rasengan



Offline



Activity: 114

Merit: 10









MemberActivity: 114Merit: 10 Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 02, 2011, 12:06:11 AM

Last edit: January 04, 2012, 02:43:46 AM by rasengan #1 Mt. Gox Mobile, it just keeps getting easier.

block. Bitcoins are getting around the



EDIT: Please give us a high 5 (5 star the app) on the Android Market if you like it. We are working hard to meet every single feature request/optimization/modification for the community. We do this for Bitcoin. We do this for you. Happy Holidays and a very Happy New Year! 2012 is the year of Bitcoin! Let's do this! Feel free to e-mail help@mtgoxlive.com if you have any issues or come to our IRC channel on Freenode (#MtGoxLive).



Mt. Gox Mobile 3.1 includes support for redeemable private keys. Now you can import your private keys into your Mt. Gox account to redeem your Bitcoins. If you have a paper bitcoin wallet with a private key in Wallet Import format and many others, you will be able to instantly redeem the balance (6 confirmations req.).



Simply manually enter or scan a QR code to get started. It's easy. Mt. Gox Mobile 3.1 is available on Android and will be available shortly for Cydia/iOS.





Learn more on the Official Mt. Gox Mobile website.









QR Code is a registered trademark of Denso Wave International.

Android is a registered trademark of Google.

Mt. Gox Mobile is the official application of the Mt. Gox Bitcoin Exchange QR Code is a registered trademark of Denso Wave International.Android is a registered trademark of Google.









AWARD-WINNING

CASINO CRYPTO EXCLUSIVE

CLUBHOUSE 1500+

GAMES 2 MIN

CASH-OUTS 24/7

SUPPORT 100s OF

FREE SPINS PLAY NOW rtised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertised sites are not endorsed by theBitcoin Forum. They may beunsafe, untrustworthy, or illegain your jurisdiction. Advertise here.

casascius

VIP

Legendary



Offline



Activity: 1386

Merit: 1064





The Casascius 1oz 10BTC Silver Round (w/ Gold B)







Mike CaldwellVIPLegendaryActivity: 1386Merit: 1064The Casascius 1oz 10BTC Silver Round (w/ Gold B) Re: Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 02, 2011, 01:16:34 AM #4 Couple quick requests/suggestions.



1 - Are you able or willing to implement the Base58 checksum code, as well as the mini checksum for Casascius coins so typos can be automatically rejected? (Both are simple SHA256-based checks documented on the wiki under "Base58Check encoding" and "Mini private key format" respectively). Last I checked on MtGox, website accepts checksum failures (typos) and reports there is no balance, rather than rejecting the input.



2 - Two-part private keys have been recently discussed on the forums. They would provide very strong security, because it would enable physical bitcoins where the manufacturer can guarantee nobody has the private key, by creating half and allowing a 2nd party to add the other half. The two part scheme is based on elliptic curve addition, so the full bitcoin address can be computed with neither party knowing the full private key. Would you be willing to implement a redeemer for a two-part private key? (Two part private keys are convertable to a single private key with elementary math - a bignumber add and a divide - no complex EC stuff required. Each of the private keys would likely contain a bit flag that indicates it is only "half" of a key, so your system would know to ask for the other half). Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable. I never believe them. If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins. I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion. Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice. Don't keep coins online. Use paper or hardware wallets instead.

MagicalTux

Hero Member



Offline



Activity: 608

Merit: 501





-







VIPHero MemberActivity: 608Merit: 501 Re: Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 02, 2011, 06:02:46 AM #5 Quote from: casascius on December 02, 2011, 01:16:34 AM Couple quick requests/suggestions.



1 - Are you able or willing to implement the Base58 checksum code, as well as the mini checksum for Casascius coins so typos can be automatically rejected? (Both are simple SHA256-based checks documented on the wiki under "Base58Check encoding" and "Mini private key format" respectively). Last I checked on MtGox, website accepts checksum failures (typos) and reports there is no balance, rather than rejecting the input.



2 - Two-part private keys have been recently discussed on the forums. They would provide very strong security, because it would enable physical bitcoins where the manufacturer can guarantee nobody has the private key, by creating half and allowing a 2nd party to add the other half. The two part scheme is based on elliptic curve addition, so the full bitcoin address can be computed with neither party knowing the full private key. Would you be willing to implement a redeemer for a two-part private key? (Two part private keys are convertable to a single private key with elementary math - a bignumber add and a divide - no complex EC stuff required. Each of the private keys would likely contain a bit flag that indicates it is only "half" of a key, so your system would know to ask for the other half).



1. We already do the Base58 checksum. The only issue - I guess - is the fact we fall back to SHA256 if the checksum does not verify. For your "mini private key format" checksum I'll have to check the doc and see how it works.



