Javascript cryptography - Revision history

NotATether: Add Randstorm reference

2025-12-14T11:12:36Z

Add Randstorm reference

← Older revision		Revision as of 11:12, 14 December 2025
Line 12:		Line 12:

	Generally the code out there uses almost completely untested ECC code which would sometimes generate the wrong pubkeys, as well as being insecure non-constant time implementation subject to surveillance from other javascript tabs.		Generally the code out there uses almost completely untested ECC code which would sometimes generate the wrong pubkeys, as well as being insecure non-constant time implementation subject to surveillance from other javascript tabs.

			A major example is the "Randstorm" vulnerability disclosed by Unciphered, affecting JavaScript-based Bitcoin wallets generated using the BitcoinJS library (and derivatives) between 2011 and 2015.<ref>https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/</ref> Due to flaws in the SecureRandom() function from the underlying JSBN library, combined with weak browser implementations of Math.random(), private keys were often generated with far less entropy than required (sometimes under 48 bits instead of 256), making them highly predictable and vulnerable to brute-force attacks. It is recommended that anyone using vulnerable software should transfer their bitcoins to a new wallet.

	== SF Bitcoin Devs Seminar talk==		== SF Bitcoin Devs Seminar talk==

Belcher: Added extra note about untested

2018-11-20T19:06:43Z

Added extra note about untested

← Older revision		Revision as of 19:06, 20 November 2018
Line 10:		Line 10:

	This is even before you get into the fact of how easy it is for sites to quietly substitute different JS, or the fact that HTTPS provides virtually no protection against attackers with a network position close to the server (because you can get a cert for any domain you can answer HTTP requests for...). <ref>https://www.reddit.com/r/Bitcoin/comments/6ss91w/seriously_how_are_you_all_generating_your_private/dlf4uhr/</ref>		This is even before you get into the fact of how easy it is for sites to quietly substitute different JS, or the fact that HTTPS provides virtually no protection against attackers with a network position close to the server (because you can get a cert for any domain you can answer HTTP requests for...). <ref>https://www.reddit.com/r/Bitcoin/comments/6ss91w/seriously_how_are_you_all_generating_your_private/dlf4uhr/</ref>

			Generally the code out there uses almost completely untested ECC code which would sometimes generate the wrong pubkeys, as well as being insecure non-constant time implementation subject to surveillance from other javascript tabs.

	== SF Bitcoin Devs Seminar talk==		== SF Bitcoin Devs Seminar talk==

Belcher: Add link to gmaxwell's discussion of javascript crypto

2018-10-26T12:41:58Z

Add link to gmaxwell's discussion of javascript crypto

← Older revision		Revision as of 12:41, 26 October 2018
Line 10:		Line 10:

	This is even before you get into the fact of how easy it is for sites to quietly substitute different JS, or the fact that HTTPS provides virtually no protection against attackers with a network position close to the server (because you can get a cert for any domain you can answer HTTP requests for...). <ref>https://www.reddit.com/r/Bitcoin/comments/6ss91w/seriously_how_are_you_all_generating_your_private/dlf4uhr/</ref>		This is even before you get into the fact of how easy it is for sites to quietly substitute different JS, or the fact that HTTPS provides virtually no protection against attackers with a network position close to the server (because you can get a cert for any domain you can answer HTTP requests for...). <ref>https://www.reddit.com/r/Bitcoin/comments/6ss91w/seriously_how_are_you_all_generating_your_private/dlf4uhr/</ref>

			== SF Bitcoin Devs Seminar talk==

			Greg Maxwell discusses javascript cryptography. (watch time: 3 min 6 sec)

			https://www.youtube.com/watch?v=TYQ-3VvNCHE&t=3071

	== See Also ==		== See Also ==

Belcher: Create page

2018-10-24T20:15:49Z

Create page

New page

'''Javascript cryptography''' is when cryptographic software, especially [[bitcoin]] software, is written in javascript.

Javascript is not a suitable language for this. Such software is best avoided.

== Explanation ==

Please don't use any javascript address generator for anything that matters.

The common libraries they have used have had a long and worrying series of mathematical flaws that cause them to occasionally generate addresses that do not match the private keys, and were completely without the sorts of test that would have detected these mistakes. Even if the errors are all fixed now, it's very easy for a webpage generator to be using an old version without anyone really noticing.

This is even before you get into the fact of how easy it is for sites to quietly substitute different JS, or the fact that HTTPS provides virtually no protection against attackers with a network position close to the server (because you can get a cert for any domain you can answer HTTP requests for...). <ref>https://www.reddit.com/r/Bitcoin/comments/6ss91w/seriously_how_are_you_all_generating_your_private/dlf4uhr/</ref>

== See Also ==
* [[Paper wallet]]
* [[Browser-based wallet]]

==References==
<references />

[[Category:Technical]]