4 ms·

Considering that each key can be generated deterministically from a seed key and the seed keys are not infinite… it’s only a matter of time (millions of years c

Considering that each key can be generated deterministically from a seed key and the seed keys are not infinite… it’s only a matter of time (millions of years compute time with current technology, and not out of reach for state actors who can spend infinite money to run that much compute in a matter of weeks) until every wallet is accessible by anyone who knows the address. Bitcoin isn’t that safe to hold value in, if you might be targeted by someone with brains and money.

posnet 3y ago
Just for fun, because it's hard to appreciate how strong a 256bit ECDSA key is. Base Numbers: - 2*128 guesses on average - public state of the art for ECDSA on an FPGA is 1315tps [0] - retail price of said fpga $10,000 [1] - total net income for xilinx from advanced FPGAs FY2022 (936M * 0.74 + 879M * 0.72) = 1325M [2] Ballpark numbers, we'll assume that attacker can buy 10x every FPGA xilinx made in 2022 for a 50% discount and can run them non stop for zero cost. We'll also assume they have a bunch of secret math geniuses and have a faster ECDSA implementation that can do 1,000,000,000 tps ( or 1,000,000x SOTA) - (1325,000,000 / 5,000) * 10 = 2,650,000 FPGAs - 2,650,000 * 100,000,000,000 = 2,650,000,000,000,000tps - 2*128 / 2,650,000,000,000,000 = 1.28e+23s - 1.28e+24 / 60 / 60 / 24 / 365 = 4,080,000,000,000,000 years - ~4 quadrillion years - or 4x the time until every planet has been ejected from every star system and the sun has cooled to 5K [3] But why stop there, lets assume that the attacker can use the entire planets GDP to buy chips and has a 1,000,000,000,000,000x faster ECDSA implementation. - World GDP (2022): 101.3 trillion - (101,300,000,000,000 / 5000) = 20,260,000,000 - 100,000,000,000,000,000 * 20,260,000,000 = 2.66419e+28tps - 2*128 / 2.66419e+28 = 12,772,451,173s - 12,772,451,173 / 60 / 60 / 24 / 365 = 405 years So even then, we wouldn't see a single BTC key broken within our lifetime. (Unless you believe that 3 letter agencies have successfully built a quantum computer that practically implement shore's algorithm, in which case you should probably be more worried about the fact that they can break public key encryption globally) [0]: https://arxiv.org/pdf/2112.02229.pdf https://arxiv.org/pdf/2112.02229.pdf [1]: https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=3664&idcategory=6 https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=... [2]: https://web.archive.org/web/20211203065624/https://investor.xilinx.com/node/18856/pdf https://web.archive.org/web/20211203065624/https://investor.... [3]: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future
- withinboredom 3y ago
  I don't think you understand what I mean. I'm not talking about cracking a key. I'm talking about creating a key from seed 0, then 1, then 2, etc. etc., until you have an index of every possible key. Then, since you know every possible public key ... it's just a matter of looking up its private key in the index. HOWEVER, I was off by a few magnitudes on how big the seed numbers get. If you are curious, this is basically the biggest seed number: 904,625,697,166,532,776,746,648,320,380,374,280,100,293,470,930,272,690,489,102,837,043,110,636,675 ... or 904 trevigintillion (thanks wolfram alpha!) So, yeah, it's not happening anytime soon, though it doesn't invalidate the premise, just changes the timeline to unachievable with current technology. Technology could improve to the point where it is feasible in a human lifetime.
  - 01HNNWZ0MV43FF 3y ago
    It would require a break through in quantum stuff, or new laws of physics to produce a 256 bit rainbow table, right? "Computers made of something other than matter and occupying something other than space" https://security.stackexchange.com/a/25392 https://security.stackexchange.com/a/25392
    - withinboredom 3y ago
      Or ... just generate a few here and there, and eventually, you'll find something. Looks like https://keys.lol https://keys.lol is an example of just that.
  - yau8edq12i 3y ago
    Where and how do you store your "index"? The number you wrote is multiple orders of magnitude higher than the number of atoms on Earth. It's not simply "not happening any time soon". It's physically impossible.
    - withinboredom 3y ago
      Good point :) Edit to add: just found https://keys.lol https://keys.lol that does exactly this, but generates a few dozen at a time and doesn't store the results.
Retr0id 3y ago
This is simply not true.
- postalrat 3y ago
  It is but probably though new math and not faster machines.
- lyu07282 3y ago
  It reminds me a bit of when people worry about collisions in random uuids
  - Retr0id 3y ago
    Those are more subtle, and often well-founded, due to the birthday paradox.
    - Retr0id 3y ago
      (and sometimes weak entropy sources)
  - Zigurd 3y ago
    I once had to convince someone much smarter than me that UUID collisions (for a messaging system we were developing) would not happen. It was a surreal experience.
    - a1369209993 3y ago
      Are you sure they were talking about UUID collisions in a idealized/theoretical system? If you generate UUIDs using, for example, a random number generator with only a 16-bit seed, you absolutely will see collisions, for much the same reasons as in TFA.
      - extraduder_ire 3y ago
        I am regularly concerned about using UUIDs in a public-facing way, since that would encourage people to make "vanity" UUIDs somehow. Requiring some kind of value to be hashed to create the UUID would sidestep this a little.