2. That shouldn't be an issue, could you show me a couple of those (you got my email) with the required computation and we'll implement it. 1. We already do the Base58 checksum. The only issue - I guess - is the fact we fall back to SHA256 if the checksum does not verify. For your "mini private key format" checksum I'll have to check the doc and see how it works.2. That shouldn't be an issue, could you show me a couple of those (you got my email) with the required computation and we'll implement it.

casascius

VIP

Legendary



Offline



Activity: 1386

Merit: 1064





The Casascius 1oz 10BTC Silver Round (w/ Gold B)







Mike CaldwellVIPLegendaryActivity: 1386Merit: 1064The Casascius 1oz 10BTC Silver Round (w/ Gold B) Re: Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 02, 2011, 06:50:31 AM #6 Quote from: MagicalTux on December 02, 2011, 06:02:46 AM

1. We already do the Base58 checksum. The only issue - I guess - is the fact we fall back to SHA256 if the checksum does not verify. For your "mini private key format" checksum I'll have to check the doc and see how it works.



2. That shouldn't be an issue, could you show me a couple of those (you got my email) with the required computation and we'll implement it.



I couldn't find a PM or e-mail, sorry.



Mini private keys are always 22, 26, or 30 characters long and always start with 'S'. Simply limiting SHA256 hashing to those lengths will solve the Base58 checksum problem.



Mini private keys are validated by hashing SHA256(entry + "?") and confirming the result starts with eight zero bits.



The computation for merging a multi part private key (regardless of the number of parts) is to get the private key of each part (a 32-byte unsigned bignumber, just like a standalone private key), adding them all together, dividing the total by the secp256k1 constant N, and using the remainder as the combined private key.



The constant N is 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141



You are probably aware that Base58Check-encoding a private key implies the version byte 0x80, and that mini private keys start with 'S'. I propose using a different version byte to specify that a private key is incomplete and requires other keys.



A version byte of 0xA2 will ensure that a Base58 private key starts with '6' instead of '5'. A mini private key could start with 'P' to specify it is partial. Either of these would simply be a clue to MtGox (or any other redeemer) that the private key needs to be combined with something else to be complete, and to show a second prompt asking for the other half of the private key, rather than proceeding to redeem the single private key.







I couldn't find a PM or e-mail, sorry.Mini private keys are always 22, 26, or 30 characters long and always start with 'S'. Simply limiting SHA256 hashing to those lengths will solve the Base58 checksum problem.Mini private keys are validated by hashing SHA256(entry + "?") and confirming the result starts with eight zero bits.The computation for merging a multi part private key (regardless of the number of parts) is to get the private key of each part (a 32-byte unsigned bignumber, just like a standalone private key), adding them all together, dividing the total by the secp256k1 constant N, and using the remainder as the combined private key.The constant N is 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141You are probably aware that Base58Check-encoding a private key implies the version byte 0x80, and that mini private keys start with 'S'. I propose using a different version byte to specify that a private key is incomplete and requires other keys.A version byte of 0xA2 will ensure that a Base58 private key starts with '6' instead of '5'. A mini private key could start with 'P' to specify it is partial. Either of these would simply be a clue to MtGox (or any other redeemer) that the private key needs to be combined with something else to be complete, and to show a second prompt asking for the other half of the private key, rather than proceeding to redeem the single private key. Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable. I never believe them. If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins. I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion. Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice. Don't keep coins online. Use paper or hardware wallets instead.

rasengan



Offline



Activity: 114

Merit: 10









MemberActivity: 114Merit: 10 Re: Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 03, 2011, 05:21:53 PM #7 These are some pretty interesting suggestions, and we will definitely look into this. A two or more part private key would be very interesting. (The first thing that actually came to mind was a scene in "Gundam Seed Destiny" where Kira and Lacus have two separate keys which are both required to unlock Freedom. -- Pretty cool idea)



Also, just a note, a small update (version 3.11) was pushed which includes a fix for some users who have indicated issues while on unstable wireless networks.



Edit: forgot a comma in the first sentence

Edit #2: added gundam remark

casascius

VIP

Legendary



Offline



Activity: 1386

Merit: 1064





The Casascius 1oz 10BTC Silver Round (w/ Gold B)







Mike CaldwellVIPLegendaryActivity: 1386Merit: 1064The Casascius 1oz 10BTC Silver Round (w/ Gold B) Re: Gettin' Paper - Redeemable Private Keys now in Mt. Gox Mobile 3.1 December 16, 2011, 04:48:11 PM #14 Have you considered emulating the YubiKey functionality in the MtGox app, at least as a blockade for withdrawals? So that the app can be used to generate one time passwords one must type into a PC to do a withdrawal. This isn't going to ever be as strong as a real YubiKey, but it would be free and available immediately and would be a meaningful impediment to theft via keyloggers. Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable. I never believe them. If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins. I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion. Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice. Don't keep coins online. Use paper or hardware wallets instead.