OP_RETURN in a coinbase transaction? Hey looking at this transaction I'm confused why there are two outputs and why one of them is labelled with OP_RETURN

Every segwit block has one such OP_RETURN in the coinbase transaction: It's the Merkle root of the witness tree.

When the segwit softfork was activated, this included a fix to the third-party transaction malleability issue that was present on the network before. The issue was that the signature of a transaction could be changed by any other person by inverting the S-value used in the signature. This resulted in another valid (non-standard) transaction spending the same coins to the same recipients, but a different txid.

Segwit prevented this source of transaction malleability by moving the witness program out of the input script to a separate "witness field" in the transaction ("segregated the witness") which is ignored when the txid is calculated. This means that even when signatures are changed for segwit transactions, their txid remains the same. Making the txid independent from the signature also makes it easier to build on top of unsigned transactions (since their txid doesn't change with the signature) which is e.g. useful for smart contracts employed in Lightning Network payment channels.

A block commits to all of its transactions by including the root of the Merkle tree over their txids. However, this would mean that this commitment wouldn't cover the signatures of segwit transactions as they don't contribute to the txid. To commit to the signatures, segwit introduced the a second parallel Merkle tree, built from the witness txids, i.e. a transaction id calculated over the complete transaction data including the witness program. Since the blockheader can't be extended without a hardfork, segwit blocks commit to this witness tree by including the root in an OP_RETURN in the coinbase transaction.


Are there any example of Bitcoin being used for IOT application? I am looking for examples of Bitcoin mining being integrated into embedded systems so that a by product of the services being provided is more Bitcoins. For example if I have a control system for a factory CHP system boiler then I would like to use that to generate bitcoins during spare cycles as well as provide a mechanism for billing and buying/selling spare capacity.

That makes no economic sense. If such a thing did make economic sense, everyone would already be doing it, raising the difficulty until just the point where it no longer made sense. There is no way the bitcoins generated could justify the additional electricity consumed.

This is equivalent to arguing that if you have a bit of ground beef left over from making tacos for your family, you can make a hamburger and sell it to compete with McDonald's. McDonald's is 100% optimized for making and selling hamburgers cheaply. There is no way you could justify the costs involved in making and sell a single hamburger.

The supply of newly-mined Bitcoins has a fixed, known rate. If the most efficient miners spend X dollars to mine a Bitcoin, then they will increase the amount of mining until it costs them almost X dollars to mine a Bitcoin. Unless you can compete with their efficiency, which you can't because everything about their operation is intended to maximize their efficiency, you will lose money.


How to find out if Bitcoin is running ANYWHERE on my laptop Sooo long story short, I have a Samsung series 7 laptop, i'm running Fedora 18 and I downloaded Bitcoin-qt not too long ago.  I am admittedly stupid for doing so before doing ALL proper research (though I did a lot, but not enough) I am pretty much over my bitcoin phase for the moment and would LOVE LOVE LOVE to completely remove bitcoin and any trace of it from my system.. I have had some pretty big speed issues since installing and even though I have tried to delete bitcoin I am almost positive it is still haunting me and secretly running on my machine....Can someone PLEASE give me the proper instructions to A) Find it on my system and B) DELETE IT ALL!!????
I am soo tired of spending as much time as I have searching Google and every forum under the sun for a simplistic answer...and by simplistic I mean I am also VERY new to Linux based systems so I am not familiar with command lines....
Sorry for being "stupid" for doing what I've done but hey...live and learn!  Thanks in advance for the help!!

Michelline

By using ps and searching for processes named bitcoin:

ps aux | grep bitcoin | grep -v grep

The second grep just filters out the first grep which might under some conditions show up as well.
If you want to kill them just use the following:

for i in `ps aux | grep bitcoin | grep -v | awk '{print $2}'` do
  kill $i
done

This searches for running bitcoin processes, reduces them to the pid field and for each found pid it sends a kill.


Why do websites such as satoshimines and bustabit generate new addresses every time? Why a single address for each user not enough? Can't they just verify the incoming transactions?

If I want to mimic this practice, how can I generate unlimited addresses, from which transactions can be sent and received?

I am searching for an alternative to the Blockchain APIs...

There are privacy advantages of always generating a new address.

You can easily accomplish this with the use of HD wallets.


Prompt user for payment amount using bitcoin bip 70? When specifying the details for the payment object I have noticed that if I leave amount blank I am not prompted to enter an amount by the bitcoin-qt 0.9 client.

xpd = x.PaymentDetails()
xpd.time = int(time())
xpd.outputs.add(amount = 10000000, script = serialized_script)
xpd.memo = 'this is xpd memo'
xpdstring = xpd.SerializeToString()
xpr = x.PaymentRequest()
xpr.serialized_payment_details = xpd.SerializeToString()
xprstring = xpd.SerializeToString()

If I do not specify an amount then it is set to zero by default and I am presented with the error that the bitcoin amount is too small and is considered 'dust'.

Please can someone help me understand how to prompt the user for a deposit amount if the amount field is blank?

Thanks.

Additionally I should note that I am using the testnet.


Why can't default minimum fee rate be changed to 0.1-0.2 sat/vByte? Main question (focus on this incase you are looking to close it as "needs focus"): Why can't we change default minimum fee rate to something below 1 sat/vByte?

It was done in past: https://github.com/bitcoin/bitcoin/pull/3305 why not again?

Why does nobody respond to comments in this pull request? https://github.com/bitcoin/bitcoin/pull/13990 Do I need to be from some OG devs group or from blockstream or chaincode labs to contribute and discuss? Or some PRs are intentionally kept pending because a certain group doesn't want things mentioned in it?

Do you think it will result in spamming? I don't think so and few other people as well: https://www.reddit.com/r/Bitcoin/comments/kjrbny/should_default_minimum_fee_rate_be_01_satvbyte_now/ggyym67

The primary reason for the minimum feerate (and related things like the discard feerate) is preventing the use of the P2P network as a cheap global broadcast system. If it's easy to produce transaction that will never confirm yet will relay across the network, it'd open the network to abuse. I don't know what the right level is to make sure that doesn't happen, but 1 sat/vbyte seems pretty low.

That was before the network and mempool logic had floating fees. Now the feerate is primarily set by market pressure, and lowering the minimum would at most have an impact during times when there is ~no demand for block space. I personally think the ecosystem should expect to function fine when there is continuous back pressure, so I'm not sure what is gained by reducing it.

I can't speak for anyone else, but I don't think it's interesting to spend review time on. Note that the PR you link to is just to increase precision of the internal data types used for feerates; it doesn't change any relay policy.

I don't think spam is the problem. Lately the feerate has been significantly higher than 1 sat/vbyte anyway, and long term I hope that whatever the minimum is set to, it's effectively never hit. What matters is the discard feerate, which is not set by the market (it's the "additional" feerate you need to pay to replace a transaction in the mempool through RBF or mempool limiting, in order to make sure there is some cost to relaying the transaction that is now expected to not be mined anymore). That discard feerate is by default set to 1 sat/vbyte as well, which seems low.


Move bitcoin data from Windows to Mac Is it possible to move the Blockchain data from Windows to Mac? The wallet on windows is synced, the one on mac is not. The wallet on Mac has had some bitcoins sent to one of its addresses. Would it be safe to copy the blocks and chainstate folder to the mac from windows without losing the bitcoins?

The blocks, chains, and all that excessive data can be tossed. All you need is your wallet.dat which contains your private key.

I like to think of it this way... The bitcoin network is like a massive bank full of billions, trillions, and so on of vaults. You can put coins into any vault without needing a key to that vault. You can only take coins out of a vault IF you have a key to that vault (your wallet). Your coins are never stored on your actually computer. Only the KEY to the vault is stored on your computer. That key is used to access your coins. Downloading the blockchain is simply a way of letting your bitcoin client know how many coins you have, who you sent coins to, and who sent coins to you. Its like a virtual copy of those billions of vaults, which mostly all you don't have access to. Only that vault whose key you possess. Good luck!


Parsing stripped-witness blocks I've read all the relevant BIPs, and am still confused.

Are segwit enabled blocks stripped of witness data and marker and flag bytes when they are propagated to non-segwit peers? Or are they just serialized in such a way as to ignore the those bytes?

It is my understanding that blocks containing segwit transactions may have the witnesses, flag, and version bytes in them, or may not - depending on where that block is being propagated from. If it is coming from a non-segwit node, the transactions will be stripped. However, what happens when a stripped-witness block then reaches a Segwit-enabled node? How will it know that those transactions are actually segwit and are just missing the relevant data? Do they compare the txid's to txids in their cache and fill in the data?

Follow up question: what is the process/flow for individual transaction messages? Do their contents also depend on what type of node is asking for them?

When forwarding the block to a non-segwit peer, a segwit-enabled node strips the witness data from the block before transmission, including marker and flag. Note that the stripped blocks still enable the non-segwit peers to arrive at the same UTXO set, since the stripped transactions specify which inputs get spent and which new outputs get created.
If a segwit-enabled node were to receive a stripped block, it would consider the block invalid due to the missing witness data on transactions with segwit inputs (and the presence of a witness commitment). Thus, a segwit-enabled node will not requests blocks from non-segwit peers as they wouldn't be able to provide the complete block anyway (unless the block had no segwit transactions and no witness commitment).
Segwit inputs were designed so that non-segwit nodes consider segwit transactions valid but non-standard. Non-standard transactions are not accepted into the mempool and thus not relayed. This means that non-segwit nodes will not relay (stripped) segwit transactions except in the context of a new block. In turn, this makes it safe for segwit nodes to request transaction inventory offered by non-segwit peers, since non-segwit peers will only offer non-segwit transactions.


Why does blockchain.info say BTC was traded for $35? According to blockchain.info, BTC reached a peak rate of $35 in June 2011. According to the data available from bitcoincharts.com, the highest price BTC was traded in Mtgox that month (and until recently, the all-time high) is $31.9099.

What is the reason for this discrepancy? Does blockchain.info give the rate from an exchange other than Mtgox?

In the past blockchain.info got their prices from two sources: MtGox and Tradehill (though in the meantime they have removed the reference to Tradehill from their description). It could be related to that.

Also other media report a peak rate of USD 33, e.g., http://www.economist.com/blogs/babbage/2011/10/virtual-currencies


Could speculation some day rise bitcoin to the moon? I saw too many questions about bitcoin losing value.

But in my view, 21 million bitcoins is relatively less money (ie., units) than other currencies. Why wouldn't Bitcoin's value rise simply due to supply/demand when it is used more widely?

