Hacker News Reader

Comment by ddtaylor | Hacker News Reader

"Faketoshi" as he's known in the community always finds a new way to NOT be able to prove he has access to the early mined coins. It's honestly comical at this point the different bullshit he comes up with. My favorite so far was finding an existing signature on the blockchain from Satoshi, modifying the data, then publishing the signature with different data in an attempt to claim to be the creator of Bitcoin. Everyone called him out on his bullshit and a few months later he came up with a new scam, which is exactly what he'll do after this attempt fails.

Craig Wright will never sign a message with the original private keys or move the coins in a way that proves his involvement or ownership of the first mined coins. He is a fraud.

View on HN

Here’s a video of Craig Wright being called out by an actual expert and it’s hilarious https://youtu.be/0thnCDgRJfM. He clearly has no clue how ECDSA signatures work.

Does anyone find the other guys claim more interesting? That you can derive private keys after just one transaction.

(edit: ignore me) Yeah that sounds like he mis-spoke. You can't get the private key from a signature, or the protocol is broken.

Edit: I see. It's confusingly worded but that makes sense.

You can recover a private key from two signatures if they reuse the same nonce. The nonce should be random and only used once as the name suggests

And this is one of the reasons why ECDSA is a poor standard: it's too easy to accidentally screw it up, and it results in the worst possible kind of compromise (private key).

There is a better way: make the nonce a hash of the message signature and the private key. That way you don't need any randomness, and the entire algorithm is deterministic. It is guaranteed (assuming the hash is good, but you need a good hash algorithm to sign things anyway) that no two messages will be signed with the same nonce, and that the nonce cannot be guessed without already having the private key. This is what EdDSA does.

Most modern wallets nowdays use deterministic nonces via RFC 6979. The newly introduced Schnorr signatures also do not have this weakness afaik.

"ECDSA" isn't a concrete scheme that you can use in any case. To implement ECDSA one must pick a group where the discrete log is hard, choose a message hashing function, and choose a way to serialize the values. One can optionally choose a derandomized method for generating the nonces, e.g. RFC6979 which is the approach taken by most implementations created in the last 5 years or so.

One could just as well implement something EdDSA compatible with insecure nonce generation and people have done so (for years the thing you got when you goggled for eddsa python was just such an implementation).

It's good that the eddsa paper specifies more of the system, as people have made bad choices and ruined the security-- but even it fails to completely specify the system: the exact input handling isn't specified, which has resulted in security problems.

With "ECDSA" I meant the original NIST ECDSA standard. It is, objectively, a bad standard. ECDSA as originally specified required the use of random numbers in signature generation; the RFC6979 approach may interoperate just fine and be a better idea, but it is not FIPS 186-4 compliant. If you have to break standards compliance to avoid security pitfalls, the standard is bad.

It's not just about specifying more of the standard either. EdDSA is designed to be harder to screw up an implementation of, by construction.

RFC6979 has a fairly convoluted design (and poor performance, requiring 12 invocations of the compression function when implemented with sha2 for a 256-bit curve) specifically so that it is actually a FIPS compliant DRBG with its initialization parameters set in a particular standard permitted way, so as to result in a derandomized nonce.

While I not a FIPS certification expert by any means, it was intended that implementations could implement RFC6979 without breaking the standard by simply using a standard allowed DRBG in the right way.

> EdDSA is designed to be harder to screw up an implementation of, by construction.

That's the marketing claim at least. It's debatable. Some of its choices make it easier to screw up, and widespread implementations of it have also been wrong in the varrious ways it was intended to address. It's a good idea to try, at least, for sure.

I think nonce security in particular is not at all the best example since modern ECDSA implementations are secure against in that respect. I'm also aware of some systems which have had grave security flaws because they believed the EdDSA claim of a deterministic signature meant that it was a unique signature. The promotion of EdDSA itself as magic pixie dust creates vulnerabilities.

There is just no replacement for understanding. :)

> You can recover a private key from two signatures if they reuse the same nonce.

You can, but you can also do a lot more than that. Thinking that this is the only attack is a common error, and precisely the one Wright was making in that recording.

Two signatures with different messages and the same key and message is just a special case of the fact that if you write out the signing equation as a linear system with privkey and nonce being unknown, and the message and signatures being the knows if the resulting matrix is exactly determined or over-determined, then you can solve for the unknown values.

It would also be the case that if you had two signatures with the same key and the nonces being any known multiple of each other that it's just as solvable.

There are other attack approaches, for example if you have a set of signatures where you know the leading bits of the nonce you can also recover the keys by solving a hidden number problem. (If you only know the single leading bit it'll take a few hundred signatures).

Cryptosystems are inherently fragile. The security assumptions of these schemes demand a uniformly random nonce. Deviation from the required property easily destroys security in practically exploitable ways.

The person Wright was arguing with was pointing out that if Wright had the private keys in question -- turns out he didn't-- it wouldn't be impossible that he obtained them after observing a single insecurely generated signature. Wright drove the discussion down a tangent with an argument that one couldn't recover a key with a single signature-- a false claim, but even if it were true it wouldn't really have supported his case.

Indeed; in general, if you know 1/n of the information in the nonces, you can recover the private key after n signatures. So even subtle biases in the random number generation can leak your key after a few transactions.

He did not (he even said they've recovered 10,000+ private keys!). If a nonce is reused across different signatures or just known because randomness is bad, one can compromise the private key used in making the signature.

It doesn't even have to be known completely! Almost deviation in the expected properties of the nonce severely damages security.

He's referring to the fact that with ECDSA signatures, if the randomness is bad on a single signature (i.e. you know the "k" value in the signature) then that is sufficient to reveal the private key used in making the signature. Similarly, if two signatures are made with the same nonce and private key, you can reveal the nonce and thus the private key. The maths is actually explained on the wiki page: https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signatu...

He's saying you can derive the private key from a single signature made using a known nonce value (the "bad random"). You can also derive the private key from two signatures made using the same nonce value. In both cases the solution just requires trivial algebra.

That's what we did to get the PS3 signing keys. Accidentally became a bit of a citation in the ECDSA world for that one too; who knew Sony would unwittingly earn the title of "canonical example of how to screw up ECDSA in a consumer product"? :-)

It's also how lots of Bitcoin have been taken away when transactions are signed using broken random number generators. These days people are running bots to spot those keypairs and automatically take the bitcoin.

Craig was Wright then, you can't derive the private key from a single transaction. Bitcoin would be broken if you could.

Rather, Craig had no idea what the conversation was even about.

Dr Nicolas Courtois - "You can get a private key from one single transaction or from one single digital signature."

That's false.

That's missing context. It's true if the nonce is predictable.

Craig Wright - "The nonces I used are non-standard."

Dr Nicolas Courtois - "Well, uhhhum that's the question."

Craig Wright told him that he used non-standard nonces, not predictable ones.

That's awesome, thank you. The irony of "show me or you're bullshit" is amazing!

He clearly knows he's talking to an actual expert who's calling him out, so he thinks faking getting angry and storming out is a good way for him to escape the situation.

What else is an cornered scammer supposed to do to save face?

It worked, didn't it?

Imagine saying your favourite thing in the world is education and then exacerbating yourself that much when the situation isn't going your way. My money is he loves being on stage "teaching" because he's in love with himself, not educating.

I AM THE KING! Why does everyone keep ignoring me and my orders?

What is sad is that anyone is even talking about this guy. From the beginning people pointed out he is lying and yet he is still somehow able to be talk about.

Most obvious con-man that is still able to stay in public spotlight.

how does this con-man make money off his cons though?

He's got a direct line to Calvin Ayre's money.

He's a household name in the crypto world. Sure, not in a good way, but any publicity is good publicity right?

He could offer his services to various blockchain-focused startups in which he'll fit right in considering said startups' objective is often to get money off clueless VCs by throwing the "blockchain" buzzword around (there are very little legitimate use-cases for a blockchain that can't be served by a traditional database, and a truly decentralized blockchain can't easily be monetized to the level a VC would want).

The people in Bitcoin that don’t understand public/private key cryptography. That is who Faketoshi leads.

He has a bad habit of suing former business partners that don't do exactly what he wants. E.g. he's currently suing the second and third person from the left in this photo https://i.redd.it/ph8slk43st331.jpg and the person on the right is the rube that is financing most of Wright's litigation.

He's a temporarily embarrassed billionaire, he just needs some funds to access his rightful fortune.

You don't even have to believe him - you'd just have to believe (or see viable risk/reward) that he has a shot at a successful legal attack.

Exactly.

Wright claims to own around $50 billion dollars worth of cryptocurrency which he cannot access.

Let's say he manages to convince you that he has 1% chance of success at obtaining these funds-- something you could believe even if you know he's a fraud, you just have to have a low opinion of the courts and misunderstand how Bitcoin works (which many people do, see this discussion!).

If offers you a 10% stake in his victory, what would you pay for that? Well under the 1% assumption you might be willing to pay $25 million dollars (half the expected value).

The buyers error is just in flawed reasoning about the odds of success, but people are notoriously bad at reasoning about fringe events and a lot of people don't understand Bitcoin.

For Wright, the fact that his effort cannot be successful is actually a very good property: It means that he can safely sell more than 100% of his fictional fortune: He doesn't have to worry that he'll win and then have to pay out >100%. Instead, he'll lose and tell his investors "Sorry, gave it our best shot but you always knew this was a risky deal!". In that case his income from the scheme is only limited by how many suckers he can bring in... 100 people paying 25m for a '10%' stake would yield a 2.5 billion dollar windfall.

And if you don't think there are at least 100 suckers out there with 25 million to blow you haven't been paying attention to all the defi/ico/nft noise the last couple years.

Right now we know of one major self-claimed billionaire that Wright is exploiting, but there may be many others-- particularly in Asia where language barriers make it much easier for Wright to isolate victims from discrediting information.

There are a lot of scams which start off with step 1: "Convince people that you have a lot of money".

Strong "Norton I, Emperor of the United States and Protector of Mexico" vibes.

He's launched a lot of legal actions in recent times that make him hard to ignore.

Because noone in the real world know or cares about him. In the land of clowns...

My favorite was him posting the fake signing and then when he was called out on it he posted a "Goodbye to the world" style message on his blog after taking it down.

May 2nd, 2016:

https://web.archive.org/web/20160502071722/http://www.drcrai...

May 7th, 2016:

https://web.archive.org/web/20160507165900/http://www.drcrai...

If he really were Satoshi, he could literally prove it in 4 seconds beyond any shadow of a doubt. Instead he obfuscates with things like Tulip Trusts that can't be touched until January 1, 2020 and then that date comes and goes (over 2 years ago now!) and nothing happens.

https://coingeek.com/what-is-the-tulip-trust/

Accused of forgery and perjury by at least one Judge:

https://cointelegraph.com/news/judge-slams-craig-wright-for-...

And then in 2017 he got the bright idea to start filing patent after patent on anything to do with Blockchain. Why did he wait 8 years after he "invented" it?

https://patents.justia.com/inventor/craig-steven-wright

There are like a hundred patents there from 2017 and after!

And he has two doctorate degrees (one in Theology!) with two more on the way and a dozen other degrees and certifications. The man is a wonder!

It's time I finally admit my past to the world - I'm Satoshi Nakamoto. AMA.

I am Spartacus, er Satoshi...

The We Are All Satoshi movement is a real thing :).

We are all Satoshi (but without the bitcoins).

Many media publications really helped him by posting articles about how he "admits" to being Satoshi and has a "very similar email address".

