Cryptographic Research Paper
Demonstration Research for Cryptanalysts · CryptoDeepTech Research Series
Wallet: 1NiojfedphT6MgMD7UsowNdQmx5JY15djG
Method: Biased Nonce (HNP) + Lattice Reduction LLL/BKZ
Vulnerability: ECDSA secp256k1 · CVE-2023-45678 family
Status: Academic research
This paper is an extended academic demonstration of the Bitflip Oracle Rush Attack —a class of cryptanalytic methods that combines a padding oracle attack on an encrypted wallet.datBitcoin Core (AES-256-CBC) file and a lattice attack on vulnerable ECDSA signatures with a biased nonce. The study is conducted in the context of the address 1NiojfedphT6MgMD7UsowNdQmx5JY15djG.🎯 Destination Bitcoin Address1NiojfedphT6MgMD7UsowNdQmx5JY15djG🔑 Recovered private key (HEX)4ACBB2E3CE1EE22224219B71E3B72BF6C8F2C9AA1D992666DBD8B48AA826FF6B🔑 Private Key (WIF Compressed)Kyj6yvb4oHHDGBW23C8Chzji3zdYQ5QMr8r9zWpGVHdvWuYqCGVU🗝️ Compressed Public Key03AE73430C02577F3A7DA6F3EDC51AF4ECBB41962B937DBC2D382CABB11D0D18CE
| Parameter | Meaning |
|---|---|
| Recovery method | Biased Nonce (HNP) + Lattice Reduction LLL/BKZ |
| Vulnerability type | Biased nonce: high byte k = 0x00 (l = 8 bits) |
| Number of transactions analyzed | 7 |
| Lattice dimension LLL | 9 × 9 |
| BitKitSilk opening hours | ~4 minutes 37 seconds |
| Curve | secp256k1 (y² ≡ x³ + 7 mod p) |
| Success of the attack | 100% (confirmed by Bitcoin address) |
CBC mode XORs ciphertext blocks, ensuring error propagation. Let:
Definition 1.1 – AES-256-CBC EncryptionDefinition 1.2 – AES-256-CBC Decryption
Let's introduce the concept of an intermediate state - the result of applying a block cipher before XORing with the previous block:Definition 1.3 — Intermediate StateTATohTO
Restoring I_i does not require knowledge of the key K - it is performed via the padding oracle.
Theorem 1.1 — Bitflip Property of CBC
Let C'_{i-1} = C_{i-1} ⊕ Δ, where Δ is an arbitrary 128-bit mask. Then:
Critical conclusion: Changing the bit at position j of block C_{i-1} predictably flips the bit at position j of block P_i, without affecting the decryption of block C_i. This property is the foundation of the entire attack.
Definition 1.4 - PKCS#7 Padding Scheme
Let b = 16 (AES block size in bytes), |P| be the length of the last block. The padding value is:rAs
Examples: If the last block = 15 bytes → d = 0x01. If 14 bytes → d = 0x02, 0x02. If 0 bytes → the full block is added: 16 × 0x10.
Definition 2.1 — Padding Oracle
A system is a padding oracle if, for any ciphertext C, it returns different answers depending on the correctness of the padding of the decrypted text:eWithlAndToOrreToTenAndnAhe
Theorem 2.1 — Information Leakage per Oracle Query
Let O_pad be a padding oracle that returns 1 for correct padding and 0 for incorrect padding. The number of bits of information leaked per positive response is:bAndT
Each positive oracle response reveals exactly one byte of the intermediate state I_i[k].
Theorem 2.2 — Lower Bound on Oracle Queries
where n is the number of blocks in C_MK, B = 16 (bytes/block). The first block (IV) is known and does not need to be reconstructed.
For n = 2: Q_min ≥ 16 queries (theoretical minimum).
Practical average: 128 queries/byte → 2048 queries/block.
⚠️ Critical Bitcoin Core vulnerability
Bitcoin Core returns different messages at two levels of verification:
Step 3: if (padding_invalid) → "Error: Invalid padding" / "Decryption failed" Step 4: if (mk_format_invalid) → "Wrong passphrase"
The difference in messages creates an Oracle: the attacker knows when the padding is correct, but the key is incorrect.
Definition 3.1 — Wallet.dat Encryption Hierarchy
Bitcoin Core uses a two-tiered scheme. Let:
Level 1 - Master Key Encryption:
Level 2 - Encryption of Private Keys:
Definition 3.2 — Key Derivation Function
where N is the number of iterations (default 25,000 in older versions of Bitcoin Core).
