From wk at gnupg.org  Wed Oct 11 14:28:01 2017
From: wk at gnupg.org (Werner Koch)
Date: Wed, 11 Oct 2017 14:28:01 +0200
Subject: Bitcoin trouble
Message-ID: <87k201j2cu.fsf@wheatstone.g10code.de>

Hi!

On July 7 we received 22 BTC from 1FxkfJQLJTXpW6QmxGT6oF43ZH959ns8Cq to
our campaign address 1EAw3RnaALKiES8Ap93SwwDx4fsoY12wzF [1].

Meanwhile I converted these and 4 other received Bitcoins to Euro using
Bitwala.com.  The net result on our account is

| 2017-09-07 |  3615.64 | Exchange of 1 BTC        |
| 2017-09-11 | 38650.36 | Exchange of 10 BTC       |
| 2017-09-14 | 25868.08 | Exchange of 10 BTC       |
| 2017-10-06 | 18197.53 | Exchange of 5 BTC        |
             ------------                
               86331.61 EUR

Bitwala is registered in the Netherlands and our bank received the money
via a Dutch bank.  Bitwala did all the required identification for the
Verein and me and I used that Bitwala account for the conversion.  But
that identification is not enough.  Due to money laundering laws our
(receiving) bank wants to know the real origin of the money and not just
that it was sent from Bitwala.

We publish all transactions at https://gnupg.org/verein/finances.html
which should be enough evidence that there is no money laundering issue
here.  However the law or the current practise requires something
different.

I had a few phone calls with the bank.  The outcome is that they need to
know the origin of the 22 BTC and possible also those of the other 4
BTC.  Until this has been resolved they have frozen the account.

Sure, we could have side-stepped this issue and kept the Bitcoins in our
wallet.  The problem with that approach is that we would have incomplete
financial reporting and would risk our charitable state.  Thus the board
agreed to exchange the Bitcoins as soon as possible.

Does anyone known why the address 1FxkfJQLJTXpW6QmxGT6oF43ZH959ns8Cq is
often used in code examples - is it related to Ethereum?


Shalom-Salam,

   Werner


p.s.
I'll will tell the bank the (public) URL of our mailing list
archive so that they can also follow our discussion.

[1] <https://blockchain.info/tx/9ec1013b9c6073918537647f2063ffaf7e02252e3f093eb7a17aa44471390dd8:

-- 
GnuPG e.V., Rochusstr. 44, D-40479 D?sseldorf.  VR 11482 D?sseldorf
Vorstand: W.Koch, A.Heinecke, n.n.            Mail: board at gnupg.org
Finanzamt D-Altstadt, St-Nr: 103/5923/1779.   Tel: +49-2104-4938799
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: </pipermail/verein/attachments/20171011/800e3836/attachment-0001.sig>

From gniibe at fsij.org  Mon Oct 16 07:37:10 2017
From: gniibe at fsij.org (NIIBE Yutaka)
Date: Mon, 16 Oct 2017 14:37:10 +0900
Subject: Bitcoin trouble
In-Reply-To: <87k201j2cu.fsf@wheatstone.g10code.de>
References: <87k201j2cu.fsf@wheatstone.g10code.de>
Message-ID: <87efq33b7d.fsf@iwagami.gniibe.org>

Werner Koch <wk at gnupg.org> wrote:
> Does anyone known why the address 1FxkfJQLJTXpW6QmxGT6oF43ZH959ns8Cq is
> often used in code examples - is it related to Ethereum?

I also found the address in the commit:

    https://github.com/vbuterin/pybitcointools/commit/b9909bf

=============================================
b9909bf53a6a447e067486acd6ccf943777b1c10
Author:     Vitalik Buterin <v at buterin.com>
AuthorDate: Sat Mar 22 11:32:37 2014 -0400
Commit:     Vitalik Buterin <v at buterin.com>
CommitDate: Sat Mar 22 11:32:37 2014 -0400

Parent:     69712b6 Added JSON features and transaction features
Containing: master

Added to readme

2 files changed, 23 insertions(+), 5 deletions(-)
README.md | 22 ++++++++++++++++++++--
pybtctool |  6 +++---
=============================================

Then, I visite this page:

	https://onename.com/vitalik

And pushing "SEND BITCOINS" button, it showed the address:

	1FxkfJQLJTXpW6QmxGT6oF43ZH959ns8Cq

-- 


From wk at gnupg.org  Mon Oct 16 09:25:26 2017
From: wk at gnupg.org (Werner Koch)
Date: Mon, 16 Oct 2017 09:25:26 +0200
Subject: Bitcoin trouble
In-Reply-To: <87efq33b7d.fsf@iwagami.gniibe.org> (NIIBE Yutaka's message of
 "Mon, 16 Oct 2017 14:37:10 +0900")
References: <87k201j2cu.fsf@wheatstone.g10code.de>
 <87efq33b7d.fsf@iwagami.gniibe.org>
Message-ID: <87wp3vwo49.fsf@wheatstone.g10code.de>

On Mon, 16 Oct 2017 07:37, gniibe at fsij.org said:

> I also found the address in the commit:
>
>     https://github.com/vbuterin/pybitcointools/commit/b9909bf

Right, I meanwhile also stumbled upon Vitalik Buterin as did Marcus.

