Public contributions

in Open source projects and elsewhere.. Nothing big, mostly small bits here and there.

• BitcoinJ:

  • Pull request, implemented support for message signing/verifying with Segwit addresses: https://github.com/bitcoinj/bitcoinj/pull/2657
  • Pull request, add documentation explaining recId in prefix byte of bitcoin message signing signatures ("CompactSignature" format), realizing that I will never see a recId of 2 or 3 in my life time: https://github.com/bitcoinj/bitcoinj/pull/3361
  • Pull request, adding length check for Taproot address witness program length (including rationale why): https://github.com/bitcoinj/bitcoinj/pull/2663

• Satoshi-Engineering / dart-bitcoin-message-signer:

  • Issue, found and pinpointed a bug in the signing library, sometimes producing invalid signatures: https://github.com/Satoshi-Engineering/dart-bitcoin-message-signer/issues/1

• Rust BDK / rust-electrum-client:

  • Issue comment, provided data pinpointing the bug (using wireshark and some debug statements): https://github.com/bitcoindevkit/rust-electrum-client/issues/75#issuecomment-2332617669

• Bitcoin Optech Newsletter:

  • Review comment about BIP 16 activation logic and also Taproot (active since Genesis, only exempting the one single violating block hash): https://github.com/bitcoinops/bitcoinops.github.io/pull/935#discussion_r1030052483

• Grin (Mimblewimble implementation):

  • Pull request, adding documentation, explaining Switch committments: https://github.com/mimblewimble/grin/pull/2526. (Here the committed text: Introduction to Switch Commitments)

• rust-secp256k1-zkp:

  • Pull request and discussion: adding documentation and steps for verifying the NUMS character of generator point for the Pedersen commitment: https://github.com/mimblewimble/rust-secp256k1-zkp/pull/42

• Electrum Wallet:

  • Pull request, Bugfix, Save wallet DB after adding payment: https://github.com/spesmilo/electrum/pull/6435
  • Issue, regression bug, config parameter no longer working: https://github.com/spesmilo/electrum/issues/8693
  • Issue, make max message size configurable for poweruser, so that they can tune their own setup (server + client): https://github.com/spesmilo/electrum/issues/4315#issuecomment-698730778

• LNURL / LUDs Repo:

  • Issue, wallet must not send invoice with tag h (hash): https://github.com/lnurl/luds/issues/206

• "Falsehoods Programmers Believe About Bitcoin" list:

  • Some commits, adding some entries into the awesome "Falsehoods Programmers Believe About Bitcoin" list: https://github.com/theborakompanioni/bitcoin-spring-boot-starter/commits?author=johnzweng&since=2021-01-31&until=2021-02-28

• Check credit card RSA keys for ROCA vulnerability (own hobby project, Android)

  • Originated from my wish to understand the encoding of (public) keys in the EMV cards (payment smartcards). When the ROCA vulnerability was published I used this as motivation to learn how to read the EMV keychain (and as a result this proof of concept app came into being): https://github.com/johnzweng/android-emv-key-test

• Other cryptography stuff and fun:

  • Gist, just for fun, showcasing a valid signature without private key: https://gist.github.com/johnzweng/6b2710b8484b14eab31e1a2bca14d13e
  • Gist, in SageMath, showing what all the generator points of the SEC-2 curve family have in common (the unknown mystery): https://gist.github.com/johnzweng/863f412689ee383cc41ac7c709ca662c (see also my comment here: https://bitcoin.stackexchange.com/a/113495/109728)
  • Reddit posting, for fun, an ECDSA riddle: a valid signature which cannot have been created from a private key (assuming security assumptions behind ECDSA hold): https://www.reddit.com/r/Bitcoin/comments/1g4fxbq/the_strange_case_of_a_signature_which_does_the/

• Bitcoin Stack Exchange:

  • Comment, adding infos about generator G in secp256k1 and the whole SEC-2 family in general: https://bitcoin.stackexchange.com/a/113495/109728
  • Comment, providing support and on how the calculate the missing part of a WIF private key: https://bitcoin.stackexchange.com/a/98956/109728

• Mycelium Wallet (back in 2014):

  • Pull request, import Schildbach wallet keys: https://github.com/mycelium-com/wallet-android/pull/78
  • Pull request, import keys from protobuf export format: https://github.com/mycelium-com/wallet-android/pull/82
  • Commit, improve detection of compressed/uncompressed key: https://github.com/mycelium-com/wallet-android/commit/0ed8b92846fe0955177924aeedfc24310d71ac2c
  • My name is still mentioned in the README.md

• NicolasDorier/docker-bitcoin repo:

  • Pull request, adding Docker image for new Bitocin core 0.21.0 release:: https://github.com/NicolasDorier/docker-bitcoin/pull/32
  • Pull request, adding Docker image for Bitcoin Core 23.0 and 24.0.1 https://github.com/NicolasDorier/docker-bitcoin/pull/37

• General Bytes (Bitcoin ATM manufacturer):

  • Pull request, adding missing dummy implementation for exchange with Bitcoin Lightning support, to enable easier on machine testing with Bitcoin Lightning: https://github.com/GENERALBYTESCOM/batm_public/pull/759
  • Pull request, security fix: TLS cert pinning was not really pinning (General Bytes Bitcoin ATMs): https://github.com/GENERALBYTESCOM/batm_public/pull/448
  • Pull request, fixing infura ETH wallet implemantion to return txid immediately https://github.com/GENERALBYTESCOM/batm_public/pull/760
  • Several other security issues adhering responsible disclosure principles.

• Some of my public talks:

  • 2018: Talk at Blockchain Hub Graz meetup, explaining atomic swaps: https://johannes.zweng.at/presentations/2018/atomic_swaps_BCHGraz/
  • 2021: Talk about Schorr signatures in Taproot at 77th Bitcoin Austria meetup: https://x.com/coinfinity/status/1425453157182853120 (unfortunately not online)

• Ethereum, Batch sending (own project, just for learning and proof of concept):

  • Learning EVM OP-Codes, realizing there is (was) a way to send ETH transactions to EOA (external owned accounts) using less than 21000 gas, using batching, just proof of concept: https://github.com/johnzweng/eth-batch-sender

• And some stuff on Twitter (X):

  • Fun: :-) ECDSA riddle: a signed message that proves that I cannot know the private key (assuming the security assumptions of ECDSA hold): https://x.com/wauzibauzi/status/1845383574846906646
  • Bitcoin Testnet Block Storm explained: https://x.com/wauzibauzi/status/1785319790820675587
  • How much you save when DCA'ing onto different address script types (P2PKH, segwot, taproot): https://x.com/wauzibauzi/status/1737056480149328369
  • TIL Nonce reusage between signature schemes (ECDSA, Schnorr) also is deadly: https://x.com/wauzibauzi/status/1621399577050898433
  • Difficulty adjustment off-by-one error explained: https://x.com/wauzibauzi/status/1600021414186143745
  • Taproot shilling by listing some of its cool features :) https://x.com/wauzibauzi/status/1457679731785142276
  • Shellscript for Bitcoin node to follow Taproot activation signalling: https://x.com/wauzibauzi/status/1403298159489585161 and https://x.com/wauzibauzi/status/1404316462764941314
  • 2019: As lots of bla bla is everywhere about Libra (facebook coin), I looked into the code and wrote a very short technical summary for engineers: https://x.com/wauzibauzi/status/1141329611936161793
  • Looked into Copay wallet hack by malicious dependency: https://x.com/wauzibauzi/status/1067347440393773056