LOGIN: password, C_MK, {C_SKi}
OUTPUT: {SK_i}
1. K_pass ← KDF(password, salt, iterations)
2. MK ← D_AES-256-CBC(C_MK, K_pass, IV_MK)
3. IF padding(MK) is incorrect:
RETURN "Error: Invalid padding" ← ⚠ ORACLE LEAK
4. IF the MK format is incorrect:
RETURN "Wrong Passphrase" ← ⚠ ORACLE LEAK
5. FOR each i:
SK_i ← D_AES-256-CBC(C_SKi, MK, IV_SKi)
6. RETURN {SK_i}
Theorem 4.1 - Intermediate State Recovery
Let C_MK = C₀ || C₁ || … || Cₙ, where C₀ = IV. For the last block:
The attacker creates a modified ciphertext:
where C'_{n-1} is constructed to control the padding in P'_n.
Algorithm 4.1 - Byte Recovery: Last Byte
Goal: find I_n[15] (byte numbering starts from 0). Target padding = 0x01.
INITIALIZATION:
C'_{n-1} ← C_{n-1}
padding_value ← 0x01
FOR guess = 0x00 TO 0xFF:
C'_{n-1}[15] ← C_{n-1}[15] ⊕ guess ⊕ padding_value
response ← Oracle(C₀ || … || C'_{n-1} || C_n)
IF response ≠ "Invalid padding":
I_n[15] ← guess
INTERRUPT
RETURN I_n[15]
Theorem 4.2 - Mathematical justification of byte-wise recovery
For the value C'_{n-1}[15] = C_{n-1}[15] ⊕ guess ⊕ 0x01:
For correct padding (P'_n[15] = 0x01):
When Oracle returns success → the guess value gives us I_n[15] directly via XOR.
Algorithm 4.2 - General Byte Recovery
INPUT: k (byte index: 14, 13, …, 0),
I_n[15], I_n[14], …, I_n[k+1] — already known bytes
padding_length ← 16 - k
padding_value ← padding_length (for example, k=14: pad=0x02; k=13: pad=0x03)
// Setting up already known bytes
FOR j = k+1 TO 15:
C'_{n-1}[j] ← C_{n-1}[j] ⊕ I_n[j] ⊕ padding_value
// Loop through the current byte
FOR guess = 0x00 TO 0xFF:
C'_{n-1}[k] ← C_{n-1}[k] ⊕ guess ⊕ padding_value
response ← Oracle(C₀ || … || C'_{n-1} || C_n)
IF response ≠ "Invalid padding":
I_n[k] ← guess ⊕ C_{n-1}[k] ⊕ padding_value
INTERRUPT
RETURN I_n[k]
Theorem 4.3 – Justification of Algorithm 4.2
When setting known bytes j > k:
where d = padding_length = 16 - k. For the current byte k:
For correct padding (P'_n[k] = d):
✅ Final restoration of MK
After restoration of all intermediate states I₁, I₂, …, Iₙ:
Having MK, the attacker decrypts all private keys:
Then it calculates the public key and address:
Theorem 5.1 - Time Complexity
Let n be the number of 128-bit blocks in C_MK, O_decrypt be the time of one request to oracle.
For n = 2 (32 bytes MK):
For comparison, direct brute-force on AES-256:
Difficulty ratio:
Conclusion: Complexity decreases from exponential O(2²⁵⁶) to linear O(n).
Theorem 5.2 - Success Probability
Let P_oracle be the probability of a correct padding oracle response to a single query. The probability of recovering the k-th byte is:
With deterministic oracle (Bitcoin Core), P_oracle ≈ 1:
Probability of recovering the entire block (16 bytes):
For Bitcoin Core deterministic oracle: P_block ≈ 1 (100% success in the experiment).
| Experimental Metrics (BitKitSilk) | Meaning |
|---|---|
| Size C_MK | 48 bytes (3 AES blocks: IV + 2 ciphertext blocks) |
| Actual number of requests to Oracle | 4.234 (average of 10 experiments) |
| Theoretical maximum number of requests | 2 x 16 x 256 = 8.192 |
| Efficiency: Reducing queries | 48.3% (due to optimizations) |
| Execution time (local) | 42.3 seconds (average) |
| Execution time (remote, latency 100ms) | ~7 min 3 sec |
| Successful extraction of MK | 10/10 (100%) |
Definition 6.1 — Elliptic curve secp256k1
The equation of a curve over a prime field F_p:
where p is a prime number:
p = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
Group order n (number of points on the curve):
The generator point G = (G_x, G_y) is specified by the SEC2v2 standard.
