Dark Skippy is a new attack that in theory, makes it much easier for a malicious person to steal your coins. Listen in to learn about some of the ins and outs here, as well as mitigation and the path forward for the industry from @utxoclub , @LLFOURN & @robin_linus . 

Summary

The conversation discusses the ‘Dark Skippy’ attack, a new method for leaking secret keys from a malicious signing device. The attack takes advantage of the nonces used in the Schnorr and ECDSA signature schemes. The new attack vector can potentially extract private keys and seed words from hardware wallets. The attack targets the nonce generation process during key generation and signing. The previous versions of this attack were inefficient, but Dark Skippy improves upon them. The contributors explain how the attack came about and its implications for hardware wallet security. They also discuss the RFC6979 deterministic nonce generation and the concept of anti-klepto signing protocols as mitigations against the attack. 

While Dark Skippy is a sophisticated attack, it requires a high level of expertise and is not currently seen in the wild. The discussion highlights the importance of secure boot, upgrading the Partially Signed Bitcoin Transaction (PSBT) process, and improving the randomness of upfront key generation as potential mitigations. 

However, it is emphasized that current reputable hardware wallets still provide a high level of security, and there is no immediate action required for users.

Takeaways

Timestamps:

(00:00) - Intro

(00:45) - What is ‘Dark Skippy’?

(04:39) - Is it an old attack vector? Bitcoin’s security evolving with time

(12:41) - Sponsor

(15:22) - What is a nonce?, RFC6979 Deterministic nonce generation

(22:55) - Common ways of people losing their Bitcoin

(31:08) - Sponsor

(32:07) - Anti-klepto signing protocols; ways to mitigate risks of losing coins

(39:51) - Updating PSBT to help mitigate this attack

(43:26) - The role of Multisig in preventing the attack

(49:57) - Other attack vectors in malicious actor’s toolkit

(56:49) - Summarizing the steps to improve the ecosystem security

(1:00:18) - Closing thoughts

Links: 

Sponsors:

Stephan Livera links: