<p>Several cryptographic schemes have such kind of flaw, that is, if an attacker intercepts several messages from one single private key source, it becomes easier to decipher the message. During the World War II this were done several times by the allies in order to break the Nazis and the Japaneses codes.  </p>

<p>Fortunately, bitcoin rely on cryptographic schemes (mainly SHA256) that doesn't have any know flaw (unless brute force) yet. This means that, if you don't provide your private key to no one else, you can do as many transactions you like with one single address account that an attacker would not be better of to break your account.  </p>

CC BY-SA 3.0
2015-11-23T18:20:56.793Z
2015-11-23T20:12:19.673Z
2015-11-23T20:12:19.673Z
Mark Messa
<p>It does make your address slightly less secure once you send from it. If the address is only used to receive Bitcoin though, it is secure, and there is no significant risk to your private keys.</p>

<p>EDIT Added: Sending lets the world know the public address. This increases risk (albeit to insignificant levels) but still IMO many times <em>higher risk</em> than not disclosing this information at all, because now any attacker is closer to finding the private key.</p>

<p>So as just one reason (there are more)... given that there is clearly non-zero risk that technology could be developed to compute private keys more easily from public addresses, publicizing public addresses increases risk. See link below.</p>

<p><a href="https://www.reddit.com/r/Bitcoin/comments/3wfmg2/satoshis_unmoved_coins_are_the_worlds_biggest/" rel="nofollow">Reddit thread discussing quantum-safety</a></p>

CC BY-SA 3.0
2015-11-22T19:09:55.217Z
Can you quantify the "slightly"?  As far as I know, these risks are only significant if you are using a flawed implementation.  It would seem to be a serious problem with ECDSA if publishing any reasonable number of signatures would make it feasible for an attacker to recover the private key.
Nate Eldredge
CC BY-SA 3.0
2015-11-22T20:42:45.163Z
This is misleading, because it's conflating address correlation (see which keys are related) and address compromise (take money from you).
Nick ODell
CC BY-SA 3.0
2015-11-22T23:38:07.310Z
I do not understand your criticism Nick, can you explain. As for quantification Nate, I don't have time to calculate that, not certain why the exact number is relevant to answering the question.
Bradley Thomas
CC BY-SA 3.0
2015-11-23T21:45:50.707Z
@BradThomas Sure. `It does make your address slightly less secure once you send from it.` If you mean in the sense that it reduces address privacy, that's true, but misleading, since the OP asked about something else. If you mean that in the sense that repeated signings can allow someone to compromise your private keys, that's false. If there's some other aspect of my criticism you'd like clarification on, please let me know. (P.S. Remember to @mention someone to notify them of your response.)
Nick ODell
CC BY-SA 3.0
2015-11-23T23:37:06.780Z
@Nick, thank you for your clarification. I think I could have been clearer what I meant in my answer, so I have updated it
Bradley Thomas
CC BY-SA 3.0
2015-12-12T05:16:02.723Z
Link for reference: https://www.reddit.com/r/Bitcoin/comments/3wfmg2/satoshis_unmoved_coins_are_the_worlds_biggest/
Bradley Thomas
CC BY-SA 3.0
2015-11-22T17:16:42.473Z
2015-12-12T05:16:44.477Z
2015-12-12T05:16:44.477Z
Bradley Thomas
<p>So there are <a href="http://arstechnica.com/security/2014/03/scientist-devised-crypto-attack-could-one-day-steal-secret-bitcoin-keys/" rel="nofollow">attacks</a> where if you sign enough times with the same private key, the attacker, with access to a side-channel can figure out your key. </p>

<p>So if you were signing with your private key a lot of times, this would make your private key slightly less secure. If you're receiving bitcoins to your address, you're not signing with your private key, so this isn't an issue.</p>

<p>The more important consideration here is that you lose privacy with address reuse. </p>

CC BY-SA 3.0
2015-11-22T22:33:31.567Z
Note that a "side channel" is often talking about some level of access. Bitcoin Core also does not use OpenSSL for signing transactions so this particular bug is likely a complete non-issue.
Claris
CC BY-SA 3.0
2015-11-22T21:58:24.990Z
2015-11-22T21:58:24.990Z
Jimmy Song
<p>I've read that it's never safe to use the same bitcoin address more than once because there is a small chance that someone could solve for your private keys (though I don't have a solid-enough background in encryption to understand all of the implications of this concept). In any case, even if you did generate a different address for every incoming transaction, what would stop an attacker from simply sending many transactions to the first address they see in an attempt to crack your private key?</p>

CC BY-SA 3.0
2015-11-22T15:51:15.937Z
I think that what you read is wrong, or you have misunderstood it.  Can you give a link / reference to where you read this?
Nate Eldredge
CC BY-SA 3.0
2015-11-22T16:04:48.447Z
@NateEldredge https://en.bitcoin.it/wiki/Address_reuse#Security
JSideris
CC BY-SA 3.0
2015-11-22T16:20:03.443Z
I believe you are thinking of the leaking of a private key when building a transaction with reused r-values. There is no chance someone can solve your private key from an attacker sending you coins. https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517
m1xolyd1an
CC BY-SA 3.0
2015-11-22T17:06:08.570Z
@m1xolyd1an Yes this is the issue to which I was referring. That was a pretty good explanation on how the vulnerability works - I get how the calculation is done. Am I to understand that using the same address to receive bitcoins more than once is, per se, not insecure, but that this vulnerability has to do with the way transactions are signed?
JSideris
CC BY-SA 3.0
2015-11-22T17:21:09.023Z
Yes the reused r-value vulnerability is from creating many transactions from the same address AND a wallet service fault of re-using r values. @Bizorke
m1xolyd1an
CC BY-SA 3.0
2015-11-22T19:08:21.263Z
@Bizorke: I think it's also important to emphasize that the signature vulnerability is not inherent to ECDSA, as far as I know; it requires a flawed implementation.  The "reused r values" only works if you are using a broken random number generator, and the side channel attack requires that the attacker have access to your computer (possibly a different account).  I'm not aware of any inherent risks of creating many transactions from a single address.
Nate Eldredge
CC BY-SA 3.0
2015-11-23T01:26:38.220Z
Modern software uses RFC6979 which doesn't use any supplied entropy for the ECDSA nonce anyway. If the RNG is so broken it's making duplicates there's going to be other problems though.
Claris
<security><private-key><encryption>
Could someone solve for your private keys by sending many transactions to the same address?
JSideris
# Could someone solve for your private keys by sending many transactions to the same address?

(Asked by: username_0 on 2015-11-22)

I've read that it's never safe to use the same bitcoin address more than once because there is a small chance that someone could solve for your private keys (though I don't have a solid-enough background in encryption to understand all of the implications of this concept). In any case, even if you did generate a different address for every incoming transaction, what would stop an attacker from simply sending many transactions to the first address they see in an attempt to crack your private key?

**Tags:** security, private-key, encryption

> **Comments:**
> **username_1**: I think that what you read is wrong, or you have misunderstood it.  Can you give a link / reference to where you read this?  
> **username_0**: @username_1 https://en.bitcoin.it/wiki/Address_reuse#Security  
> **username_2**: I believe you are thinking of the leaking of a private key when building a transaction with reused r-values. There is no chance someone can solve your private key from an attacker sending you coins. https://bitcointalk.org/index.php?topic=977070.msg10669517#msg10669517  
> **username_0**: @username_2 Yes this is the issue to which I was referring. That was a pretty good explanation on how the vulnerability works - I get how the calculation is done. Am I to understand that using the same address to receive bitcoins more than once is, per se, not insecure, but that this vulnerability has to do with the way transactions are signed?  
> **username_2**: Yes the reused r-value vulnerability is from creating many transactions from the same address AND a wallet service fault of re-using r values. @Bizorke  
> **username_1**: @Bizorke: I think it's also important to emphasize that the signature vulnerability is not inherent to ECDSA, as far as I know; it requires a flawed implementation.  The "reused r values" only works if you are using a broken random number generator, and the side channel attack requires that the attacker have access to your computer (possibly a different account).  I'm not aware of any inherent risks of creating many transactions from a single address.  
> **username_3**: Modern software uses RFC6979 which doesn't use any supplied entropy for the ECDSA nonce anyway. If the RNG is so broken it's making duplicates there's going to be other problems though.  