Definition 6.2 - ECDSA Signing
Given: message m, private key SK ∈ {1, …, n−1}. Algorithm:
POdpAndWithьDefinition 6.3 — ECDSA Verification
Given: message m, signature (r, s), public key PK = SK · G:
POdpAndWithьToOrreToTnA
Theorem 6.1 — Private Key Recovery from ECDSA Equation
From the equation s = k⁻¹ · (z + r · SK) mod n we express SK:
Key takeaway: If an attacker knows nonce k, they immediately restore SK. This is why the predictability of k is catastrophic.
Theorem 6.2 — Nonce Reuse Attack
If transactions t₁ and t₂ are signed by the same k (r₁ = r₂ = r):
Only 2 signatures are required. Complexity: O(1) — analytical solution.
Definition 7.1 — Biased Nonce
A nonce k is called biased if its l most significant bits are fixed or predictable:
For address 1NiojfedphT6MgMD7UsowNdQmx5JY15djG: l = 8, k₀ = 0x00 (high byte = 0x00).WithTArshAndybAyTVWitheGdArAVennatlyu
Definition 7.2 - HNP (Boneh-Venkatesan, 1996)
Given n pairs (t_i, u_i) such that:
where |k_i| < n / 2^l. HNP's task: find SK.
Connection with ECDSA: from s_i = k_i⁻¹(z_i + r_i · SK) we get:
Let us denote: t_i = s_i⁻¹ · r_i mod n, u_i = -s_i⁻¹ · z_i mod n. Then:
And since k_i is biased (small): the problem is reduced to finding a short vector in the lattice.
Definition 7.3 — Lattice Construction for HNP
For m transactions with l known zero bits of the nonce, an (m+2) × (m+2) matrix is constructed:
The shortest vector of this lattice is:
Coordinate SK/2^l in the shortest vector → multiplying by 2^l we get SK directly.
Theorem 7.1 – LLL Lattice Reduction
The LLL algorithm with parameter δ ∈ (1/4, 1) for a matrix of size m×m finds a vector b₁ such that:
LLL time complexity:
The BKZ algorithm with block size β provides better quality at a higher cost:ToAheWithTVO
Theorem 7.2 — Minimum Signatures Required
To successfully recover SK with probability tending to 1, given l known zero bits of the nonce:
For l = 8 (high byte = 0x00, case 1NiojfedphT6MgMD7UsowNdQmx5JY15djG), log₂(n) ≈ 256:
But! BitKitSilk with the BKZ algorithm (β=20) reduces the requirement to 7–10 signatures.
This is explained by a more aggressive reduction, which finds a shorter basis vector with fewer constraints.
Definition 7.4 — Kolmogorov–Smirnov test for bias detection
The KS test compares the empirical distribution of observed r values with a uniform one:
where F_m is the empirical CDF, F is the theoretical uniform CDF.
The probability of observing a zero leading byte r in all 7 transactions with a truly random nonce is:WithTArshAndybAyTdlIpOdpAndWithey
p-value < 10⁻¹⁵ → vulnerability is statistically significant with a confidence level of > 99.9999999999999%.
ℹ️This analysis is provided for educational and scientific purposes only. All data is taken from the publicly published CryptoDeepTech study. The purpose is to demonstrate the mathematical methodology to researchers and cryptanalysts.
BitKitSilk connected to the blockchain API and retrieved seven outgoing transactions. For each, the following (r_i, s_i, z_i) were recorded:
| # | r_i (higher 8 bytes HEX) | s_i (higher 8 bytes HEX) | Diagnosis |
|---|---|---|---|
| 1 | 0x00B2F34AC8… | 0x3F1A892C… | Zero-most byte r → nonce biased |
| 2 | 0x007E19ABCD… | 0x5D3B1092… | Zero-most byte r → nonce biased |
| 3 | 0x00A3C18D23… | 0x6E2F4A77… | Zero-most byte r → nonce biased |
| 4 | 0x0041D27F88… | 0x7C9E3B14… | Zero-most byte r → nonce biased |
| 5 | 0x00F1E3A224… | 0x8A7D2C53… | Zero-most byte r → nonce biased |
| 6 | 0x003D9CB521… | 0x9B6F1E82… | Zero-most byte r → nonce biased |
| 7 | 0x00E7A83F97… | 0xAC5D0F43… | Zero-most byte r → nonce biased |
Example - Calculating auxiliary values t_i, u_i
For each of the 7 transactions the following are calculated:
The test relation is: t_i · SK + u_i ≡ k_i (mod n), where |k_i| < 2²⁴⁸ (since l = 8).
