11

From my knowledge the connection is not encrypted, but this doesn't hurt anything because the data that is exchanged is already public record. For example: the same information can also be found on Moneroblocks


10

ChaCha8; the key derivation is done with CryptoNight. https://github.com/monero-project/monero/blob/e06530e2d97a0a44f1f954b0d9a49e522e2ca74a/src/wallet/wallet2.cpp#L1362 Specifically note L1429 which calls https://github.com/monero-project/monero/blob/e06530e2d97a0a44f1f954b0d9a49e522e2ca74a/src/crypto/chacha8.c#L43


7

Your wallet.keys file should be perfectly safe in the cloud as long as your passphrase to unlock it remains secure. You are correct about the use of Chacha8 to protect the file. As long as the file remains encrypted, wallet.keys will not leak any data. Renaming it should not be a problem, but to be safe I would keep a backup of the original file (prior to ...


3

Blinding factors are random numbers that are only used once per commitment. No two commitments should ever share the same blinding factor, even if they're for the same amount. The blinding factor is generated by the sender and communicated to the receiver in encrypted form using the DH shared secret (as you've pointed out). If the existing commitments for ...


3

The scheme from the site is a good one and it won't be lost if you don't lose it :) But anyways, it's fairly simple to remember: hash the passphrase with CryptoNight and EC add it to the original seed. Even if lost, knowing the scheme, it could be reimplemented. This method has the benefit you seek - encrypted seed looking like any other. You could roll a ...


3

An AES round uses the three functions (SubBytes, ShiftRows and MixColumns). The Wikipedia article on AES has a high-level description of the algorithm and links to the AES standard, reference source code, etc.


3

According to its GitHub description: novault is a command-line utility and Python module for generating passwords and cryptocurrency wallets from a combination of a description and a master password. The description and master password are hashed, generating a pseudo-random seed which is then formatted as a password or wallet keys/address. There is no ...


3

There are no forbidden characters. However, you might have difficulty with characters such as \r and \n, since they're interpreted as "I'm done" when you type a string, and as terminator when reading from a file. $ works just fine (let me try right now just to double check... yes, it works). Interesting characters that might cause trouble are non ASCII ...


2

It's less about the security of the data moving across the connection than about the authentication of the remote server. When you have the TLS fingerprint for the pool server set up in your miner configuration, such as with XMR-STAK, then you can be assured that the pool is the same one as last time you connected, and nobody has hijacked the domain name or ...


2

I'm not qualified to answer this but I'll provide this in answer in the hopes that someone more qualified will step in. There is no reason why you shouldn't connect to a remote node, but any node you connect to (local or remote) should be your own, because you can trust your own nodes. In any case, if the node you are going to connect to is remote, you ...


2

Credit to @JollyMort the python base64 module can encode/decode the unsigned_tx file into ascii for transmission via QR code: import base64 ... ... with open(args.infile, "rb") as source: with open(bitPath, 'wb') as dest: dest.write(base64.b64encode(source.read())) <transmit sliced up bitpath file via qr codes as is now ASCII> <on ...


2

No, the wallet does not provide the remote node with the view keys. I think you are confusing this with the web wallet MyMonero which requires the view key. The only thing that the remote node will know about you is your IP Address. Edit: The remote node will also know what are your mixins, so best to keep changing remote nodes. Edit: To answer your ...


1

Your wallet password is local to the wallet. It's not sent to the daemon, which never gets hold of that, nor the wallet keys. Using Tor, information is encrypted between your own tor daemon (though if you're going to use a third party Monero daemon, you might be using a third party Tor daemon, which is even worse) and the destination hidden service, so any ...


1

The SSL code you refer to is only used by the Sumokoin Android wallet. It's not hooked anywhere else yet and I'm not aware of any plans to do so. Source: I made that change


1

Monero does not implement SSL in the RPC but it's super simple to enable if you really want to open up a remote node with encrypted communication. Some options are: Connect via an SSH tunnel Proxy an SSL enabled Apache/Nginx vhost Use stunnel


1

Wallet passwords are never stored on your computer. They're used at the time of input to derive the encryption key which is then used to decrypt your actual wallet data. Deriving the key from the password is done with CryptoNight. The encryption of wallet data (using the derived key) is done with ChaCha8. More details can be found here.


Only top voted, non community-wiki answers of a minimum length are eligible