Because there is no guarantee that bitcoin will be in demand in the future.  Here's an example, in a recent Gawker article they put "(RIP)" when naming Bitcoin .. as if it had died. http://www.gizmodo.com.au/2011/09/is-digital-money-the-new-way-to-buy-drugs

Of course, the existing $35 million or so valuation of the currency come from those speculating that the value of the currency will at some point in the future buy more than it will today.

Whether or not this will be a stratospheric rise nobody knows but it isn't unprecedented, just not typical nor expected by most.  But there are those, such as Rick Falvinge, who believe it.  Rick describes his thoughts here:

http://falkvinge.net/2011/06/16/bitcoins-four-drivers-part-one-unlawful-trade
http://falkvinge.net/2011/06/18/bitcoins-four-drivers-part-two-international-trade
http://falkvinge.net/2011/07/03/bitcoins-four-drivers-part-3-merchant-trade
http://falkvinge.net/2011/07/05/bitcoins-four-drivers-part-4-investment


Verifying a P2SH transaction script by hand. How should I concatenate OP CODES in order to hash the script? I'm reading this:

  Transaction
  40eee3ae1760e3a8532263678cdf64569e6ad06abc133af64f735e52562bccc8 paid
  to P2SH address 3P14159f73E4gFr7JterCCQh9QjiTjiZrG. You can see the
  redeem script in transaction
  7edb32d4ffd7a385b763c7a8e56b6358bcd729e747290624e18acdbe6209fc45 which
  spends that output, using OP_FALSE  { OP_1  OP_1
  OP_CHECKMULTISIG }.

from https://en.bitcoin.it/wiki/Pay_to_script_hash

I'm trying to check the validity of the transactions by hand to see if I understand what's happening. I first found the first transaction: https://blockchain.info/tx/40eee3ae1760e3a8532263678cdf64569e6ad06abc133af64f735e52562bccc8

As I understood, it is locking these outputs to the output script

OP_HASH160 e9c3dd0c07aac76179ebc76a6c78d4d67c6c160a OP_EQUAL

The text tells me to look at the other transaction: https://blockchain.info/tx/7edb32d4ffd7a385b763c7a8e56b6358bcd729e747290624e18acdbe6209fc45

which spends this output. It means that this transaction presents a script (with data) that satisfies OP_HASH160 e9c3dd0c07aac76179ebc76a6c78d4d67c6c160a OP_EQUAL. Let's see the input of this transaction:

OP_FALSE 3045022100ad0851c69dd756b45190b5a8e97cb4ac3c2b0fa2f2aae23aed6ca97ab33bf88302200b248593abc1259512793e7dea61036c601775ebb23640a0120b0dba2c34b79001 5141042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf51ae

I should take the OP_HASH160 of this to verify it's equal to e9c3dd0c07aac76179ebc76a6c78d4d67c6c160a, right? Remember that OP_HASH160 means: ripemd160(sha256(something)). Should I concatenate that OP_FALSE int he beggining? Also, shouldn't it be a script? Where are the other op_codes beasides OP_FALSE?

You can find the execution of a similar pay to script hash (P2SH) transaction here:
Pay to Script Hash Execution

Basically the scriptSig is evaluated first, it pushes an empty array of bytes onto the stack because of the OP_FALSE code, and then pushes the signature 3045....001 onto the stack, and finally pushes the redemption script 5141...1ae on. Then we move on to the scriptPubKey evaluation, the encoded redemption script is taken off the stack and hashed, and the hash is compared to the hash e9c3...60a. if these are equal, we move on to the actual evaluation of the redemption script. This means the stack is taken back to the point before the scriptPubKey execution, so we have:

 5141...1ae
 3045....001
 (empty value)

The top element is popped off, decoded, and then evaluated. In this case, it is a OP_CHECKMULTISIG script, the decoded version is on the webpage you linked as well as in your question, but this multisig only has one public key and one signature, so it's basically equivalent to paying straight to that one address. The OP_CHECKMULTISIG will check the signature 3045...001 against the public key, and if it matches, the transaction is valid. The empty data pushed on at the start by OP_FALSE is simply there due to CHECKMULTISIG taking one more element off than it needs, due to a bug, so it's just an unused bit of data needed to make it work.

I'm not sure what you mean by it being a script. It is a script, it is just encoded in the 5141...1ae. You can decode it with the decodescript call on bitcoin RPC.


How do import a paper private key into MultiBit? Sorry to sound like a total Bitcoin noob (which I am).
I've just made a purchase at the new Robocoin Bitcoin ATM.  I have a paper receipt that has a Private Key (starting with 5 and 51 characters long).
How do I import this key into my wallet? I'm using MultiBit 0.5.14 on Ubuntu.
Thanks in advance!

Tools -> Import Private Keys

Create a file with the private key inside it. If you do not add the time of creation of this address, you get this message:

  "There were missing dates. Have to go back to genesis block."

I think this date should be the first transaction date registered in the block chain.

  Key createdAt is in UTC format as specified by ISO 8601
  e.g: 2011-12-31T16:42:00Z . The century, 'T' and 'Z' are mandatory

To be safe, turn the date back a few days.


Why is syncroning taking forever on BitcoinCore It has been synchronizing for months and i want my money now. I have tried re-downloading , clearing cache

i downloading from their website. It is the lastes.t version of Bitcoin Core.Windows 10 ,4.00GB  64 Bit

It depends of your internet speed as the QT has to download the data. I would suggest using electrum if you dont want to download everything.


keypool and restoring from backup I have a wallet running on a raspbery pi and the SD card hit the skids, fortunatley I have a backup of the .iso from 1 month ago so I have recovered the entire state as of that time.

My only concern is over the keypool.  I had increasead it to 1000 because I was testing issung a lot of transactions, my keypool was down to around 800 before my issue required the backup.  Now my keypool is at 970 (as it was a month ago) and Im trying to figure out if thats going to cause a problem when a key that is already used in an existing TX is to be used again?

Try not to reuse keys/addresses.

Just call getnewaddress 200-times (RPC call in a loop).

Maybe call keypoolrefill afterwards (and do a backup again if you don't use HD [Core >=0.14]).


When a scriptSig/scriptPubKey executes, it's supposed to leave an element that evaluates to true on the top of the stack. Both of these are Pay to Public Key Hash inputs, so that means that OP_CHECKSIG failed for at least one of your inputs. Check the signatures.


How to search (via json API) transactions to my wallet? I'm new to bitcoin and want to take payments with it on my website.
Taking payment isn't a problem but the manually process of verifying payments and matching up with users is.
Is there any way to use an API to search the transactions to my address and look for specific text in the "message" field?
Thanks
Matt

There is no "message" field in Bitcoin transactions, only the payment information is transferred on the network. While you can generate a label for a payment requests on your end, or include a label in the QR code for the benefit of the payer, neither would be transferred on the Bitcoin network. The proper way of distinguishing payments on Bitcoin is to give each payment a unique invoice address.
Instead of using plain Bitcoin Core, you may want to take a look at BTCPay Server, which is a self-hosted open-source payment processing solution that facilitates on-chain and Lightning Network payments. If you want to continue using Bitcoin Core, look into the listunspent call.
H/T to @Anonymous and @darosior, whose comments I've collected to write this answer.


Why does Bitcoin support both compressed and uncompressed keys/addresses? My question is about the difference between compressed keys and addresses, and i know it was addressed in another question but my question is less about the theory and more about how the keys are used practically in Bitcoin.
So heres what I did: I used dumpprivkey for an address 183Tw2TqXKkbk5ZeocTYwmxg8x46ADXb6c in the .7.2 client, and got L5DTi7rgqsPg7Vq1vTU2dP2HWMEsNM5w5JCqEDXXXXXXXXXXXX. When i pasted this into bitaddress.org's wallet details script it returned several things. First, it showed a different address 1FKswUuFsjWKyr4ZPSe3vEpp1iCXXChBZm, but it also showed the address above and said it was the compressed version. I sent like 0.0001 to each of the 2 addresses and my satoshi client only shows a transaction recieved from the 183 (compressed) address.
Can someone please explain in practical terms what the difference is and why they both even exist in Bitcoin? Any help is appreciated.

The reason they exist both, is because Satoshi didn't know about compressed public keys, and it was only recently discovered that they would be possible to use without compatibility problems (support only exists as of version 0.6 of the reference client).

The advantage is clear: their public keys are smaller, resulting in smaller transactions on the network, saving block chain size for everyone.

Update: inside SegWit spends, only compressed keys can be used.


Why can't I participate on bitcointalk.org? I just created an account and spend a frustrating hour reading help menus and trying to figure out how to post or reply to posts.

None of the buttons -- New Topic, Reply, Quote -- seem to be showing up.  Is there a verification step that I skipped?

I'm logged it.  I get the "hello [user]" message on top.

You should first make some posts on the Newbies forum. This post explains the restrictions.

  Newbie Restrictions You can only post in the Newbie and Local
  sub-forums till you have 5 posts and at least 4 hours on the forum.
  The other two restrictions are you need 1 post to be able to send a PM
  and 10 posts to put a link in your sig.


Retrieve private key for watch only address When sending bitcoin for an ico the mycelium wallet automatically generated a watch only address and sent the btc from there. I need the private key for this watch only address to access my tokens. Is that possible? Thanks, Piers

the mycelium wallet automatically generated a watch only address and sent the btc from there

A watch-only address is one for which you do not have the private-key. It isn't possible to send bitcoin from a watch-only address.

I need the private key for this watch only address to access my tokens. Is that possible?

See Mycelium

'Watch only' accounts
An address stored in the wallet without the corresponding private key, allowing the wallet to watch for outputs but not spend them.

If the address is watch-only, your wallet doesn't have the private key.
How to manage my account says

To activate an archived account, press it to select it, and press «Activate» at the top.
To delete an account, press it to select it, open the pop-up menu, and press Delete. Note, you cannot delete your HD accounts, only single address accounts. When deleting an account, you are given the option to delete the account completely, or only delete its private key. Deleting only the private key will convert the account into a watch-only address, allowing you to monitor the balance and receive payments to the account, but not to spend from it.

(my emphasis)


How to sign non-standard transaction Consider Testnet transaction 7a438...de03e which has vout[0].scriptPubKey =

OP_DUP OP_DROP OP_DUP OP_HASH160 039.....6fe OP_EQUALVERIFY OP_CHECKSIG

The script is equivalent to a standard pay-to-pubkeyhash scriptPubKey. Let's try to spend it:

> bitcoind createrawtransaction '[{"txid":"7a438.....de03e","vout":0}]' '{"mfq.....oDY":1.3}'
01000000013ee0bdf5779c48f42bda36cd740ba297ae071ec7fe3eadae6418602de48d437a0000000000ffffffff0180a4bf07000000001976a914039541a738df12eed1825b866eb5bb5aba6bf6fe88ac00000000

> bitcoind signrawtransaction 01000.....00000
{
  "hex" : "01000000013ee0bdf5779c48f42bda36cd740ba297ae071ec7fe3eadae6418602de48d437a0000000000ffffffff0180a4bf07000000001976a914039541a738df12eed1825b866eb5bb5aba6bf6fe88ac00000000",
  "complete" : false
}

As you can see, bitcoind refuses to sign the transaction (same hex and obviously complete is false) I guess because it can't find a suitable address (since it's a non-standard script). I do indeed control the address and have its private key.

