Unencrypted RPC & Multiparty ECDSA ~ Bitcoin op Tech #18

Here's a synthesized summary of Bitcoin OpTech #18, incorporating the provided partial summaries:

1. Narrative Summary

Bitcoin OpTech #18, recorded on October 28, 2018, presented a reading of the Bitcoin OpTag newsletter, focusing on recent security concerns, innovative research, and noteworthy code merges within the Bitcoin ecosystem. A significant portion of the discussion centered around a critical security vulnerability: a substantial number of Bitcoin nodes (approximately 13%, or around 1,100 out of 8,400 listening nodes) are running with unencrypted RPC ports open. This exposes these nodes to serious risks, including wallet theft, blockchain fork manipulation, and unauthorized file system access. The podcast strongly urged users to disable RPC connections or ensure they are encrypted to mitigate this threat.

Beyond security, the episode explored advancements in multi-party ECDSA (Threshold ECDSA), a technology with the potential to significantly reduce transaction fees for multi-signature setups. Two research papers were highlighted, detailing progress in this area, which aims to create a single signature and public key regardless of the number of participating parties. The podcast also reviewed several code merges across Bitcoin Core, L&D (Lightning Development), and C Lightning, including new RPC commands, bug fixes, and enhanced functionality for transaction creation, fee management, and payment tracking. Finally, the hosts emphasized the value of the Bitcoin OpTag newsletter as a vital resource for staying informed about developments in the Bitcoin open-source community.

The discussion also touched upon a merge pull request enabling the use of custom hash functions, allowing for greater flexibility in cryptographic operations. This feature allows developers to pass arbitrary data to these functions, expanding the possibilities for Bitcoin's functionality. Overall, the episode provided a comprehensive overview of the current state of Bitcoin development, highlighting both critical security concerns and promising technological advancements.

2. Main Topics Discussed

• Unencrypted RPC Ports: The significant security risk of open, unencrypted RPC ports on Bitcoin nodes.
• Multi-Party ECDSA (Threshold ECDSA): Advancements in this technology to reduce multi-signature transaction fees.
• Notable Code Merges: Review of recent code changes in Bitcoin Core, L&D, and C Lightning.
• New RPC command to list available wallets.
• Fix for a regression in Bitcoin Core 0.17.0 affecting watch-only wallets.
• Anti-fee sniping techniques in L&D for sweep transactions.
• Prevention of excessive fund locking in L&D.
• New RPC in C Lightning for listing forwarded payments and tracking fees.
• Merge in Lipsack P256K1 allowing custom hash functions for ECDH.
• Custom Hash Functions: A merge allowing the use of custom hash functions with arbitrary data.
• Bitcoin OpTag Newsletter: Promotion and encouragement to subscribe to the Bitcoin OpTag newsletter.

3. Key Quotes

• "About 13% of Bitcoin nodes appear to have their RPC ports open on unencrypted public connections."
• "RPC communication is not encrypted, so any eavesdropper observing even a single request to your server can steal your authentication credentials."
• "allows passing a pointer to a custom hash function that will be used instead of the default and which permits passing arbitrary data to that function."
• "a wealth of resources provided by really, really kind and loving experts of the Bitcoin open source community."

4. People Mentioned

• Rosario Gennaro (author of a paper on fast multi-party threshold ECDSA)
• Stephen Goldfeather (author of a paper on fast multi-party threshold ECDSA)
• You Well in Them and Are You Enough (authors of a paper on fast secure multi-party ECDSA)
• Samuel Renelucci (author of a paper on fast secure multi-party ECDSA)

5. Bitcoin Price

• No specific Bitcoin prices were mentioned.