<p>The following is taken from problem 3 in HW1 of CS 251 Stanford's course (<a href="https://cs251.stanford.edu/syllabus.html" rel="nofollow noreferrer">https://cs251.stanford.edu/syllabus.html</a>).</p>
<p>Alice is on a backpacking trip and is worried about her devices containing private keys getting stolen. She wants to store her bitcoins in such a way that they
can be redeemed via knowledge of a password P. Accordingly, she stores them in the following
ScriptPubKey address:</p>
<p>OP_SHA256
&lt;0xeb271cbcc2340d0b0e6212903e29f22e578ff69b&gt;
OP_EQUAL</p>
<ol>
<li><p>Write a ScriptSig script that will successfully redeem this UTXO given the password P.
Hint: it should only be one line long.</p>
</li>
<li><p>. Suppose Alice chooses a six character password P. Explain why her bitcoins can be stolen
soon after her UTXO is posted to the blockchain. You may assume that computing SHA256
of all six character passwords can be done in reasonable time.</p>
</li>
<li><p>Suppose Alice chooses a strong 30 character passphrase P. Is the ScriptPubKey above a
secure way to protect her bitcoins? Why or why not?
Hint: reason through what happens when she tries to redeem her bitcoins</p>
</li>
</ol>
<p>My attempts/doubts:</p>
<ol>
<li><p>The private key needs to be 256 bit number, I don't see how to connect this with ANY password P to obtain the ScriptSig composed of private and public key. Also should't the hashed version of the public key correspond to eb271cbcc2340d0b0e6212903e29f22e578ff69b?</p>
</li>
<li><p>Similar doubt as in 1)</p>
</li>
<li><p>Funds can be stolen by the node that sees the transaction?</p>
</li>
</ol>

CC BY-SA 4.0
2022-11-14T15:10:36.260Z
Your doubts regarding question 1 might well be a strong hint at the answer to question 3. :) Maybe this resource can help you answer the questions on your own: https://learnmeabitcoin.com/technical/script.
Antoine Poinsot
CC BY-SA 4.0
2022-11-14T19:39:45.500Z
This is a "hashlock" contract, once the transaction that unlocks it is first broadcast, the miner can just take it for himself as there's no signature. https://en.bitcoin.it/wiki/Hashlock
bca-0353f40e
CC BY-SA 4.0
2022-11-15T13:22:10.700Z
This script is actually unspendable, because OP_SHA256 computes a 32-byte hash, but here it is compared to a 20-byte expected value, which will never match.
Pieter Wuille
<private-key><script><public-key>
Bitcoin script and unsecure ScriptPubKey
Mattiatore
# Bitcoin script and unsecure ScriptPubKey

(Asked by: username_0 on 2022-11-14)

The following is taken from problem 3 in HW1 of CS 251 Stanford's course (<https://cs251.stanford.edu/syllabus.html>).

Alice is on a backpacking trip and is worried about her devices containing private keys getting stolen. She wants to store her bitcoins in such a way that they
can be redeemed via knowledge of a password P. Accordingly, she stores them in the following
ScriptPubKey address:

OP\_SHA256
<0xeb271cbcc2340d0b0e6212903e29f22e578ff69b>
OP\_EQUAL

1. Write a ScriptSig script that will successfully redeem this UTXO given the password P.
   Hint: it should only be one line long.
2. . Suppose Alice chooses a six character password P. Explain why her bitcoins can be stolen
   soon after her UTXO is posted to the blockchain. You may assume that computing SHA256
   of all six character passwords can be done in reasonable time.
3. Suppose Alice chooses a strong 30 character passphrase P. Is the ScriptPubKey above a
   secure way to protect her bitcoins? Why or why not?
   Hint: reason through what happens when she tries to redeem her bitcoins

My attempts/doubts:

1. The private key needs to be 256 bit number, I don't see how to connect this with ANY password P to obtain the ScriptSig composed of private and public key. Also should't the hashed version of the public key correspond to eb271cbcc2340d0b0e6212903e29f22e578ff69b?
2. Similar doubt as in 1)
3. Funds can be stolen by the node that sees the transaction?

**Tags:** private-key, script, public-key

> **Comments:**
> **username_1**: Your doubts regarding question 1 might well be a strong hint at the answer to question 3. :) Maybe this resource can help you answer the questions on your own: https://learnmeabitcoin.com/technical/script.  
> **username_2**: This is a "hashlock" contract, once the transaction that unlocks it is first broadcast, the miner can just take it for himself as there's no signature. https://en.bitcoin.it/wiki/Hashlock  
> **username_3**: This script is actually unspendable, because OP_SHA256 computes a 32-byte hash, but here it is compared to a 20-byte expected value, which will never match.  

---

## 0 answers