Is there any way to sign this transaction?

You will have to build the transaction yourself instead of relying on wallet software. You can either create it all from scratch and use pushtx or use an online API that accepts explicit input references to previous outputs. For example (check the last paragraph):

http://dev.blockcypher.com/#transaction_skeleton


Each full node has different mempool? I don't understand if each full node has different mempool inside.

With RPC command getblocktemplate I can Get the information about candidate block.
I can Find all transaction verified but unconfirmed
And I can find even bits and target, the value for mining.

My mempool is different from another node?
I have to Update my mempool before build candidate block ?

The mempool of all nodes is different, but this isn't an issue. There will always be some inconsistency due to latency, network conditions, and differing configurations. This doesn't measurably impact your income and won't effect the validity of blocks you produce.


Bitcoin transaction graph I am trying to make bitcoin transaction graph, but I am not sure how to go about it. I have extracted the necessary data from blockchain like the sender, receiver, amount of bitcoins sent, transaction hash and the date and time when it first got included in the block. The format for which is shown below:-

TXID                                                                       Input Address                  Value               Output Address                    Time & Dates

363ec29e4fc43f97576423d0d522f5f0fc79c5c018c3a210c5644ab79a38041d                                        25.0301   [u'1CjPR7Z5ZSyWk6WtXvSFgkptmpoi4UM9BC']    2014-01-12 01:36:19

f264c5c36b624110201a27bd02883508d29dfe1f94975aa8cc652fb8bc1496a9 1AyHWFST4jhcdVs74Hd3pvCdafpktmiF8Y       299.0   [u'13vZBq8ayCzficfP3uwm52bctv5mSXKfM1']    2014-01-12 01:36:19
                                                             154yacyVMuVoahSd1dmsz6PDS8MZzX3FzB
                                                             1KzXSypcJUdStaHfLtucBiaqEWDZ5PhBix
                                                             14FJfPxbXpBrTPnPcCS1gwWpTz7XVmSJeQ
                                                             15CdDBvSfr5JsnbqoSgnEdSFvtKwf1GoNj

I am not sure what should be my first step towards constructing transaction graph. I am trying to use hadoopcryptoledger library available in Apache spark for doing so, but not sure how to use the result that I have extracted from blockchain for that. Do I first need to create a database to store my result?
The file that contains the above information is in .txt format. Any help would be appreciated.

Can you provide an example or design document to illustrate where are you stuck?

Spark offers SparkX to create a Bitcoin transaction graph. There is an example on the hadoopcryptoledger web site:
https://github.com/ZuInnoTe/hadoopcryptoledger/wiki/Using-Spark-Scala-Graphx-to-analyze-the-Bitcoin-transaction-graph

best regards


How do I use Multisig transactions to handle escrow needs? I want to do a private escrow between me and someone else for a Bitcoin miner, and it will take weeks or months for that miner to arrive.

I think multisig is an easy trust-free way to accommodate this.  What is the correct sequence of actions that I can use to handle this?
Is there a way to also have arbitration in case either party refuses to release the funds?

There are two basic templates for using multisig for "escrow", 2-of-2 and 2-of-3. In both cases, you can currently use bitcoin-qt's raw transaction API to create the addresses and transactions.

In 2-of-2 you do the following:

Create a multisig address which requires signatures from both the buyer and seller.
The buyer sends funds to this address.
Seller ships the product.
When the product arrives, the buyer and the seller sign a transaction sending the funds from the multisig address to the seller.
If the order is cancelled amicably, the buyer and seller sign a transaction sending the funds from the multisig address to the buyer.

This doesn't require any 3rd party, but it does have several failure modes, e.g. extortion, negligence and so on.

In 2-of-3 you do the following:

Find a relatively trustworthy escrow/mediator.
Create a multisig address requiring 2 signatures out of the buyer, seller and mediator.
Buyer sends funds to this address.
Seller ships the product.
When the product arrives, buyer and seller sign a tx sending funds to seller.
If the product doesn't arrive, mediator verifies this fact, and buyer and mediator sign a tx sending funds to buyer.
If the product arrives but buyer refuses to pay, mediator verifies this fact, and seller and mediator sign a tx sending funds to seller.

This requires a 3rd party, but the trust requirement is limited. As long as buyer and seller cooperate the mediator doesn't do anything. A problem requires 2 out of 3 parties to defect, unlike traditional escrow where the escrow can ruin it himself.


What could be causing hourly bitcoin price spikes? The price spikes every hour, on the 26 minute mark:

https://bitcoinaverage.com/charts.htm#USD-averages-1d

(Although it seems like spikes do not show up for some people/browswers.  Her is what I see: imgur.com/aKYaDvX )

Someone could have programmed a bot to place buy-orders every hour based on a some historical price average, say over the last 24 hours.


How can I find a hash with leading zeros I came across a similar question that was asked but the answer didn't seem quite complete.  Coding is completely foreign to me and I have spent some time trying to solve with no success.  I am trying to increase the difficulty by getting 8 leading 0s and the corresponding nonce for the initial hash (no previous blocks) in python.  Any direction here is appreciated

import hashlib

m = hashlib.sha256()
m.update(b'Your Name')
m.digest()
m.hexdigest()

'9cd26bee4d76694cb03cfee8c2355a83339157f2e9234fd1352c12597da72474'

You're missing multiple parts here. If that's your complete code, you don't seem to be adding a nonce to your preimage at all. You will need to generate a nonce, add it to the preimage, and test the corresponding digest against your acceptance criteria. To that end, you probably want to use a while loop that continues rolling random nonces and testing digests until one has the correct prefix. In the success case, it should output the relevant nonce.

You will also need to make sure that you use the same method of combining the nonce and your name as the exercise's test framework.


What is a public NXT api i can access? Is there a public site where you can access the nxt api? like how blockchain.info does it. all i want to do is make queries to retrieve all the messages in the nxt network to see the activity.

Start your own node and access the page http://localhost:7876/test for a list of public APIs. You can also find some public peers which enable API access. Take a look at peerexplorer.com for an up to date list.


Downloaded and installed bitcoind--bandwidth usage gone through the roof I downloaded the Bitcoin Core daemon on a Ubuntu 16.04 platform from the bitcoin PPA.

sudo apt-get install software-properties-common
sudo apt-add-repository ppa:bitcoin/bitcoin
Press ENTER to continue

sudo apt-get update
sudo apt-get install bitcoind

Set up the Bitcoin daemon to auto-run.

nano /etc/systemd/system/multi-user.target.wants/bitcoind.service

Entered these instructions to the file:

[Unit]
Description=Bitcoin Server
After=network.target
After=syslog.target
[Install]
WantedBy=multi-user.target
Alias=bitcoind.service
[Service]
User=bitcoin
Group=bitcoin
Start=main service   (was a missing = in the original script)
ExecStart=/usr/bin/bitcoind
ExecStop=/usr/bin/bitcoin-cli stop
Restart=always
PrivateTmp=false

Looks as if the program has been installedd since I get this output from the following command line:

snerx@snerx:~$ systemctl status bitcoind
● bitcoind.service - Bitcoin Server
   Loaded: loaded (/etc/systemd/system/multi-user.target.wants/bitcoind.service; bad; vendor preset: enabled)
   Active: active (running) since Wed 2018-04-18 12:06:30 AEST; 17min ago
 Main PID: 4283 (bitcoind)
   CGroup: /system.slice/bitcoind.service
           └─4283 /usr/bin/bitcoind

Apr 18 12:06:30 snerx systemd[1]: Started Bitcoin Server.

That's all well and good. For the time being I'm not interested in downloading a full bitcoin blockchain but it appears that it must be doing so since after the install a full month's worth of bandwidth (200 GB) got eaten up in a 24 h period. And it looks as if something similar is going on still when I fire up my Ubuntu machine. Bandwidth usage has gone from KiB/s to MB/s and is going to drain the household internet budget very rapidly.

What is this Frankenstein monster I have installed?

I have since got an unlimited download internet account and have got a blockchain node up and running. I used the following command to install Bitcoin Core v0.16.0:

$ curl https://bitnodes.earn.com/install-full-node.sh | sh

Downloading the full node using the Bitcoin Core GUI was quite an epic, taking 9 days in total to catch up with 9 years and 18 weeks of blockchains (180GB)--much downtime from internet connection shutting down overnight. At a mere 13.6GB, downloading the full testnet blockchain with the bitcoind -testnet -daemon command was a much less time consuming proposition.

Bitcoin Core is full node software. This means that it will download, validate, and keep up with every transaction made in Bitcoin's history and future. Its goal is independence: if you run a node, you know that everything you see adds up (no theft, no money created out of nothing, ...), without relying on anyway else's judgement. However, it comes at the cost of high resources.

This is one of the ways of interacting with bitcoin-the-currency, but certainly not the only one. A good resource for finding wallet software is here: https://bitcoin.org/en/choose-your-wallet


Sending Bitcoin to Bitcoin Cash address. Restore without private key I need help.

I use blocktrail.com for accept payment in my site by bitcoin cash.

Steps: 1. Generate bitcoin cash address 2. Sending bitcoin cash to generated address

One of customer sent bitcoin (BTC) to bitcoin cash address, and the address is available. Look at https://www.blocktrail.com/BTC/address/35HSWxagkcWxsEgDh3EWE6A1n3THyM1mqC/transactions

Question. How can I get these bitcoins?

I haven't got private key from bitcoin cash wallet, but I have got restore-file "Bitcoin Wallet Recovery Data Sheet". I guess that file can be use to restore only bitcoin cash wallet.

Any ideas?

Thanks

Try tell him to import the bitcoIN cash wallet private key into a regular bitcoIN wallet. If the person does not have the private key nor it not working then the fund will permanently loose

If your using the provider then contact them and they should able to recover it for you


Error in checkout while using Bitcoin Payments by BitcoinWay with WooCommerce, "CurveCurveFp Object" I have bit coin installed on a clients wordpress site. Upon checkout, when I check Bitcoin as my payment, and click Place Order, the order does not go through and I get the following error at the top of the checkout page:

CurveCurveFp Object
(
    [a:protected] => 0
    [b:protected] => 7
    [prime:protected] => 115792089237316195423570985008687907853269984665640564039457584007908834671663
)
 does not contain point ( 20139727203196486522876591193063649819462947761513549103823800141681658369 , 369049320460203173903206256216019890340108033867982827520 )

Here is the URL: https://www.goldextradellc.com/checkout/

Any help / suggestions you can give me would be great. Thanks

FYI: this site seems to be using the Bitcoin Payments for WooCommerce plugin. If I'm wrong, then please disregard this answer.

This plugin is not compatible with the current version of Electrum. Give this a try (these instructions are for Windows):

Start -> Run (or press the Windows key + r), then type in %appdata%\Electrum\wallets and press OK.
Take a backup of all of your wallet files in this folder. If you have any funds in your wallet(s) and skip this step, you may lose those funds, so be careful!
Close this folder, and open a new one: Start -> Run (or press the Windows key + r), then type in %appdata% and press OK.
Delete the Electrum folder.
Uninstall Electrum.
Download and install electrum-1.9.8-setup.exe from https://download.electrum.org/.
Follow the normal install instructions for the plugin.

After you've tested it and have gotten it working, it is safe (and recommended) to upgrade Electrum to the newest version. You only need the old version when you first create your wallet. After upgrading, you can open your wallet backups you made in step 3 to access any old funds (but you can't use these wallets with the plugin).


Full example data for scrypt Stratum-client I'm trying to write a Mining client for Scrypt-based mining using Stratum Communication.
As of now, I have some trouble verifying all my bit orders and sequences. Hashes I'm generating get always rejected due to not meeting the Target.

What I'm looking for is a full sequence of data, starting from the information I get from the stratum server (coinbases, merkles,...) to a final hash.

I could already verify parts of the algorithm (mainly from input to a valid merkle-root, using the information of http://mining.bitcoin.cz/stratum-mining/ , and a scrypt hashing, using the block header from https://litecoin.info/Scrypt ), but I guess there is some endian problem in between, or something completely different, I don't know... With a full workflow I could verify where the error happens.

Does anyone know where to get such data, or how to generate them for myself?

Alright, I finally managed to fix my bugs and get a full roundtrip. Here is an example for a full communication with a Pool.
I don't explain everything in detail as the API description can be found elsewhere.
a) Suscription
{"id": 1, "method": "mining.subscribe", "params": []}
{"error": null, "id": 1, "result": [["mining.notify", "ae6812eb4cd7735a302a8a9dd95cf71f"], "f8002c90", 4]}

We suscribe with the server. This has no parameters.
As result, we receive some Suscription ID, and our Extranonce1 + extranonce2 size, which we need for later.
b) authorization
{"params": ["User", "password"], "id": 2, "method": "mining.authorize"}
{"error": null, "id": 2, "result": true}

Authorize worker with Username + password. No parameters to store from the result.
c) Server -> difficulty
{"params": [32], "id": null, "method": "mining.set_difficulty"}

Sets the difficulty to 32, defining our target. The resulting difficulty can be calculated as
0x0000FFFF00000000000000000000000000000000000000000000000000000000 / 32 =
0x000007fff8000000000000000000000000000000000000000000000000000000

Now, the fun part:
d) Block info
{"params": ["b3ba", "7dcf1304b04e79024066cd9481aa464e2fe17966e19edf6f33970e1fe0b60277", "01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff270362f401062f503253482f049b8f175308", "0d2f7374726174756d506f6f6c2f000000000100868591052100001976a91431482118f1d7504daf1c001cbfaf91ad580d176d88ac00000000", ["57351e8569cb9d036187a79fd1844fd930c1309efcd16c46af9bb9713b6ee734", "936ab9c33420f187acae660fcdb07ffdffa081273674f0f41e6ecc1347451d23"], "00000002", "1b44dfdb", "53178f9b", true], "id": null, "method": "mining.notify"}

I split the parameters and assign them to variables
job_id = "b3ba"
prevhash = "7dcf1304b04e79024066cd9481aa464e2fe17966e19edf6f33970e1fe0b60277"
coinb1 = "01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff270362f401062f503253482f049b8f175308"
coinb2 = "0d2f7374726174756d506f6f6c2f000000000100868591052100001976a91431482118f1d7504daf1c001cbfaf91ad580d176d88ac00000000"
Merklebranches = [
    "57351e8569cb9d036187a79fd1844fd930c1309efcd16c46af9bb9713b6ee734",
    "936ab9c33420f187acae660fcdb07ffdffa081273674f0f41e6ecc1347451d23"
    ]
version = "00000002"
nbits = "1b44dfdb"
ntime = "53178f9b"
clean_jobs = true// Not required for block, just for completeness

What we also need is extranonce1 and extranonce 2:
extranonce1 = "f8002c90" // from earlier
extranonce2 = "00000002" // can be anything, but 4 bytes

With this, we can start building our Merkle root:
First, the coinbase:
coinbase = coinb1  + extranonce1 + extranonce2 + coinb2;
coinbase = "01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff270362f401062f503253482f049b8f175308f8002c90000000020d2f7374726174756d506f6f6c2f000000000100868591052100001976a91431482118f1d7504daf1c001cbfaf91ad580d176d88ac00000000"

Now, we convert this coinbase into binary. No flips or BE-LE conversions required, straight from left to right.
The resulting binary data is hashed with sha256(sha256(data)).
From here on, I will post binary as hex representation, but as is: Left to right, no endianess conversion
resulting hash : 280b3927f6763b1ed90cae2a3cef4d27c743f6a7d91e3901dc3816a46acacf36

This is the start for the merkle concatination. Concatinating means just joining them. 32 byte for the hash and 32 byte for each merkleroot result in 64 byte of data to hash.
for each Merkle_branch
    byte[64] = hash + merkle_branch
    hash = sha256(sha256(byte))
end

For the example it looks like this:
byte = 280b3927f6763b1ed90cae2a3cef4d27c743f6a7d91e3901dc3816a46acacf36 + 57351e8569cb9d036187a79fd1844fd930c1309efcd16c46af9bb9713b6ee734
hash = e6df228610b9f0e96a42a4877565627a3e1e133e984b6c46ff6e44b7dc9dc056

byte = e6df228610b9f0e96a42a4877565627a3e1e133e984b6c46ff6e44b7dc9dc056 + 936ab9c33420f187acae660fcdb07ffdffa081273674f0f41e6ecc1347451d23
hash = 0b1edc1ccf82d3214423fc68234f4946119e39df2cc2137e31ebc186191d5422

which is the final merkle_root. There is no need of converting it back to hex, it can be kept in binary format for the next step
e) Block header
The block header is build with all previous information + the calculated merkle root. It results in 80 byte of Data
blockHeader {
    version[4]
    prevhash[32]
    merkle_root[32]
    ntime[4]
    nbit[4]
    nonce[4]
}

Here, byte order gets a bit tricky: All 4 byte types are Little endian, and bytes have to be flipped. Merkleroot can be copied 1:1, without flipping bytes.
prevhash is what surprised me the most. It can be best viewed as an array of 8 4byte ints, where each of these ints has to be converted to LE, but the order is kept left to right.
I show it in the example:
version:  00000002 --> 02000000
prevhash: 7dcf1304 b04e7902 4066cd94 81aa464e 2fe17966 e19edf6f 33970e1f e0b60277
        -->   0413cf7d 02794eb0 94cd6640 4e46aa81 6679e12f 6fdf9ee1 1f0e9733 7702b6e0 // 8 ints left to right, each one flipped
merkle:   0b1edc1c cf82d321 4423fc68 234f4946 119e39df 2cc2137e 31ebc186 191d5422 // nothing changed
ntime:    53178f9b --> 9b8f1753
nbits:    1b44dfdb --> dbdf441b

Results in the following bytestream:
020000000413cf7d02794eb094cd66404e46aa816679e12f6fdf9ee11f0e97337702b6e00b1edc1ccf82d3214423fc68234f4946119e39df2cc2137e31ebc186191d54229b8f1753dbdf441b00000000

Note that we don't need the padding or anything, like the bitcoin implementations have, the 80 bytes are all we need.
Now, lets hash it
f) hashing and result
sending this through a scrypt cycle results in the following hash:
f6f13e350aa4f251e192ab8a78690ee99f1cc2d930d4ae16c4172a0a8aefddd0

Well, this is not the hash we are looking for... So we start playing with nonce first, and if thats not enough we can increase the ntime. Until finally, after a long time, we try
nonce = "00007f8a" // BigEndian
time = "53178f9f" // BigEndian

This gives us the following Block and resulting hash:
block = 020000000413cf7d02794eb094cd66404e46aa816679e12f6fdf9ee11f0e97337702b6e00b1edc1ccf82d3214423fc68234f4946119e39df2cc2137e31ebc186191d54229f8f1753dbdf441b8a7f0000
hash = 7441207b6390054623bc5e659ffe2581356dafc5ec41db44d27de85035000000

Looks kind of high, but here again, endianess has to be considered. To compare it with our Target, we have to compare high to low. And, not to forget that we have to change the byte order of our target:
target = 0x000007fff8000000000000000000000000000000000000000000000000000000
   --->  0x000000000000000000000000000000000000000000000000000000f8ff070000

Now if we compare them:
000000000000000000000000000000000000000000000000000000f8ff070000
7441207b6390054623bc5e659ffe2581356dafc5ec41db44d27de85035000000

We see that the hash is below our target, and we can submit it. Alternatively we can look at them in the other byte order (in which it is printed most of the time)
000007fff8000000000000000000000000000000000000000000000000000000
0000003550e87dd244db41ecc5af6d358125fe9f655ebc23460590637b204174

Which looks the same, mostly. This leads us to our final step:
g) Submit Share
Now we collect the variable parameters we used, and send them to the server.
user = "user"
job_id = "b3ba"
extranonce2 = "00000002" // No byte swapping needed. Its how we put it in the coinbase
ntime = "53178f9f" // This is Big Endian. The ntime in the block_header is little endian. IF you read it from your block_header, don't forget to swap
nonce = "00007f8a" // Same here. Convert To BigEndian before sending

We pack these Data in a neat JSon wrapper, and send it off to the server:
{"params": ["User", "b3ba", "00000002", "53178f9f", "00007f8a"], "id": 4, "method": "mining.submit"}

And, if all works well, and we have no other problems (like stale shares or anything), we get a positive response:
{"error": null, "id": 4, "result": true}

And thats it! For more shares repeat as often as wanted.


How to find out the ECDSA private key perfix version for Altcoins? I want to create a paperwallet for an altcoin (Protoshares).

I know the public key version byte is 0x38 (56) and the addresses start with P...

But how do I find out the ECDSA private key prefix? For bitcoin it's 0x80, for litecoin it's 0xb0.

The Protoshares private keys start with 7... if that helps. Any idea where to look at?

Take the private key. It's probably expressed in base-58 encoding, so you just have to translate the number into base-16. The prefix is there in hexadecimal form.

To convert a base58 number to hex, check etotheipi's code. Based on it:

b58_digits = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'

def base58_to_hex(b58str):
  n = 0
  for s in b58str:
    n *= 58
    digit = b58_digits.index(s)
    n += digit
  return hex(n)


Find my Bitcoin Account I signed up for Bitcoin many years ago and I have no clue on how to find my account. I googled "how to find my bitcoin account" and I got this platform. Any help is appreciated.

There's no such thing as a Bitcoin account.
If you mean an account on a Bitcoin exchange, then I'd check your emails and maybe old bank statements from that time to see if you can find which exchange it is, then try and recover your account.
If you mean a Bitcoin wallet, and you have completely lost the wallet file and have no backup of its keys, then it is probably gone for good. You can try looking through your old computer backups if you have any; if you used the Bitcoin Core client you're looking for a file called wallet.dat.


what does segwit remove? It's said that Segwit removes signature data from transactions which makes block have more space for more transactions.
Question 1)
If SegWit removes signature data, where does it put it exactly ? what does it mean that it puts at the end of the transaction ? and how does it make a block to contain more transactiosn?
I understand that segwit solves transaction malleability by adding segwitTxid , but I am mostly curious how segwit increased block size..
Question 2) I know that block size is measured in weight units.  and we can read the following:

Each byte of a transaction that is not witness data (so everything
that a non-segwit node would see) is worth 4 weight units. Every byte
of witness data is worth 1 weight unit. Blocks are limited to 4000000
weight units, which, if full of non-segwit transactions, is 1 MB. –

By reading this, it still doesn't make sense how block size limit has been increased. if we count the size in MB, segwit implementation might need more MB than non segwit implementation(older bitcoin).
I'd appreciate a nice explanation..

If SegWit removes signature data, where does it put it exactly ? what does it mean that it puts at the end of the transaction ? and how does it make a block to contain more transactiosn?

It doesn't remove anything. It moves witness data to a separate area, the segregated witness, which (a) does not contribute to the txid and (b) is counted differently.
But, the witness data is still an integral part of the transaction. It's not covered by the txid, but it is covered by a new separate identifier, the wtxid. These wtxids are committed to by segwit blocks. So you still can't change/remove/... the witness data without it invalidating the block that contains them.

By reading this, it still doesn't make sense how block size limit has been increased. if we count the size in MB, segwit implementation might need more MB than non segwit implementation(older bitcoin).

Yes, absolutely. From the perspective of newer nodes, it is a block size increase. It's not a blunt multiply-by-4, but segwit blocks do permit more transactions, and their total size in bytes can be (and is) larger than 1 MB.
The important part is that this extra space is all in witness data, which old nodes don't see. Thus, their 1 MB limit requirement is still satisfied.


Can Bitcoin scripting be used for double spending attacks? A standard Bitcoin transaction deposits coins into an address and then, using Bitcoin's scripting language, states that whoever wants to spend this output must be in possess of the private key corresponding to that address.

However, it's possible to deviate from this base template to create more complex transactions, where other conditions must be met in order to spend the transaction output.

Is it possible to create a transaction where a sum is deposited into an address, but only the owner of another private key is allowed to spend it? I'm not a Bitcoin scripting expert, but this looks at least possible.

In this case, can such a crafted transaction be used to mount a double-spending attack, where address A sends sum X to address B, but after the transaction is completed address A retains ownership of the sum and can send it elsewhere, while address B can actually do nothing about it even if the sum is credited to its balance?

How would a standard wallet treat such a transaction? Would it even recognize there's something strange going on, or would it blindly display that X BTC entered address B, regardless of the transaction script?

Edit:

Sorry, I was misled by how sites such as blockchain.info display transactions: a transaction doesn't actually contain any "output address", it only contains outputs which state the conditions necessary to spend them; the "output address" is computed by checking which address's signature is requested by the output script; thus it's impossible to "send money to address B" without actually placing address B in the output script.

However, the question somewhat remains: could a transaction be crafted to fool a wallet into telling its user "I received X BTC" while someone else can actually claim the sum using another private key?

What you're describing is a contradiction of terms. If a sum of money is deposited into an address, that means that only that address's private key can spend the money.

Maybe you could craft a non-standard transaction and tell people it's giving address B's owner permission to spend it, but if people look closely enough at the transaction, they'll be able to tell that it's really address C (and not B)'s owner that can spend it. There's no way around this: the transaction output is public, as is the implementation of how it works.

So if the question is: can you fool software X with a non-standard transaction? Perhaps, it would depend on finding a bug (or other less-than-ideal situation) in the software in question. (for example, if you craft a transaction that can be spent by address B or C, maybe the wallet owning B will say it has the balance, and if he doesn't transfer it again before you do, then you can "steal back" the money that way) However, I'd treat any non-standard transactions as highly suspect.


What is a worker exactly from Antminer Pool Worker field So I see on the What is a worker? post that a worker is "simply an identifier for you to use so that you can track different machines within your account".

For someone that just started maintaining bitcoin systems for others and only configures the Antiminers I wanted to get some clarification that may help me understand better.

Note: I have not ever registered for a wallet account (e.g. Antminer, etc.) and only maintain a farm for someone else and was given the detail to plug in per each miner.

Question

Correlated sub questions for context to help understand what I'm trying to get my head around here

Is a Worker any random name you make up right then in the Antminer General Settings > Pool # > Worker field, or do you set these up with your associated Antminer account and then once on the pool start dropping in the names you registered on your account?

I assume once you use one specific Worker name that you will get an error if you try to use that same name on that same pool from another miner device?
The pool is a URL with a port number and the Worker seems to be a private name you use on your account connected to this public URL pool but the Workers in this context are like the private bitcoin miner nodes—if someone else on that same URL pool from another account uses the same Worker name as another account's Worker name, then that does not make any difference—only no duplicates on same account only, right?

What is a worker exactly from Antminer Pool Worker field?

  a worker is "simply an identifier for you to use so that you can track different machines within your account".

Is a Worker any random name you make up right then in the Antminer General Settings > Pool # > Worker field, or do you set these up with your associated Antminer account and then once on the pool start dropping in the names you registered on your account?

You set these up with your pool and then use them in your mining hardware to keep track of individual machines.

I assume once you use one specific Worker name that you will get an error if you try to use that same name on that same pool from another miner device?

No, you can generally use a worker name over and over on different machines, all the work is added together to show the worker work.

The pool is a URL with a port number and the Worker seems to be a private name you use on your account connected to this public URL pool but the Workers in this context are like the private bitcoin miner nodes—if someone else on that same URL pool from another account uses the same Worker name as another account's Worker name, then that does not make any difference—only no duplicates on same account only, right?

I thought that you had to enter your username and worker password in addition to the information shown in your screenshot. In many pools you enter the username as {username}_{workername} or similar. The worker password hardly needs to be secret - if someone steals it they can generally just mine on your account giving you greater share.

To answer, it depends on the pool but generally worker names are isolated to sepcific individual accounts, so it doesn't matter if a different user on the pool has the same worker name. If you can create the worker name on your pool account it should be safe.


Input script public key len Why in some transactions the public key after R and S is longer 33 bytes and in others is 65 bytes? There's a difference during the signature check?

Thanks

ah, indeed that was not clear to me. The input sigscript is composed of two parts, the signature itself, and the following "condition", that need to be met for spending the tx. Usually this is a public key, but can also be multisig elements or smart contracts.

In the case where a public key follows, there are two representations of public keys: compressed keys and uncompressed keys. How they are generated is explained in a thread here: How are compressed PubKeys generated?.
So you can have this representation:

pubkey hex uncompressed (04 + x + y):

04 50863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B2352 2CD470243453A299FA9E77237716103ABC11A1DF38855ED6F2EE187E9C582BA6

or this:
pubkey hex compressed (02 + x, y=even):

02 50863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B2352

In the case where y=odd, then a 03 is at the beginning.
Looking at the length, you have 65 for uncompressed, and 33 bytes for compressed keys.


Is it possible to recreate a multisig wallet with just 2 out of 3 private keys? Example:

Created a 2 of 3 multisig wallet in Electrum
Send funds to the multisig wallet
Lost the Electrum wallet
Access to two of the private keys (e.g. 2 trezors)

Is it possible to recreate the wallet and move the funds through access to 2 of the private keys?  If so, how?

It is possible to move funds with only two private keys, however, you must still know the missing private key's public key.

The public keys are required to produce the redeem script, which is require to complete a transaction.

If you already know the redeem script (for example, it may be recorded in an old wallet file, or available on the blockchain if the same multisig address has been used to send out coins in the past), then you can spend any remaining coins with just two keys (in a 2 0f 3 multisig).


Is it possible to send one satoshi to every bitcoin address? As a random whim, I want to see if it's possible to send one satoshi to every bitcoin address that's ever been used. How much would that be? I'm betting the transaction fee would be a lot more, though. Is this even possible? How would I do it?

Yes. There are currently about 10 million unique addresses in the block chain, so 0.1 BTC would be enough to send a satoshi to each address. The transaction data would be about 340 MB. The network's anti-spam protections would make this project either very expensive (due to transaction fees) or very time-consuming.


Do vanity addresses lower the security of my key? (reduced complexity) Do vanity addresses somehow decrease the security of my private key?

No they do not.

A vanity adress is only trying to pattern match a specific part of an address. The complexity remains the same.

To generate the vanity address it usually takes millions of attempts per second to find a public key which matches your pattern. This is done by cycling through private keys and and checking the corresponding public key.

If an attacked was to do the same thing then they would still need to cycle through every combination of your pattern aswell, which is just as extensive.


Can a double spend attack be obfuscated by mimicking the transactions seen before the fork? An attacker controls the majority of the hashing power and wants to double spend without arousing suspicion. If they mirror the public chain's activity while generating the private fork and the fork is short (say 10 blocks), can you only detect the double spend by verifying the block hashes haven't changed or noticing the double spend transaction directly?

The short answer is that there is no way to double spend "without arousing suspicion". Presumably, you would be double-spending against someone and that person would notice as soon as you diverted the main chain.

longer answer:
As long as you're building your private chain you can double spend everything you have by normally broadcasting to the public chain, knowing that it will be reversed later. There is no way to detect/defend against a 51% attack until it happens, and once it happens the security of the blockchain of Xcoin is obviously compromised and the whole coin/your stash of coins is now worthless, so there was not much point in the double spend anyway.


What happens between submitting a transaction to the network and it being confirmed? I am very new to bitcoin, appreciate any help that I can get for below queries.
1) Is there any way (site or app) to know, to which node my current (latest) transaction is headed to? Does it go to one node or many before included into block? Probably it is going to the pool, where it will be picked to included in the block. So do we know which pool it landed in?

2) How to know, how many miner are currently working with my latest transaction, which is yet to be included into the block? Here is my understanding, more than one miner can include one transaction and all may not have same transactions. So how to know who all are working on this

Kind Regards

Some miner will mine the next block. No one knows which one it will be. For transactions to be included in a block within a reasonable period of time, pretty much all miners have to know about pretty much all transactions.

You don't know who is currently mining and maybe you're on a bad internet connection so you don't want to send your transaction to every single miner in the world, just in case that is the one who will build the next block. You merely have to send your transaction to a single node in the Bitcoin network. If it's valid and contains a reasonable fee, it'll be automatically propagated through the network and find its way to all miners.

So to answer your first quesiton: It didn't just go to a single miner. You can be pretty sure all miners know about it.

Miners don't tell others which transactions they are trying to get into the next block. This changes with really, really often, for every big miner. They by the way are working on many blocks at the same time, hoping to succeed with one.

Once a transaction has been included in a block, you can find out who made that block. Let's say your transaction ID is ccb5133b45fbca133936ab059377d4a5e4078a48b98349c8beb99c2cee529716. Head over to https://blockchain.info and enter it. You'll be shown that it's included in block 446059 ("Included In Blocks"). Click on that number and you'll be shown that block. There is a field called "Relayed By" whose value in this case is "BitFury". So you know the block was probably made by BitFury.


How to claim BCC/BCH having BTC in MultibitHD without having a seed, but having a password? I wanted to add a comment here, but I do not have enough reputation, so please forgive me.

So I am using MultibitHD wallet. I have access to my bitcoins after I type my password. I can send then to new address, so I think this mean, that I have there my private keys.

However I discover that I do not have saved those 12 words from seed in place where I thought I saved them.

Question is, how can I extract keys and claim BitcoinCash?

Disclaimer: I have there 0.25 BTC. I will give 0.025 BCH to someone who help me discover the solution :)

I would like to dump my BCH, to support BTC, but first I need to know how to claim them. Please help me support BTC!

Unfortunately there is no easy way to do that. MultiBit does not allow you to export private keys and they use their own implementation of AES to encrypt the wallet files so no third party tool (like bitcoinj' wallet tool) can be used to extract the private keys. All you can do is modify the MultiBit source code and run it yourself in order to dump the private keys to a file.


How to claim Bitcoin Cash & Bitcoin Gold from paper wallet Before the first Bitcoin fork (August 1st) I put all my Bitcoin into a paper wallet. I kind of forgot about it. Now I think I can claim Bitcoin cash as well. Now there has been another fork resulting in Bitcoin gold. How to I take my Bitcoin from the paper wallet and turn it into Bitcoin, bitcoin cash and Bitcoin gold?

Any step by step guides out there that anyone would know of?

Go to Blockchain.info

Sign up and after logging in, go to settings. Then in settings, you will see addresses as shown below:

Then click on Import Bitcoin Address as shown:

Then add your private key as it is in the form as shown:

Click import, and you will be able to use your BTC again.

Now to get Bitcoin Cash, just go to Settings > General

There you will see a button near this to claim your Bitcoin Cash as well:

Regarding Bitcoin Gold, it is still not officially started, and will update the answer once there is any secure way to access your Bitcoin Gold as well.

Please follow that and let me know if you were able to retrieve the coins.

Update:

For those who want to retrieve BTG, please head to Coinsutra for easy retrieval.


gcminer with ATIRADEON HD3600 on ubuntu 12.04 64bit headless won't detect GPU I am following this guide: http://rdmsnippets.com/2013/03/20/bitcoin-mining-with-ubuntu-12-04-tls-and-cgminer/

But it won't work on my server (Specification's are in the Subject-field)

I get this error:

koen@gorgabal-Server:~/bitcoinmining$ ./cgminer/cgminer -n
 [2013-06-23 15:03:51] CL Platform 0 vendor: Advanced Micro Devices, Inc.
 [2013-06-23 15:03:51] CL Platform 0 name: AMD Accelerated Parallel Processing
 [2013-06-23 15:03:51] CL Platform 0 version: OpenCL 1.2 AMD-APP (1113.2)
 [2013-06-23 15:03:51] Error -1: Getting Device IDs (num)
 [2013-06-23 15:03:51] clDevicesNum returned error, no GPUs usable
 [2013-06-23 15:03:51] 0 GPU devices max detected
koen@gorgabal-Server:~/bitcoinmining$ sudo aticonfig --lsa
* 0. 01:00.0 ATI Radeon HD 3600 Series

* - Default adapter

I can't switch to windows because of several reasons, does anybody have an idea of what I am doing wrong?

Thanks in advance!
ps: I have used linux for several years now, so I know my way around. This is a fresh server installation.

OpenCL is not supported on 3xxx series cards.  Although it's not completely impossible to mine on a card that old it will be very difficult.  Also, a card that old will produce less than 1 MH/s which will only be fractions of bitcoins.  I wouldn't waste my time fighting the Radeon 3600.

If you are serious about mining check out the 5xxx and 7xxx series cards.  Or better yet, look into ASICs.


Is it possible to connect to BTCPay server remote c-lightning node? I have BTCPay server and would like to use external c-lightning node which i have funded and prefer more over BTCPay server local docker container (DC).

In store configuration i see that there is option to connect to c-lightning over tcp or unix socket (this one is used when i connect internal node because c-lightning DC socket is linked to BTCPay directly).

How can i connect over TCP? As i uderstand this is not public nodes port (9735) which is used to communicate between nodes but some API port? How can i enable it on c-lightning? Is data sent plain and i should secure communication (lan, fw, vpn etc.)?

Port 9735 is the lightning port. What BTCPay wants is the API.
C-Lightning does not support TCP natively, but one can use socat as I did in the docker entrypoint to bridge unix to TCP.


What's the sense of how lightning network is performing? I realize that we are still very early in the deployment of Lightning network, but is there a sense of how things have been performing thus far? Is this the solution which BTC has been waiting for? I'm hoping to get a sense from anyone who is well knowledgeable about the project's development.

Yes, as of writing, there is an overwhelmingly positive sense of how things are performing thus far - more than 800 nodes with 1600 channels are already on the main net, and micro transactions exchanged more than ~40.000 USD.
It is unclear what you mean by "the solution which BTC has been waiting for". Who is BTC? The community, using bitcoins?

The solution can be SEGWIT, Lightning, SCHNORR sigs, Smart contracts ... ??

Maybe you talk about blocksize, or the fee peak problem in December, which has been discussed in several channels, with many politics involved. This peak has meanwhile reduced to normal values, and doesn't exist anymore (see here). There is also a common sense, that with future lightning adoption this will not re-occur.

I want to stress the point, that lightning is on mainnet, but at a very, very early stage. It is not recommended to be used by newbies, it is more for experts to see behaviour in real world (after extensive tests in test environments).


What if duplicate wallet addresses are created? I'm a newbie to Bitcoin, so I apologize if this seems like a "noob" question.

So, from what I've read: anyone can create a new Bitcoin wallet. Upon creation, a wallet address is automatically generated. The wallet address can be used by others to make transactions to that particular wallet.

Now, my question is, what guarantees that two automatically generated wallet addresses will be unique? If my friend and I created separate wallets on our own computers offline, then what is the guarantee that the two wallet addresses will be unique? What if the two randomly generated wallet addresses turned out to be the same?

The probability is unfathomably small. In practice it will never happen. You can find one billion friends all keep generating trillions of addresses every second and there won't be any duplicate addresses til the end of the life of the sun.

Edit: this actually exaggerated a bit. By virtue of the Birthday Paradox you only need to generate 2^80 addresses (not 2^160) to likely get a pair of duplicate addresses among all the addresses generated. So this address generating party won't be able to run that long.

On the other hand if your billion friends all keep generating addresses in an attempt to get the same address as yours, then it does take forever to happen.


Having some trouble getting started mining bitcoins using GUIMiner and Radeon HD 5770 graphics card I wanted to give mining bitcoins a go. I set up a wallet and downloaded GUIMiner. I also signed up for Slush's pool and all of that fun stuff.

However, my GPU seems to not accept anything. I have zero accepted and two stale/invalid.

My CPU is running GUI and has accepted shares. It's running at ~3.6 Mhash/s.

My GPU is HIS' Radeon HD 5770. It also says it's running at ~890 Khash/s which seems low. It's stably overclocked and has been for some time now. How do I properly set up this GPU on GUIMiner?

My current preferences are set to -v -w128 - that I saw that on the hardware settings Wikipedia page.

There isn't any point in mining with a CPU or GPU. You can get just a few MHash/s that are not enough to accept work from pools. If you want to mine, you have to have at least 1 GHash/s, and you need to buy specific hardware, like ASIC miners. There are a few companies like Butterfly Labs, KnCMiner and more where you can buy machines. The most recent one is from KnCMiner that release preorders for Neptune, a 3000 GHash/s machine for about 12,000 dollars.

You can also look at some cloud mining like cex.io. The price per GHash is much more, but you can trade GH any time.


How do bitcoin miners determine the next valid state of a ledger? I know bitcoin miners compete for a reward by seeing who can solve a difficult hashing problem first (proof-of-work).

However, how does this random hash problem help validate the transactions in the next block? It seems like this hashing problem is completely irrelevant to the ledger validation issue at hand. And when do the other miner nodes validate that the proposed block is correct after one miner finishes?

You are mixing the two things. It is not just miners, but the entire network of full nodes that ensure only valid transactions are included in a block. When a block is mined by a miner, it is propagated on the network. All the full nodes go through a detailed checklist (see here) to ensure that the block and the transactions within the block confine with the consensus protocol. This is unlike ledger based systems where an 'authority' is appointed to vote on transactions to maintain a state of the ledger.

Since Bitcoin is peer-to-peer, there is no central authority to control it. As a result, anyone can send any kind of transaction to the network, whether or not it is valid. You could simply send a transaction that sends someone else's coins to yourself. Now, if a miner tries to mine a block with those invalid transaction, the rest of the network will reject the block. So the entire effort (read electricity and time) that the miner put in will go waste as that block will not be added to the blockchain by the rest of the participants.

The 'random hash problem' also has other benefit. It ensures that Bitcoin blocks are mined every 10 minutes. Every 2016 blocks (or ~2 weeks) the difficulty is adjusted to ensure that the average block time remains at 10 minutes.

