OSC-2026-0016 · github.com/diybitcoinhardware/embit
low inconclusive grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/diybitcoinhardware/embit
- Commit
- fff7ffa43f6ce088c5ba22cb3877a122bf01dc96
- Scope path
- src/embit/util/
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/entropy-rng-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- e463ecf5a808d0a77e9ecdb27c2e65b3038171249ecabd7650ab79f04a9b4e55
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent Grok re-audit of ECDSA nonce generation and secp256k1 backend selection in embit at fff7ffa4. In scope: native/ctypes/pure-Python backends, low-R grinding, RFC6979, silent backend fallback. NOT: PSBT, descriptors, Liquid, slip39, libsecp256k1 C correctness, caller-supplied seed entropy. Cross-model counterpart to OSC-2026-0004.
Findings
low OSC-2026-0016-F1 unreviewed
ECDSA nonces remain RFC6979-style on every backend (ctypes uses libsecp256k1 default; pure-Python uses deterministic_k in key.py). Low-R grinding re-signs with counter extra_data. No nonce bias finding. Defense-in-depth note: backend selection in util/secp256k1.py uses bare except fallback from native → ctypes → pure-Python with no log/API flag, so callers cannot tell when the non-constant-time pure-Python path is active. Severity low for nonce uniqueness; side-channel threat model would rate higher. Does not change the core none-found for weak-nonce class that OSC-2026-0004 reported.