More recently Wright & co have been paying for a lot of coverage that essentially regurgitates his press releases.

The effect is that the reporting is becoming worse. Two years ago it was common for articles to mention that Wright's supposed proof was completely discredited. Today it's common for articles to say that Wright's claims haven't been "conclusively proved yet".

There is a big difference between saying that it isn't yet totally conclusive and saying that he tried to provide proof but it was proven to be a fraud!

Unfortunately, Wright has shown that he's willing to use SLAPP lawsuits against parties that criticizes him, including journalists. So you have to have deep pockets and a huge tolerance for nonsense to risk publishing something truly critical -- at least if you have enough visibility that he'll care.

Honestly I think it would be quite funny if he wins and developers have to rewrite part of the protocol to give a specific guy money. Would really highlight who's really in control.

It would be funny but it is physically impossible for all the reasons that make Bitcoin desirable.

> physically impossible

You mean ethically questionable? Because it is not impossible.

It's analogous to suing someone who makes gold jewelry to try to force them to get everyone else to start referring to lead as "gold" and paying gold prices for it.

That would be if he was asking for Bitcoin silver to take over Bitcoin. This is like someone asking the bank to give him someone else's massive but abandoned account, if more than half of its clients agree.

> This is like someone asking the bank to give him someone else's massive but abandoned account, if more than half of its clients agree.

That isn't how Bitcoin works, however. The protocol is enforced autonomously by each participant all on their own. The only voting like property in Bitcoin is the consensus used to decide the order of transactions in order to reject double-spends. Wright doesn't want to change the order of transactions-- the coins he's attempting to steal haven't moved since 2011.

If someone creates a transactions that spends some coins without the required signantures it'll just be ignored by all participants. If some participants adopt backdoored software that allow bypassing the authentication they'll just be ignored by everyone else, it doesn't matter how many do-- all automatically. Even if everyone else adopts that backdoor your own computer will just ignore them and continue the Bitcoin network with other non-backdoored participants.

So inherently what he seeks is to replace Bitcoin with an incompatible alternative. The only way that's possible is if people choose to adopt the alternative, call it bitcoin, trade it for bitcoin-prices, etc.

He's attempted it already too, he created Bitcoin Satoshi Vision-- his fork that is distributed under a proprietary software license. His conspirators and their victims go around telling people that it's the real bitcoin and that Bitcoin is an imposter. This has been mostly unsuccessful.

I don't really have a dog in this fight. I highly doubt the miners would move to that chain/protocol. There would be a hard fork of the source code and chain, possibly by people outside the reach of whatever jurisdiction this guy is in. It's just completely impossible for this to actually happen AND actually mean anything. Anyone can get access to any coins by changing the source code/protocol and hard forking the chain. But they won't be worth anything, just another orphaned side chain with nobody on it.

I think he's pinning his hopes on the assumption that if courts say his fork is Bitcoin, his chain is the one that exchanges regulated in Western countries will trade as Bitcoin, and therefore his fork is the one that dumb money that's heard Bitcoin is going to the moon and hasn't heard of Craig Wright or forks will buy. If actual cryptoenthusiasts are too disgusted to even sell off their tokens on his fork, that just helps his token sales

Nah, he already has a fork, the super sketch bitcoin knockoff "Bitcoin Satoshi's vision"... AFAIK the only US entity that will trade it is robinhood (which IMO tells you all you need to know about RH).

It's a not-particularly popular fork of Bitcoin. If they did this, I guarantee there would be a hard fork and the value of Craig's "bitcoin silver" would go to 0.

That just isn't how the system works.

Ironically, some of the funds that Wright is trying to demand a backdoor to access are ones that were indirectly stolen from the developers he's suing!

If we could have just wave a magic wand and magic those coins back into our possession, we would have!

Anyone at any time-- including you or wright or anyone else-- can go and make a modified version of Bitcoin with its own consensus rules that do whatever you want, print yourself a trillion coins from nothing. Wright even did this already a few years ago.

