A proposed Bitcoin improvement, BIP461, aims to simplify the detection of concealed pathways that leak wallet secrets. The draft outlines a standardized signing method for ECDSA, which is a current Bitcoin signature scheme.
When using independent compliant signers with the same secret key and message hash, the output signatures should match exactly. This consistency establishes a baseline to help spot divergences that might mask the leakage of keys.
Liam Gilligan authored the proposal, which was added to the BIPs repository on Sept. 16 and currently holds Draft status. Because its signatures function within current Bitcoin consensus rules, adopting this signing approach does not necessitate any changes to consensus.
Comparing signatures for deviations
When generating a valid signature, ECDSA grants the signer multiple options, such as choosing the nonce, which is a temporary signing value. Compromised firmware can abuse this flexibility to embed private key data inside signatures that continue to pass verification. BIP461 eliminates this variability by enforcing a deterministic process.
The fact that Bitcoin accepts a signature does not guarantee that the key remained secure during its creation. Having a uniform standard provides an expected result against which a signer’s actions can be evaluated.
To perform this comparison, one needs identical inputs, the exact same standard, and access to the secret key using a separate independent signer. This additional exposure represents a practical drawback of replicating the signature. If the outputs differ for the same key and message hash, it proves that at least one of the signers is failing to adhere to BIP461.
An honest system running a different valid ECDSA process may also produce a disagreement. While a mismatch calls for an audit of compliance, the root cause is not immediately clear, and the comparison by itself cannot pinpoint a malicious device or prove that theft occurred.
The mandated algorithm also caps signatures at 70 bytes when using standard DER encoding, not counting Bitcoin’s single-byte sighash flag.
The Dark Skippy disclosure highlighted how compromised firmware can smuggle seed information into transaction signatures. During their initial disclosure, the researchers noted they had not observed this method being used in the wild.
While the original Dark Skippy demonstration relies on Schnorr signing, BIP461 focuses on ECDSA. Because Taproot employs the distinct BIP340 Schnorr framework, the draft does not directly provide a standardized fix for that specific proof of concept.
In their discussion on mitigations, the researchers cautioned that a malicious signer might leak data on a single chosen transaction, allowing a device to generate fully compliant signatures during testing before leaking on a separate transaction.
When the proposal was merged in September, a reviewer noted that BIP461 requires both test vectors and a reference implementation before it can move to Complete status.
For wallet users, the main benefit is a unified reference point that can expose irregularities. Realizing that benefit, however, relies on compliant software and thorough comparisons that take into account both detection boundaries and the security hazards of exposing private keys.