4 ms·
Small note, but 3,000 trillion is 3 quadrillion, not 3 quintillion. Which is their total, over a significant amount of time. The bitcoin network does over 3 qu
by SomeStupidPoint 10y ago
Small note, but 3,000 trillion is 3 quadrillion, not 3 quintillion. Which is their total, over a significant amount of time.
The bitcoin network does over 3 quintillion (>3,000,000 trillion) hashes a second. So even if they were doing a significantly harder to compute hash -- they're still only a very small part of the computational power the bitcoin network is using.
So it's probably already more effective to attack wallets than join a mining pool.
Ed: Estimate of numbers --
Assuming that their hashrate was over 3 months (article says nearly a year, but they're also scaling), they had about 300 million hashes per second. Bitcoin had 3 million trillion hashes per second over the same period. So you're talking 1 to 10 billion in raw hashrate, and even with a generous challenge factor, bitcoin is using millions of times more compute power.
There were about 150 thousand bitcoins mined over that period, so 1 in 10 billion of that is 0.000015BTC.
Since they hit 3 in use accounts with the same compute effort, they almost certainly made more BTC attacking wallets with collisions.
Ed2: How much parasitic hashing --
If you figure the average active wallet has between 1 and 5 BTC (very high variance), and the wallet hash takes about 100x as long (over estimate), they made 3-15BTC vs 0.015BTC by attacking the network versus mining, or about 200-1000x as much.
Since colliders are themselves unlikely to collide (and thus competition doesn't starve out colliders), the system will only stabilize if 99%+ of miners drop out of the pool or the difficulty in finding a collision raises 1000x.
Given the sunk costs in dedicated mining rigs and that new hashes would be breaking, it seems like parasitic hashing will continue to be an issue.
On the plus side, only a one-in-a-million chance it wipes one of your accounts.
(Of course, a fluke collision with a high value account might create other problems.)
- xseven 10y agoMulti-sig is the cure :)
- ryan-c 10y agoP2SH addresses can be brute forced several orders of magnitude faster than P2PKH. The attacker needs to generate 1-of-2 multisig scripts in the following form: OP_1 [compressed pubkey] [0x02, 29 random bytes, 3 byte counter] OP_2 OP_CHECKMULTISIG A new compressed pubkey must be generated every 2^24 iterations. You compute a sha256 midstate from the first 64 bytes, then restore and compute over the rest of the script for each subsequent iteration, then ripemd160 the output. Very easy to GPU accelerate. The slowest part of address generation is the elliptic curve math, and this avoids it entirely for most iterations, only needing to to refresh the public key when the counter rolls over.
- deleted 10y ago[deleted]
- m-j-fox 10y agoOh hi bitgo.
- csomar 10y ago> So it's probably already more effective to attack wallets than join a mining pool. That's not how you make the calculations. The reason the idea was called stupid is because the math doesn't add up. My guess is that these 3 private keys had weaknesses in them. Even the probability that they were found by "luck" is way far off. Given merge mining is possible, I'd assume with some tweaking side-colliding + mining is possible. So if it was profitable miners would already be doing it.
- SomeStupidPoint 10y agoI'm sorry, I'm not sure I understand your point: are you saying my math is off, given the claims of the article (ie, hashes computed, time spent, and compromises), or that the article is wrong because it's not that easy to crack? Google found a SHA-1 collision (160 bit hash, same size but different method) in 9 quintillion hashes (plus some crypto work). The article claims they found a collision against 3 of millions of targets in 3 quadrillion hashes (likely plus some crypto work). Given the birthday paradox, it's not a priori impossible. Could you explain why you don't believe their attack is mere hash collisions?
- ryan-c 10y agoThey're running a brute force preimage attack against all bitcoin addresses which currently have a balance. The reason they say "collision" is that if they found a key that hadn't been made weak on purpose, it would probably be a different key from the original (bitcoin addresses do not map 1-to-1 with keys).
- ryan-c 10y agoThe wallets they've found most likely were made with weak keys on purpose.