed to use a known bad library for this. 00:23:57.200 --> 00:24:00.060 I think that's not a safe way to do things. 00:24:00.540 --> 00:24:06.420 So again, for me as a non-developer, I don't really understand 00:24:07.740 --> 00:24:13.600 how a library was written or used or so, I don't understand why why 00:24:13.600 --> 00:24:18.500 is this code in the first place? Is there a reasonable or feasible reason why it 00:24:18.500 --> 00:24:21.160 would even be there? That's sort of my question. 00:24:21.160 --> 00:24:27.000 Presumably he just picked a way to make a random number from 00:24:27.000 --> 00:24:31.030 all the possibilities out there and he picked a particularly bad one, 00:24:33.400 --> 00:24:37.460 because presumably because he thought it wasn't important so it didn't have to be 00:24:37.460 --> 00:24:39.820 secure so anything that's kind of random was good enough. 00:24:39.820 --> 00:24:44.360 Okay, so why would he think it's not that important? Is there… 00:24:44.360 --> 00:24:48.820 Presumably because the intention of that function that he had in mind was that 00:24:48.820 --> 00:24:51.940 this function should never be used for real wallet. Should be used on testnet. So 00:24:51.940 --> 00:24:55.820 on testnet you can make a wallet that's perfectly unsafe and as long as it's kind 00:24:55.820 --> 00:24:56.960 of random it's good enough. 00:24:56.960 --> 00:25:01.080 Okay, and it's easier to implement it that way or something? 00:25:01.080 --> 00:25:04.800 This part I don't know, because there are probably very secure functions that are 00:25:04.800 --> 00:25:09.460 just as easy. Okay but I don't know that. So it may have been some reason why, 00:25:09.460 --> 00:25:13.740 because I did look at the original change itself why that change was made from 00:25:13.740 --> 00:25:17.790 something that was probably secure to something that's definitely not secure. And 00:25:17.790 --> 00:25:21.510 it had something to do with thread safety, which is completely unrelated to 00:25:21.510 --> 00:25:24.890 randomness. It's just a general thing in programming. So he's trying to fix a bug 00:25:24.890 --> 00:25:29.230 related to, I'd say, reliability of the software so that it doesn't crash. 00:25:30.620 --> 00:25:35.540 And in fixing that, he switched to a different random number generator, which 00:25:35.540 --> 00:25:39.980 presumably fixed the problem with reliability, just became unsafe. 00:25:40.380 --> 00:25:40.580 Okay. 00:25:40.740 --> 00:25:44.400 And again, not realizing that people were using this with real money. 00:25:46.050 --> 00:25:51.610 Right. About that so from what I understand and 00:25:51.610 --> 00:25:55.830 I'm again I there's no reason for me to keep repeating this, but I don't know 00:25:55.830 --> 00:26:00.650 what… how how to develop a wallet. I don't know what process you follow. But 00:26:00.650 --> 00:26:06.000 apparently at least somewhere it said don't use this code for 00:26:07.750 --> 00:26:13.190 generating real money seeds or something on there was a warning it was somewhere right? 00:26:13.190 --> 00:26:14.610 Pretty fake. 00:26:14.610 --> 00:26:15.770 Fake. Okay. 00:26:15.770 --> 00:26:19.510