But your modified version doesn't do anything to anyone else, the only people it has an effect on are the people who choose to run it. Your version would form a separate currency (just as Wright's has) and you can compete in the market for adoption. If your version is distinguished by stealing a bunch of coins, I'd bet that it doesn't get much adoption particularly since the whole premise of Bitcoin advanced in it's initial announcement was giving people power against being overridden by that kind of capricious change.

https://p2pfoundation.ning.com/forum/topics/bitcoin-open-sou...

But the blockchain is all about immutability and you can't change the fundamentals!

I remember there were records of his blog where he was "downloading java courses on security" at the time when bitcoin was being developed by Satoshi )))

What if Craig Wright is suffering from mental health problems similar to those that affected Terry Davis, the author of Temple OS?

I understand the Craig Wright is violating the norms of public behavior. I think it would be more charitable to not assume that he’s necessarily in his right mind.

Uhhh, wut?

Terry built templeOS and spent years working on the project. No one questioned the authenticity of that project and anyone familiar with him or his illness would likely not compare him to Craig Wright. This analogy really falls flat and makes no sense.

Davis had schizophrenia, Wright is a pathological liar, very different diseases, both sadly incurable

What if he knew the creator(s) of Bitcoin, and is upset that a dead person had more impact on the world than he believes he ever will?

My own preferred theory as a layman is that Wright is Satoshi and has lost the keys.

Okay? I came up with a theory of ham sandwiches, but I’m no chef. (Thousand island dressing is an underrated addition to almost any sandwich.)

There’s nothing to indicate he’s who he claims to be.

Okay, then why can't he login to any of the accounts that Satoshi used originally in 2009? Mailing list accounts, email accounts, etc.

IIRC, his supposed reason is forgotten passwords. Not a great excuse, but also one that could plausibly happen.

One of the addresses he claims to own has signed a message saying it's not his though...

And when, presumably the real Satoshi, did so in 2014. (https://www.forbes.com/sites/kashmirhill/2014/03/06/bitcoin-...)

Then you haven't been paying attention. Wright is continually spouting literal gibberish and technobabble, he's technical inept to the point of hilarity. For example, when asked to explain some C code he claimed that the line declaring a double-type variable were doubling the values.

Beyond his ineptitude, Wright has repeatedly claimed he would provide proof, but then when his 'proof' is exposed to expert analysis it turns out to be a provable forgery. Not just once, but over and over again. Forged emails, forged pgp keys, forged digital signatures, forged invoices, forged whitepaper drafts. Not merely falsifiable but actually falsified.

It's certantly possible that Satoshi lost whatever keys he had-- but if so he isn't saying anything about it. The idea that Satoshi would lose keys and then make a clown out of himself is just not parsimonious.

What is parsimonious is that we know for a fact that Wright has been selling his "fortune" to suckers for a number of years now-- the setup of a classic Nigerian scam: I am a prince in exile but with a small advance from you I can access a vast fortune which I will gladly share with you. At first his excuse was that he couldn't touch the coins without risking the AU government seizing them (due to stealing millions from AU with fraudulent rebates), then his excuse was that the coins were secured by a "bonded courier" (think of the end of Back to the Future 2) and wouldn't be delivered until Jan 2020, and most recently he claims that in Feb 2020 hackers entered his home and hid a 'wifi pineapple' to penetrate his network and steal his coins (of course, the coins haven't moved on the blockchain)...

Seems Dorsey's COPA is going to try to prove that in court shortly

"Bitcoin 'inventor' will face forgery claims over his Satoshi Nakamoto proof, rules High Court" https://www.theregister.com/2022/01/06/craig_wright_satoshi_...

Yes, though wright has filed lawsuits against more or less every remaining known developer that worked with Satoshi and doesn't have a relationship with Wright in an apparent effort to create a conflict of interest to disqualify their input and intimidate them from participation (that's the subject of this article).

Reply on news.ycombinator.com