  And when do the other miner nodes validate that the proposed block is correct after one miner finishes?

As soon as the miner mines a block (finding a valid block whose header hash confines with the current network difficulty), it will propagate the block through the network. Now, the miner not just sends it to other miners, but also all the full nodes that are connected to it. If the block is valid, the full nodes/mining nodes will relay the block to the nodes connected to them. If invalid, the block will be rejected outright and not relayed. When other mining nodes see this block, they will mine the next block on top of this block (provided the block they received was valid).


Does a full Bitcoin API reference exist with examples? I know that all Bitcoin API methods are listed on the wiki: https://en.bitcoin.it/wiki/Original_Bitcoin_client/API_calls_list. However, some of the methods are very poorly documented.

F.e. the lockunspent method is only documented as taking the parameters <unlock?> [array-of-objects]. No clue about what type of objects. And there are more examples like this.

Is there a good API reference that specifies what parameters are expected and what result they give back?

This would so much lower the bar for new developers!

Here is a complete API reference that has a pending pull request for bitcoin.org

  http://bitcoindev.us.to/en/developer-reference#bitcoin-core-apis

More information:
https://bitcointalk.org/index.php?topic=511876.0


Export a list of addresses associated to blockchain.info account Is there any straightforward way to export just a list of my addresses I have in Receive money tab?
I would like to easily extract them to keep on the side to occasionally run curl on those addresses to get all unspent outputs for each without going to blockchain.info website and logging in.
I can do a copy-paste and grep whole content for addresses but maybe there is some more reliable way?

I also faced this problem.
There is a neat trick to only copy a column in firefox http://www.alvinpoh.com/how-to-select-columns-of-text-in-your-browser-firefox/ (Just need to use Ctrl key) . For chrome install https://chrome.google.com/webstore/detail/columncopy/lapbbfoohlcmlbdaakldmmallcbcbpjb?hl=en

Goto Receive Money Tab and in the list use Ctrl with mouse to select first coloumn and voila you have a list of addresses.


Smart Contract Execution If I have a Blockchain which consists of few smart contracts. Let's say that the Blockchain consists of 2000 blocks. When a new block is added to the Blockchain then does the smart contract runs on all 2000 + 1 blocks or only the last one?

It would be running on the blockchain.. which is a chain of blocks. So really its running on the whole blockchain network regardless of how many blocks there are.

Although the smart contract never existed until the block which you deployed the smart contract on.
For example you deployed a smart contract at block 1500 and right now its block 2000. If someone forked that blockchain at block 1499 your smart contract would never exist. But if they forked at block 1500 then your smart contract would exist on the new forked blockchain (look up the Ethereum classic fork.
I hope this clears it up for you.


Is the asymptotic performance of bitcoin O(n) relative to the block chain length? If I want the latest information (ie. account balance) of account A do I have to traverse the entire block chain to get that info or is the relevant information store in the latest block or some other companion data structure?

If I have to traverse the entire block chain, is there going to be scalable problem as block chain grows?

You have to traverse entire blockchain. At the lowest bitcoin level there is no accounts, there is concept of "unspent output". Bitсoin clients (excluding light versions) should support index of all transactions with unspent output, in order to validate transactions quickly. That means bitcoin clients doesn't actually scan entire blockchain, they just know balance of all accounts.

You are right, it can cause scalability problem, if bitcoin become more valuable, and count of transactions with unspent output will grow very quickly.


Wallet problem and ASIC miner I bought an ASIC miner but the wallet just cannot get synched. I am trying for days now and i am still 18 weeks back. Can i run my ASIC miner on a pool, while my wallet isn't fully synched and the blockchain isn't fully downloaded?

Yes you should be running something like cgminer or bfgminer which can join a pool and mine while your client is still downloading the blockchain.  You only need your own blockchain to do solo mining, and unless you are running a lot of very fast asics you will want to continue mining in the pool.


what is the lowest amount i can transfer using bitcoin ? can i send 0 satoshis? i was looking at this bitcoin tx

https://blockchain.info/tx/b4ea693a9d2d7e32b66777964fce13da302bed024bd9fd4651919da650fb1c40

where

Inputs and Outputs
Total Input 0.00003 BTC
Total Output    0 BTC
Fees    0.00003 BTC
Fee per byte    12.821 sat/B
Fee per weight unit 3.205 sat/WU
Estimated BTC Transacted    0 BTC

the user has set total output as 0 BTC so in short all input is given as fee.

Is this common practice or bug ?

This is unexpected (but valid) behavoiur of mining pool software. btw, i am creator of this tx


Ubuntu - Show active connections? How can I see how many active connections there are on Linux?

bitcoin-cli getinfo will show the number of connections.

bitcoin-cli getpeerinfo will give information about individual connections.


Why doesn’t Bitcoin use UDP to do Blockpropagation? Bitcoin uses TCP for P2P but why is UDP not used?  Modern day internet has relatively low packet loss rate so UDP is reliable. Even if some packets are dropped the peers can always request for the blocks. With TCP, the network is rather staticly constructed whereas UDP you can construct a random graph each time a block is propagated as its connectionless.

NANO uses UDP and I think it’s a good approach. I’m just curious as to if I’m missing something. Bootstrapping can obviously be done using TCP

The Bitcoin system doesn't have just one network protocol:   Any way of obtaining the blocks is equally valid-- blocks over freenet, over satellite broadcast, over the P2P network, all work just as well and are used in practice.  UDP is used with bitcoin too, by the Fibre protocol.

As far the common Bitcoin P2P protocol goes UDP is not an especially good fit for most operations that it performs.  Bitcoin needs to reliably send messages far larger than an IP packet, like transactions and blocks. Although the internet is "reliable" packet loss rates of 1-3% are common. This means that any application needing to communicate large messages with UDP must implement packetization, retransmission, reordering, etc-- the same things that TCP already implements for us.  Many applications that have 'rolled their own TCP' in userspace have ended up with exploitable bugs in them, so it isn't something that should be done without good cause.

UDP also has the issue of NAT traversal:  Getting bidirectional communication across a NAT with UDP is not a simple matter. Crossing anything more complicated than a full cone nat requires considerable amounts of special code but without it there will be a many hosts that just can't talk to other peers with UDP.

You mention connectionlessness allowing you relay to a random host in the network, but in Bitcoin P2P we make use of the consistent relationship between nodes to make the network more reliable and efficient. Nodes have an idea what their peers already know and can avoid sending them redundant data. Nodes also know which peers have been fastest in sending them blocks in the past and handle them specially. Likewise, even if the protocol is connectionless there are costs to processing messages from peers by prioritizing handling messages from existing peers, Bitcoin reduces the impact of some kinds of DOS attack. Handling larger than one-packet messages, retransmissions, etc. also mean that even with a connectionless transport there still needs to be some kind of persistent state.

But an if implementation did want to randomly connect to send a message it could, at an extra cost is a couple round trips for the handshake. Or not even  that: there are only about 10,000 reachable nodes in the P2P network, there wouldn't be much of a challenge in holding open a mostly idle TCP connection to each and ever one of them if all the state retained were just the TCP state. So for that point the use of UDP would at best just be an optimization for something that could already be done but isn't done. I think it would be more interesting to demonstrate the usefulness of having all those connections first, before worrying about optimizing it.

So why might UDP transport be useful to the Bitcoin P2P protocol?

To get lowest latency block transfer possible there must be no round trips even in the face of packet loss which precludes TCP and which is why Fibre uses UDP. But to get no round trips the protocol must be able to handle loss without retransmission and to get low latency a block must be decodable with a minimum amount of data received. This requires very sophisticated error correction techniques which are an evolving area and haven't become mature enough yet to consider mainstreaming them. The latency benefits of fibre also exist so long as a small number of hosts are using it, since it does the heavy lifting of taking blocks all around the world.  Round trips don't cause much harm on low latency links. And this latency concern only applies to block relay.
Unlike TCP, UDP requires some amount of NAT traversal handling to simply get bidirectional communication working. But combined with full nat traversal handling UDP is often able to establish communication between hosts which are both behind different NATs.  This could be helpful for the Bitcoin P2P network since most hosts are unreachable behind a nat. So, ironically, one of UDP's challenges is also one of its uses. However, to connect hosts which are both behind a net the assistance of a third party non-natted host is required along with even more NAT traversal code.  Considering the complexity of traversal improving Bitcoin's support for TCP port mapping (e.g. implementing NAT-PMP) would probably be a better return on investment right now.
Use of UDP would allow for "worst than best effort" traffic handling. For low priority "bulk traffic" like syncing the blockchain it would be nice if the traffic carefully shaped itself to avoid interfering with other traffic on the network. Alternative congestion control algorithims like LEDBAT make it possible to transfer low priority data with minimal impact. But since TCP stacks don't yet commonly support these congestion control approaches, applications that want them currently need to implement their own transports. For Bitcoin it would be ideal if we could just flip a socket option and turn  LEDBAT on and off on existing connections (e.g. when the peer is requesting historical blocks or in the future when something like Fibre is being used by the node to relay new blocks) but that isn't an option yet.

[These last two reasons are the reasons that Bittorrent usually uses UDP]


Get outpoint for a transaction I'm trying to get the outpoint for a transaction but I don't find how to.

The pages here and here look like saying that the outpoint must have 36 characters, of what 32 are the TXID and 4 are the vout.

However I can't find any example or further information about how to get/calculate it. I'm trying with bitcoin-cli listunspent and it gave me:

[
    {
        "txid" : "4bbf676731987cce1e4639ec28d1219f065ab2aa5e9deb323c0b56bd0482d499",
        "vout" : 0,
        "address" : "1CfdQ5eHhPmUPemNStYmSG4RTYEq2Hc1a2",
        "account" : "",
        "scriptPubKey" : "76a9147ff792d99c99e5d89b8dbb54a5f962ccaeec404088ac",
        "amount" : 0.00100000,
        "confirmations" : 1866,
        "spendable" : true
    }
]

The txid is 65 characters long, and the vout is 1 character long (should I left-pad it to 4 characters? If yes, what happens after 10.000?)

Or I am not understanding anything? :s In this case, please provide me reliable and complete sources about this matter, as the docs seems to be very superficial about it.

I'm using bitcoin-cli.

The output returned by bitcoin-cli listunspent is correct. As mentioned in document, outpoint is pair of (txid, vout)

txid is 4bbf676731987cce1e4639ec28d1219f065ab2aa5e9deb323c0b56bd0482d499. Its is hexadecimal representation of a binary string and will take 32 bytes, each hex digit is representing 4 bits (or half a byte)

vout is 0 , this is stored as uint32 in the bitcoin block and will take 4 bytes. In other words it stored as an unsigned int binary representation of 32 bits.