Thanks.  That commit along with the spending pattern of that address is
some evidence that he the donor.  


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 357 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/verein/attachments/20171016/dfba75bd/attachment.sig>

From phil.pennock at spodhuis.org  Mon Oct 16 22:18:34 2017
From: phil.pennock at spodhuis.org (Phil Pennock)
Date: Mon, 16 Oct 2017 16:18:34 -0400
Subject: Infineon / RSA troubles
Message-ID: <20171016201833.GA28362@breadbox.private.spodhuis.org>

Is there anything to do around user support, key auto-blacklisting, etc
arising from:

  https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

?

} The researchers also found 2,892 PGP keys used for encrypted e-mail,
} 956 of which were factorizable. The researchers speculated that the
} majority of the PGP keys were generated using the Yubikey 4, which
} allows owners to use the faulty library to create on-chip RSA
} keys. Other functions of the USB device, including U2F
} authentication, remain unaffected. Yubico has more details here.

Interestingly:
} To spare time and cost, attackers can first test a public key to see
} if it's vulnerable to the attack. The test is inexpensive, requires
} less than 1 millisecond, and its creators believe it produces
} practically zero false positives and zero false negatives.

    https://keychest.net/roca

I wonder if it's worth adding such a check to GnuPG in the import path?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 996 bytes
Desc: Digital signature
URL: <https://lists.gnupg.org/pipermail/verein/attachments/20171016/0cf79712/attachment.sig>

From kristian.fiskerstrand at sumptuouscapital.com  Mon Oct 16 23:49:51 2017
From: kristian.fiskerstrand at sumptuouscapital.com (Kristian Fiskerstrand)
Date: Mon, 16 Oct 2017 23:49:51 +0200
Subject: Infineon / RSA troubles
In-Reply-To: <20171016201833.GA28362@breadbox.private.spodhuis.org>
References: <20171016201833.GA28362@breadbox.private.spodhuis.org>
Message-ID: <76f3013b-2d51-9834-1459-bc396ca2ed2f@sumptuouscapital.com>

On 10/16/2017 10:18 PM, Phil Pennock wrote:
> Is there anything to do around user support, key auto-blacklisting, etc
> arising from:

This discussion likely belongs more on gnupg-devel or gnupg-users.

-- 
----------------------------
Kristian Fiskerstrand
Blog: https://blog.sumptuouscapital.com
Twitter: @krifisk
----------------------------
Public OpenPGP keyblock at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
----------------------------
"Strength lies in differences, not in similarities."
(Stephen Covey)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/verein/attachments/20171016/b20b94da/attachment.sig>

From wk at gnupg.org  Tue Oct 17 08:40:18 2017
From: wk at gnupg.org (Werner Koch)
Date: Tue, 17 Oct 2017 08:40:18 +0200
Subject: Infineon / RSA troubles
In-Reply-To: <76f3013b-2d51-9834-1459-bc396ca2ed2f@sumptuouscapital.com>
 (Kristian Fiskerstrand's message of "Mon, 16 Oct 2017 23:49:51 +0200")
References: <20171016201833.GA28362@breadbox.private.spodhuis.org>
 <76f3013b-2d51-9834-1459-bc396ca2ed2f@sumptuouscapital.com>
Message-ID: <87fuaiuvjh.fsf@wheatstone.g10code.de>

On Mon, 16 Oct 2017 23:49, kristian.fiskerstrand at sumptuouscapital.com
said:

> This discussion likely belongs more on gnupg-devel or gnupg-users.

Yep.  I am surprised that nobody has yet asked over their.

I'd really like to see their paper but given that it is 8 months sinced
they found that problem we can be pretty sure that we are not affected.

AFAIK, the Zeitcontrol cards use NXP chips.


Salam-Shalom,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 357 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/verein/attachments/20171017/496fe941/attachment.sig>

From wk at gnupg.org  Mon Oct 23 13:13:22 2017
From: wk at gnupg.org (Werner Koch)
Date: Mon, 23 Oct 2017 13:13:22 +0200
Subject: Bitcoin trouble
In-Reply-To: <87k201j2cu.fsf@wheatstone.g10code.de> (Werner Koch's message of
 "Wed, 11 Oct 2017 14:28:01 +0200")
References: <87k201j2cu.fsf@wheatstone.g10code.de>
Message-ID: <87a80idsml.fsf@wheatstone.g10code.de>

On Wed, 11 Oct 2017 14:28, wk at gnupg.org said:

> | 2017-09-07 |  3615.64 | Exchange of 1 BTC        |
> | 2017-09-11 | 38650.36 | Exchange of 10 BTC       |
> | 2017-09-14 | 25868.08 | Exchange of 10 BTC       |
> | 2017-10-06 | 18197.53 | Exchange of 5 BTC        |
>              ------------                
>                86331.61 EUR

Ooops.  The third line and the total are wrong.  The correct numbers
are:

  | 2017-09-07 |  3615.64 | Exchange of 1 BTC        |
  | 2017-09-11 | 38650.36 | Exchange of 10 BTC       |
  | 2017-09-14 | 35868.08 | Exchange of 10 BTC       |
  | 2017-10-06 | 18197.53 | Exchange of 5 BTC        |
               ------------
                 96331.61 EUR



Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/verein/attachments/20171023/d98c79a3/attachment.sig>