posnet 3y ago

Just for fun, because it's hard to appreciate how strong a 256bit ECDSA key is. Base Numbers: - 2*128 guesses on average - public state of the art for ECDSA on an FPGA is 1315tps [0] - retail price of said fpga $10,000 [1] - total net income for xilinx from advanced FPGAs FY2022 (936M * 0.74 + 879M * 0.72) = 1325M [2] Ballpark numbers, we'll assume that attacker can buy 10x every FPGA xilinx made in 2022 for a 50% discount and can run them non stop for zero cost. We'll also assume they have a bunch of secret math geniuses and have a faster ECDSA implementation that can do 1,000,000,000 tps ( or 1,000,000x SOTA) - (1325,000,000 / 5,000) * 10 = 2,650,000 FPGAs - 2,650,000 * 100,000,000,000 = 2,650,000,000,000,000tps - 2*128 / 2,650,000,000,000,000 = 1.28e+23s - 1.28e+24 / 60 / 60 / 24 / 365 = 4,080,000,000,000,000 years - ~4 quadrillion years - or 4x the time until every planet has been ejected from every star system and the sun has cooled to 5K [3] But why stop there, lets assume that the attacker can use the entire planets GDP to buy chips and has a 1,000,000,000,000,000x faster ECDSA implementation. - World GDP (2022): 101.3 trillion - (101,300,000,000,000 / 5000) = 20,260,000,000 - 100,000,000,000,000,000 * 20,260,000,000 = 2.66419e+28tps - 2*128 / 2.66419e+28 = 12,772,451,173s - 12,772,451,173 / 60 / 60 / 24 / 365 = 405 years So even then, we wouldn't see a single BTC key broken within our lifetime. (Unless you believe that 3 letter agencies have successfully built a quantum computer that practically implement shore's algorithm, in which case you should probably be more worried about the fact that they can break public key encryption globally) [0]: https://arxiv.org/pdf/2112.02229.pdf https://arxiv.org/pdf/2112.02229.pdf [1]: https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=3664&idcategory=6 https://www.colfaxdirect.com/store/pc/viewPrd.asp?idproduct=... [2]: https://web.archive.org/web/20211203065624/https://investor.xilinx.com/node/18856/pdf https://web.archive.org/web/20211203065624/https://investor.... [3]: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future

withinboredom 3y ago
I don't think you understand what I mean. I'm not talking about cracking a key. I'm talking about creating a key from seed 0, then 1, then 2, etc. etc., until you have an index of every possible key. Then, since you know every possible public key ... it's just a matter of looking up its private key in the index. HOWEVER, I was off by a few magnitudes on how big the seed numbers get. If you are curious, this is basically the biggest seed number: 904,625,697,166,532,776,746,648,320,380,374,280,100,293,470,930,272,690,489,102,837,043,110,636,675 ... or 904 trevigintillion (thanks wolfram alpha!) So, yeah, it's not happening anytime soon, though it doesn't invalidate the premise, just changes the timeline to unachievable with current technology. Technology could improve to the point where it is feasible in a human lifetime.
- 01HNNWZ0MV43FF 3y ago
  It would require a break through in quantum stuff, or new laws of physics to produce a 256 bit rainbow table, right? "Computers made of something other than matter and occupying something other than space" https://security.stackexchange.com/a/25392 https://security.stackexchange.com/a/25392
  - withinboredom 3y ago
    Or ... just generate a few here and there, and eventually, you'll find something. Looks like https://keys.lol https://keys.lol is an example of just that.
- yau8edq12i 3y ago
  Where and how do you store your "index"? The number you wrote is multiple orders of magnitude higher than the number of atoms on Earth. It's not simply "not happening any time soon". It's physically impossible.
  - withinboredom 3y ago
    Good point :) Edit to add: just found https://keys.lol https://keys.lol that does exactly this, but generates a few dozen at a time and doesn't store the results.

Retr0id 3y ago

This is simply not true.

postalrat 3y ago
It is but probably though new math and not faster machines.
lyu07282 3y ago
It reminds me a bit of when people worry about collisions in random uuids
- Retr0id 3y ago
  Those are more subtle, and often well-founded, due to the birthday paradox.
  - Retr0id 3y ago
    (and sometimes weak entropy sources)
- Zigurd 3y ago
  I once had to convince someone much smarter than me that UUID collisions (for a messaging system we were developing) would not happen. It was a surreal experience.
  - a1369209993 3y ago
    Are you sure they were talking about UUID collisions in a idealized/theoretical system? If you generate UUIDs using, for example, a random number generator with only a 16-bit seed, you absolutely will see collisions, for much the same reasons as in TFA.
    - extraduder_ire 3y ago
      I am regularly concerned about using UUIDs in a public-facing way, since that would encourage people to make "vanity" UUIDs somehow. Requiring some kind of value to be hashed to create the UUID would sidestep this a little.