Bitcoin Developers Propose Deterministic Signing to Expose Wallets That Leak Keys

BIP461 would fix one signature per key and message, letting a holder sign on two devices and compare, turning covert key exfiltration through nonce choice into a detectable mismatch.

A Bitcoin Improvement Proposal numbered 461 would standardize a single deterministic signing algorithm for ECDSA (the Elliptic Curve Digital Signature Algorithm), the signature scheme used by pre-Taproot bitcoin addresses, so that a given private key and message always produce exactly the same signature. The specification derives the nonce using RFC 6979, selects a low r value, and normalizes s to its low form.

The security argument is narrow and precise. Under current rules, a signer has freedom in two places: the nonce it picks, and which of two valid s values it returns. A malicious or backdoored signing device can use that freedom as a covert channel, encoding fragments of the private key inside signatures that look entirely valid on chain, a technique published as Dark Skippy. Removing that freedom closes the channel, because a holder can load the same seed into two independent signers, sign an identical message, and compare the results byte for byte. Any difference proves at least one device is not following the specification.

The proposal does not prove malice. A mismatch tells a holder that a device deviates from the standard, not why, and the comparison only works for holders who own two independent signers and take the time to run the test. The proposal also has a side benefit: shorter signatures, at most 70 bytes when encoded in the standard format (DER) instead of 72, which slightly reduces transaction weight across the large installed base of ECDSA spending. Developers are debating the tradeoffs in the usual developer forums and in the Bitcoin Optech review of recent proposals.

The deeper change is to trust structure. Hardware wallets ask users to accept a closed device as the guardian of a secret. Determinism makes that trust checkable without opening the device or reverse-engineering its firmware, a meaningful shift for a self-custody industry that has experienced several entropy and firmware defects in recent years.

What this means

The mechanism is removing optional randomness from a signing algorithm so that a device's behavior becomes reproducible and therefore testable. The exposed parties are hardware-wallet vendors, whose claims about firmware integrity become checkable by any customer with two devices. Vendors that already use RFC 6979 gain a compliance checkbox at no cost, while vendors that deviate face a cheap public test. This is a standards process, not a consensus change, so adoption depends on wallet and library maintainers rather than on miners. The precedent is the earlier migration to low-s and low-r signing, which spread through wallet software without any fork once the benefits were clear. The desk's read: BIP461 moves through review and into major signing libraries over the coming months, and cross-device signature comparison becomes a standard check in custody audits, one of the few mechanisms that can slow the movement of risk-averse holders from self-custody toward exchange-traded products and custodians. If major vendors decline to commit to a single deterministic scheme, the comparison test stays theoretical and the proposal's practical effect is limited to the signature-size savings.

Part of a tracked trend

Implementation Bugs, Not Just Exploits, Threaten Custody

Cryptographic implementation errors in wallets and signers (biased nonces, reused randomness, faulty derivation) keep surfacing as a distinct custody risk alongside smart-contract exploits, eroding the assumption that certified hardware protects keys.

Townsquare

Start a discussion in Townsquare.

Comments

No comments yet.