---

## 3 answers

### Answer by username_7 on 2015-11-22. Score: 4 | Accepted answer

So there are [attacks](http://arstechnica.com/security/2014/03/scientist-devised-crypto-attack-could-one-day-steal-secret-bitcoin-keys/) where if you sign enough times with the same private key, the attacker, with access to a side-channel can figure out your key.

So if you were signing with your private key a lot of times, this would make your private key slightly less secure. If you're receiving bitcoins to your address, you're not signing with your private key, so this isn't an issue.

The more important consideration here is that you lose privacy with address reuse.

> **Comments:**
> **username_3**: Note that a "side channel" is often talking about some level of access. Bitcoin Core also does not use OpenSSL for signing transactions so this particular bug is likely a complete non-issue.  

---

### Answer by username_4 on 2015-11-23. Score: 0

Several cryptographic schemes have such kind of flaw, that is, if an attacker intercepts several messages from one single private key source, it becomes easier to decipher the message. During the World War II this were done several times by the allies in order to break the Nazis and the Japaneses codes.

Fortunately, bitcoin rely on cryptographic schemes (mainly SHA256) that doesn't have any know flaw (unless brute force) yet. This means that, if you don't provide your private key to no one else, you can do as many transactions you like with one single address account that an attacker would not be better of to break your account.


---

### Answer by username_5 on 2015-11-22. Score: -2

It does make your address slightly less secure once you send from it. If the address is only used to receive Bitcoin though, it is secure, and there is no significant risk to your private keys.

EDIT Added: Sending lets the world know the public address. This increases risk (albeit to insignificant levels) but still IMO many times *higher risk* than not disclosing this information at all, because now any attacker is closer to finding the private key.

So as just one reason (there are more)... given that there is clearly non-zero risk that technology could be developed to compute private keys more easily from public addresses, publicizing public addresses increases risk. See link below.

[Reddit thread discussing quantum-safety](https://www.reddit.com/r/Bitcoin/comments/3wfmg2/satoshis_unmoved_coins_are_the_worlds_biggest/)

> **Comments:**
> **username_1**: Can you quantify the "slightly"?  As far as I know, these risks are only significant if you are using a flawed implementation.  It would seem to be a serious problem with ECDSA if publishing any reasonable number of signatures would make it feasible for an attacker to recover the private key.  
> **username_6**: This is misleading, because it's conflating address correlation (see which keys are related) and address compromise (take money from you).  
> **username_5**: I do not understand your criticism username_6, can you explain. As for quantification username_1, I don't have time to calculate that, not certain why the exact number is relevant to answering the question.  
> **username_6**: @BradThomas Sure. `It does make your address slightly less secure once you send from it.` If you mean in the sense that it reduces address privacy, that's true, but misleading, since the OP asked about something else. If you mean that in the sense that repeated signings can allow someone to compromise your private keys, that's false. If there's some other aspect of my criticism you'd like clarification on, please let me know. (P.S. Remember to @mention someone to notify them of your response.)  
> **username_5**: @username_6, thank you for your clarification. I think I could have been clearer what I meant in my answer, so I have updated it  
> **username_5**: Link for reference: https://www.reddit.com/r/Bitcoin/comments/3wfmg2/satoshis_unmoved_coins_are_the_worlds_biggest/  

---

