<h2>Bitcoin core weaknesses?</h2>

<p>Bitcoin core wallet encryption uses AES-256-CBC. So far as I know this is still regarded as a good encryption system although people have identified potential <a href="https://blog.cloudflare.com/padding-oracles-and-the-decline-of-cbc-mode-ciphersuites/" rel="nofollow noreferrer">issues with cipher-block-chaining (CBC)</a></p>

<p>Other likely weaknesses might include</p>

<ul>
<li>Poor implementation in Bitcoin core.</li>
<li>Poor choice of passwords/passphrases by the end-user.</li>
<li>Poor protection against snooping of in-memory keys etc by Bitcoin core or the OS.</li>
<li>etc </li>
</ul>

<p>I don't recall any major issue being reported so far. There are currently 0 <a href="https://github.com/bitcoin/bitcoin/security/advisories" rel="nofollow noreferrer">security advisories</a>. A quick scan of previous <a href="https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" rel="nofollow noreferrer">common vulnerabilities</a> for wallet related vulnerabilities doesn't find anything.</p>

<p>A careful study of the <a href="https://bitcoin.org/en/version-history" rel="nofollow noreferrer">release-notes</a> or even change-logs for Bitcoin core might reveal the fixing of an exploitable weakness. A careful web-search might throw something up. I haven't found anything but have not spent any time on this.</p>

<h2>Trezor weaknesses</h2>

<p><a href="https://news.bitcoin.com/ledger-reveals-physical-exploits-against-trezor-hardware-wallets/" rel="nofollow noreferrer">Published weaknesses</a> include</p>

<ul>
<li>weak proof of genuineness with respect to cloning etc.</li>
<li><a href="https://blog.trezor.io/details-of-security-updates-for-trezor-one-firmware-1-8-0-and-trezor-model-t-firmware-2-1-0-408e59dc012" rel="nofollow noreferrer">side-channel attack</a> by measuring power consumption during PIN entry.</li>
<li>extracting private key or seed from flash memory ICs</li>
</ul>

<p>These require physical access to the device.</p>

<p>These don't really translate well into possible attacks against bitcoin core.</p>

<hr>

<p>If you run bitcoin core on a PC say, and an attacker gets physical access to your PC, your security is probably gone. </p>

<p>If I had bitcoin core on a PC and suspected someone malicious had had physical access to it, I'd burn the PC and everything it touched, buy a new PC and recreate the wallet from offline backups, then transfer all remaining funds to yet another new/fresh/clean wallet or wallets.</p>

CC BY-SA 4.0
2019-06-18T13:10:10.623Z
2019-06-18T13:28:48.670Z
2019-06-18T13:28:48.670Z
RedGrittyBrick
<p>Every few years there seems to be an exploit found in Trezor that allows people to bypass the security. I was wondering has there every been the same case for Bitcoin Core wallet encryption?</p>

<bitcoin-core><encryption><trezor>
Has Bitcoin Cores encryption wallet security ever been bypassable?
Toodarday
# Has Bitcoin Cores encryption wallet security ever been bypassable?

(Asked by: username_0 on 2019-06-17)

Every few years there seems to be an exploit found in Trezor that allows people to bypass the security. I was wondering has there every been the same case for Bitcoin Core wallet encryption?

**Tags:** bitcoin-core, encryption, trezor


---

## 1 answers

### Answer by username_1 on 2019-06-18. Score: 0 | Accepted answer

## Bitcoin core weaknesses?

Bitcoin core wallet encryption uses AES-256-CBC. So far as I know this is still regarded as a good encryption system although people have identified potential [issues with cipher-block-chaining (CBC)](https://blog.cloudflare.com/padding-oracles-and-the-decline-of-cbc-mode-ciphersuites/)

Other likely weaknesses might include

* Poor implementation in Bitcoin core.
* Poor choice of passwords/passphrases by the end-user.
* Poor protection against snooping of in-memory keys etc by Bitcoin core or the OS.
* etc

I don't recall any major issue being reported so far. There are currently 0 [security advisories](https://github.com/bitcoin/bitcoin/security/advisories). A quick scan of previous [common vulnerabilities](https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures) for wallet related vulnerabilities doesn't find anything.

A careful study of the [release-notes](https://bitcoin.org/en/version-history) or even change-logs for Bitcoin core might reveal the fixing of an exploitable weakness. A careful web-search might throw something up. I haven't found anything but have not spent any time on this.

## Trezor weaknesses

[Published weaknesses](https://news.bitcoin.com/ledger-reveals-physical-exploits-against-trezor-hardware-wallets/) include

* weak proof of genuineness with respect to cloning etc.
* [side-channel attack](https://blog.trezor.io/details-of-security-updates-for-trezor-one-firmware-1-8-0-and-trezor-model-t-firmware-2-1-0-408e59dc012) by measuring power consumption during PIN entry.
* extracting private key or seed from flash memory ICs

These require physical access to the device.

These don't really translate well into possible attacks against bitcoin core.

---

If you run bitcoin core on a PC say, and an attacker gets physical access to your PC, your security is probably gone.

If I had bitcoin core on a PC and suspected someone malicious had had physical access to it, I'd burn the PC and everything it touched, buy a new PC and recreate the wallet from offline backups, then transfer all remaining funds to yet another new/fresh/clean wallet or wallets.


---