Is using a new address for each transaction pointless when applied to a donation button on a private website? I'm just looking at how to implement donations on my site and also read that I should use a new address for each transaction to increase anonymity.

Is this an ultimately pointless practice when tied to a single private website?

A new address for each transaction is used for anonymity most of the time. For a donation website this isn't isn't that useful. Most people reuse because they feel that their address could be remembered and identified later on, even though this is hard to do it is possible.

Unless you want it to be hard to tell who and where the bitcoins are, it's better to reuse and not have to have a complex system that generates and keeps track of generated addresses.


Recovering private key when someone uses the same k twice in ECDSA signatures In this blog: https://web.archive.org/web/20160308014317/http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html
the author showed a case that using same k twice will leak private key.
Many people know this method. But I find sometimes, the formula can not give the right answer(or I compute wrong).
Look at this, you can verify signatures by public key:
public_key = 02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364
msghash1 = 01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6
msghash2 = 339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1
sig1 = 304402200861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d02206cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
sig2 = 304402200861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d02204ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2

So input data:
r=0861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d
s1=6cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
s2=4ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2
z1=01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6
z2=339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1

I work out:
private key = eaa57720a5b012351d42b2d9ed6409af2b7cff11d2b8631684c1c97f49685fbb
public key = 04e0e81185567ea58fc7e7258aa4d5c3e201a8d4ce2810c1007d87727a67eeb9a8c2ba06935280209f8bf42fc7603b65095f036044c4124ddf7c6a250cb450e4c8

However, it's wrong.
I'm using this python code to compute:
# this function is from
# https://github.com/warner/python-ecdsa/blob/master/ecdsa/numbertheory.py
def inverse_mod( a, m ):
    """Inverse of a mod m."""
    if a < 0 or m <= a: a = a % m
    # From Ferguson and Schneier, roughly:
    c, d = a, m
    uc, vc, ud, vd = 1, 0, 0, 1
    while c != 0:
        q, c, d = divmod( d, c ) + ( c, )
        uc, vc, ud, vd = ud - q*uc, vd - q*vc, uc, vc

    # At this point, d is the GCD, and ud*a+vd*m = d.
    # If d == 1, this means that ud is a inverse.
    assert d == 1
    if ud > 0: return ud
    else: return ud + m

def derivate_privkey(p, r, s1, s2, hash1, hash2):
    z = hash1 - hash2
    s = s1 - s2
    r_inv = inverse_mod(r, p)
    s_inv = inverse_mod(s, p)
    k = (z * s_inv) % p
    d = (r_inv * (s1 * k - hash1)) % p
    return d, k

p  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

# this case is right
public_key=0x04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff
r =0xd47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
s1=0x44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e
s2=0x9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab
z1=0xc0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e
z2=0x17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc
print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2)
print

# this case can be wrong
public_key=0x02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364
r =0x0861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d
s1=0x6cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
s2=0x4ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2
z1=0x01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6
z2=0x339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1

print "private:%x\n random:%x" % derivate_privkey(p,r,s1,s2,z1,z2)

In fact, there have another one met this problem:
https://crypto.stackexchange.com/questions/16615/ecdsa-how-to-retrieve-a-non-random-k
But he didn't gave more infomation, maybe he figured it out.
I have not found more people complaining about it, so, it's likely my fault somehow.
Can you point out my error? or just point out the right way? Thank you.

Here is a fun thing about ECDSA signatures: you can always replace s with -s (mod N) and the signature is still valid.  So when you are deducing the k value, it is possible that someone else flipped the sign of s and you will have to undo it.  So, you have to make a list of candidates for k (kandidates?) and then select whichever one actually works.  A good list of k candidates would be:

(z1 - z2) / (s1 - s2)
(z1 - z2) / (s1 + s2)
(z1 - z2) / (-s1 - s2)
(z1 - z2) / (-s1 + s2)

I like to use the Ruby ECDSA gem to play around with this kind of stuff.  Here is the code I wrote which successfully finds the private key for the first input data you gave:

require 'ecdsa'

public_key_hex = '02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364'
msghash1_hex = '01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6'
msghash2_hex = '339ff7b1ced3a45c988b3e4e239ea745db3b2b3fda6208134691bd2e4a37d6e1'
sig1_hex = '304402200861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d02206cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188'
sig2_hex = '304402200861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d02204ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2'

group = ECDSA::Group::Secp256k1

def hex_to_binary(str)
  str.scan(/../).map(&:hex).pack('C*')
end

public_key_str = hex_to_binary(public_key_hex)
public_key = ECDSA::Format::PointOctetString.decode(public_key_str, group)

puts 'public key x: %#x' % public_key.x
puts 'public key y: %#x' % public_key.y

msghash1 = hex_to_binary(msghash1_hex)
msghash2 = hex_to_binary(msghash2_hex)
sig1 = ECDSA::Format::SignatureDerString.decode(hex_to_binary(sig1_hex))
sig2 = ECDSA::Format::SignatureDerString.decode(hex_to_binary(sig2_hex))

raise 'R values are not the same' if sig1.r != sig2.r

r = sig1.r
puts 'sig r: %#x' % r
puts 'sig1 s: %#x' % sig1.s
puts 'sig2 s: %#x' % sig2.s

sig1_valid = ECDSA.valid_signature?(public_key, msghash1, sig1)
sig2_valid = ECDSA.valid_signature?(public_key, msghash2, sig2)
puts "sig1 valid: #{sig1_valid}"
puts "sig2 valid: #{sig2_valid}"

# Step 1: k = (z1 - z2)/(s1 - s2)
field = ECDSA::PrimeField.new(group.order)
z1 = ECDSA::Format::IntegerOctetString.decode(msghash1)
z2 = ECDSA::Format::IntegerOctetString.decode(msghash2)

k_candidates = [
  field.mod((z1 - z2) * field.inverse(sig1.s - sig2.s)),
  field.mod((z1 - z2) * field.inverse(sig1.s + sig2.s)),
  field.mod((z1 - z2) * field.inverse(-sig1.s - sig2.s)),
  field.mod((z1 - z2) * field.inverse(-sig1.s + sig2.s)),
]

private_key = nil
k_candidates.each do |k|
  next unless group.new_point(k).x == r
  private_key_maybe = field.mod(field.mod(sig1.s * k - z1) * field.inverse(r))
  if public_key == group.new_point(private_key_maybe)
    private_key = private_key_maybe
  end
end

puts 'private key: %#x' % private_key

The output of the program is:

public key x: 0xa50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364
public key y: 0x7954da3444d33b8d1f90a0d7168b2f158a2c96db46733286619fccaafbaca6bc
sig r: 0x861cce1da15fc2dd79f1164c4f7b3e6c1526e7e8d85716578689ca9a5dc349d
sig1 s: 0x6cf26e2776f7c94cafcee05cc810471ddca16fa864d13d57bee1c06ce39a3188
sig2 s: 0x4ba75bdda43b3aab84b895cfd9ef13a477182657faaf286a7b0d25f0cb9a7de2
sig1 valid: true
sig2 valid: true
private key: 0xe773cf35fce567d0622203c28f67478a3361bae7e6eb4366b50e1d27eb1ed82e


How can I calculate the bitcoin per day from mining in a pool? So, I'm trying out http://cex.io, a cloud based hash market. They use the pool http://ghash.io which uses "PPLNS" for distribution of funds(?)

Given that I can see how much total hashing power is in runs, and I can see how much hashing power I am contributing to each run, how can I calculate an average rate of BTC I will get?

To go from GH/sec to BTC/day, use this:

BTC/day = GH/sec * 1,000 * 25 * 24 * 3,600 / 2^32 / difficulty(in millions)
Because: the block reward is currently 25, there are 24 hours in a day, 3600 seconds in an hour, and the base share difficulty is 2^32.

So 100GH/s, at the current difficulty of 707 million will yield:
100 * 1,000 * 25 * 24 * 3600 / 2^32 / 707.41 = .0711 BTC/day

Note that this assumes no pool fees and no variance at all. Of course, the difficulty is increasing so the yield will drop.


Offline Bitcoin Wallet I would like to have bitcoin and store them as safely as possible. I want bitcoin data to be stored on my disk -- I don't want to some online service to manage my wallet. I also would like to have ability to easily backup wallet data so if my disk fails I can then recreate my wallet from backup.

Nice thing is to have ability to transfer wallet from one program to another so if some program ceased to be developed I can import my private/public keys to another program.

Can you recommend any application like that?

The only thing you need to spend bitcoins is a Private Key, I recommend that you create a Private Key beeing offline, then import it to Bitcoin Core wallet or Electrum Bitcoin wallet (if you don't want to download the complete blockchain) these are the most secure protocols.

First you need to create a Private Key, it consist on a 32 byte array on HEX format(64 characters), you can use SHA256, for example: ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Its highly recommended that you make this process offline and the input of the SHA256 should be as random as you can.

Then convert it to Wallet Import Format (WIF) following this guide: https://allprivatekeys.com/what-is-wif.

Then import WIF to the wallet:

Bitcoin Core: https://en.bitcoin.it/wiki/Help:How_to_import_private_keys_in_Bitcoin_Core_0.7%2B

Electrum: https://bitcoinelectrum.com/importing-your-private-keys-into-electrum/


Convert BTC to BCC from Bitcoin Core Wallet Not sure if this is the proper forum for this question but I was wondering, what is the easiest way to experiment with converting BTC into BCC? Suppose I have a BTC core wallet which holds 1 BTC but I only want to claim 0.10 worth BTC as BCC?  From what I understand, the way to do this is would be to create another BTC wallet, transfer 0.90 BTC into the new wallet, and then import the private key of the original BTC wallet into a BCC wallet.   This way the remainder of 0.10 BTC will transfer over to BCC?

You need to transfer all your BTC to the new BTC wallet, after that you import the private keys from old BTC wallet into a BCC wallet and you will have the same amount of BCC. From here on you can decide with how much BCC you want to play with (you cannot clam partial amounts of BCC)


How do Bitcoin clients determine the number of confirmations a transaction has? The protocol specification doesn't seem to address this.

Transactions are first transmitted to all the nodes in the p2p network.  At this point they are "unconfirmed".
At some point a miner includes the transaction in a block.  The transaction now has 1 confirmation.
Miners continue to find blocks and the next block builds on the block that contains the transaction.  The transaction now has 2 confirmations (the original block + 1 more after it in the block chain).
Miners continue to find blocks, the next block that extends the chain makes the 3rd confirmation and the one after that makes the 4th, etc.

Clients determine the number of confirmations by counting the number of blocks in the block chain since the block that contains the transaction:

"Height of current longest chain" - "Height of chain for the block containing the transaction" + 1