3 ms·

There is: rejection sampling means that you don't ruin uniformity but your key space necessarily shrinks. As a thought experiment, imagine if you fixed all but

by madars 5y ago

There is: rejection sampling means that you don't ruin uniformity but your key space necessarily shrinks. As a thought experiment, imagine if you fixed all but the last hex digit of the public key to be your favorite string -- there are at most 16 private keys that could achieve that. We don't have fast ways to generate vanity addresses (just brute force with exponential complexity in the length of the fixed bits) so in practice entropy loss is minimal and cryptographically non-concerning.

daneel_w 5y ago
Which is the crux of it all - there's no way to optimize the search of the key space to generate only keys that already have a set prefix. Rejection sampling can target anything, no matter if someone (or some dictionary) applies a meaning to the specified sequence. As another thought experiment, imagine using a true random source to generate a BTC priv key whose base58-represented P2PK address happened to spell out "1money". Would it be less entropic than if it were on purpose searched for and found using e.g. VanityGen? Or less entropic than some random characters like "1trwm"? Certainly not. By a total coincidence the word "trwm" is Welsh for "heavy".