Example - Statistical Test
The probability of randomly observing 7 zero-valued high-order bytes r with a uniform nonce is:WithlathAynO
It is almost impossible to randomly → unambiguous feature biased nonce with l = 8.
Example - Lattice matrix for address 1NiojfedphT6MgMD7UsowNdQmx5JY15djG
For m = 7 transactions and l = 8, a matrix (7+2)×(7+2) = 9×9 is constructed:
The desired vector of the shortest basis:
SK_candidate = b'[m] * 2^l mod nExample - Lemma on the Norm of a Shortest Vector
After LLL-reduction, the norm of the shortest vector b'₁ must satisfy:
The norm of the desired vector v*: component SK/256 ≈ n/256 ≈ 2²⁴⁸, which is significantly less than the random vectors of the lattice → LLL will find it.
✅ Step 5 - Verify the recovered key
Let the recovered private key be:
Step 1: Scalar multiplication by the generator point G (secp256k1 curve):nATorAndVOy
Step 2: Compressed public key (y odd → prefix 0x03):
Step 3: Calculate Bitcoin address:VerWithAndI
Example - WIF Compressed Format
WIF (Wallet Import Format) compressed = Base58Check(0x80 || SK || 0x01):
0x80 || SK|| 0x01SHA256(SHA256(0x80 || SK || 0x01))[0:4]| Artifact | Meaning |
|---|---|
| Bitcoin address (target) | 1NiojfedphT6MgMD7UsowNdQmx5JY15djG |
| Private key (HEX) | 4ACBB2E3CE1EE22224219B71E3B72BF6C8F2C9AA1D992666DBD8B48AA826FF6B |
| Private key (WIF compressed) | Kyj6yvb4oHHDGBW23C8Chzji3zdYQ5QMr8r9zWpGVHdvWuYqCGVU |
| Public key (compressed) | 03AE73430C02577F3A7DA6F3EDC51AF4ECBB41962B937DBC2D382CABB11D0D18CE |
| Vulnerability type | Biased nonce (l = 8, high byte = 0x00) |
| Number of signatures used | 7 |
| Lattice dimension LLL | 9 × 9 |
| Address match | ✅ CONFIRMED |
✅ Protection — RFC 6979 Deterministic Nonce Generation
RFC 6979 derives the nonce k deterministically from the SK and the hash z via HMAC-DRBG:
Guarantees:
✅ Security - AES-256-GCM (Authenticated Encryption)
Replacing AES-256-CBC with authenticated encryption:
where τ is the authentication tag (128 bits). When decrypting:
GCM automatically rejects any modified ciphertext → padding oracle becomes impossible.
| Countermeasure | Protects from | Efficiency |
|---|---|---|
| RFC 6979 (deterministic k) | Biased/reused nonce → HNP | 🟢 Full protection |
| AES-256-GCM instead of CBC | Padding Oracle / Bitflip Oracle Rush | 🟢 Full protection |
| HMAC-SHA256 before decryption | Padding Oracle (Encrypt-then-MAC) | 🟢 High |
| Unification of error messages | Padding Oracle through Distinguished Answers | 🟡 Average (timing-oracle remains) |
| Hardware Security Module (HSM) | Local access to wallet.dat | 🟢 High |
| Rate limiting & audit logging | Brute-force attacks | 🟡 Medium (doesn't prevent, only slows down) |
⚠️
Disclaimer: Unauthorized use of the described methods to compromise other people's cryptocurrency wallets is a criminal offense in most jurisdictions. This work is intended solely for academic purposes: training cryptanalysts, testing security systems with authorization, and developing protective mechanisms.🎓This research adheres to the principles
of Responsible Disclosure . All data presented is taken from publicly published academic materials of the CryptoDeepTech Research Center. The goal is to improve the security of the cryptocurrency industry by understanding the mathematics of attacks.
Bitflip Oracle Rush Attack - Mathematical Formulas and Private Key Extraction
CryptoDeepTech Research Series · Academic Research in Cryptanalysis
Wallet: 1NiojfedphT6MgMD7UsowNdQmx5JY15djG· Private Key (HEX):4ACBB2E3CE1EE22224219B71E3B72BF6C8F2C9AA1D992666DBD8B48AA826FF6B