Some scenarios have our descendents mining landfill dumps for metals and other resources (hell, they do it right now in some less developed countries), so perhaps they'll be keeping a special look out for hard drives and other computer equipment.

Bitcoin mining, the term comes full circle! 

I think the answer to that has to be no. One convention is to use SHA256 (both bitaddress.org and brainwallet.org use this) but there is nothing stopping another site from using some other algorithm (for instance SHA256d, or including some salt).

As mentioned above, you're far better off using a deterministic wallet like electrum and saving the 12-word passphrase. Write it down (for your own sake, or for your beneficiaries in case the worst should happen, lost/forgotten passwords are far more risk than stolen ones) and keep it in a safe place or better, several.

And a general comment. Brainwallets are NOT safe for newbies to use, have a read of this thread https://bitcointalk.org/index.php?topic=251037.0

Those "minimum feature size" numbers have long ceased to have any real physical meaning and are now just marketing terms for the "next generation" of fabrication process. Moore's law is just about on its last gasp (at least for traditional silicon) and the enormous cost of new fab plant is going to bring it to a crashing halt in the very near future.

Puts away xtal-ball, waits for howls of anguish. Its just my 2c anyway.

Be careful with brain wallets. You need a strong passphrase or else your coin is at risk of being stolen by hackers. Strong passphrases are not easy to create (and even more difficult to remember without writing them down, which effectively makes it a paper wallet too).

Have a read of this thread https://bitcointalk.org/index.php?topic=251037.0

I gave you the link to the thread, if you'd read it you'd have found this link https://bitcointalk.org/index.php?topic=84569.0 which explains the process reasonably clearly (it relies on the properties of the ECDSA addition operation as regards private keys and their generated public keys, not being a math guru I can't explain it myself).

I find the ECDSA code in JackJack's Pywallet to be the easiest to follow, so you may want to start there, though it does not implement the split-key algorithm. You'll need to look at the vanitygen source for that (which I find quite difficult to follow) or the javascript in bitaddress.org.

That functionality is intended for vanity key "farms" that calculate private keys as a service. The key combination ensures the generated key is known only by the client and not the service.

I was involved in a short discussion on this a while back so I'll link the thread https://bitcointalk.org/index.php?topic=268567.0 in case its of any use to you.

You most definitely do not want to import "correct horse battery staple". I'm not going to tempt fate by including the actual address. If your curiosity gets the better of you, then you've only yourself to blame for the resulting snafu.

Depending on what you want to do with this, you could consider Shamir's secret sharing. It does rely on third party software, but there is an open source thread at https://bitcointalk.org/index.php?topic=142875.0 and also some discussion at https://bitcointalk.org/index.php?topic=148809.0

Possibly, but IMHO about the wrong things. The weakest link in your reasoning is your memory. Many things could happen yo you (short of death itself) that compromise your memory. A mere blow to the head could suffice to cause sufficient brain damage to render your memory unreliable.

Brainwallets sound like a nice easy concept, but it is very hard to do this properly. DannyHamilton has given very good advice upthread. You really need to do the research to understand why this is so.

For example you have commented several times that you can do an offline transaction to transfer bitcoin without exposing your public keys. This shows ignorance of the workings of the bitcoin transaction mechanism. You have to broadcast that offline transaction to the network for it to take effect. At that point you have also exposed your public key since its an integral part of the transaction.

If you do decide to use brainwallet.org you need not worry about the website breaking down or becoming unavailable. That particular brainwallet simply uses a single sha256 hash of the passphrase to generate the private key. Any competent programmer can replicate that for you. But unless your awesome brainwallet scheme includes at least 192 bits of truly random entropy it will be less secure than a key generated by bitcoin-qt itself.

My advice. Use an officially supported wallet. Choose a good passphrase, write it down and lock it away in a safe or perhaps give it to your lawyers for safekeeping (being sure to advise them not to copy or expose it). Backup your wallet and keep copies in several safe places. Your biggest risk is relying on your memory alone.

An interesting discussion at https://bitcointalk.org/index.php?topic=121264 regarding AES, but it applies equally to SHA256.

The link to http://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html gives the energy calculations, though these are for a 192 bit hash. 256 bits is 18446744073709551616 (18 quintillion 446 quadrillion 744 trillion 73 billion 709 million 551 thousand 616)  times harder.

Just to be pedantic here, I can think of one way that is completely firewalled. You build your own computer using old-skool pre-internet technology (or just dig out that old ZX-Spectrum from the attic) to be sure there are no NSA infected parts inside, code up your own address generator from scratch (I take it you're allowed to refer to the online wallet code and algorithm documentation, perhaps print it out at your local library), make a nice hot cup of tea (it will make a good source of entropy for your hardware RNG), then Bob's your maiden aunt. 

Indeed. 2^256 is an unimaginably huge number 115 quattuorvigintillion 792 trevigintillion 89 duovigintillion 237 unvigintillion 316 vigintillion 195 novemdecillion 423 octodecillion 570 septendecillion 985 sexdecillion 8 quindecillion 687 quattuordecillion 907 tredecillion 853 duodecillion 269 undecillion 984 decillion 665 nonillion 640 octillion 564 septillion 39 sextillion 457 quintillion 584 quadrillion 7 trillion 913 billion 129 million 639 thousand 936 (according to wolfram alpha). It would take more energy than the  sun outputs in its entire lifetime just to count this number (with a computer of theoretical maximum efficiency). Nice try.

bitaddress.org - yes, though if paranoid download from https://github.com/pointbiz/bitaddress.org and use it offline.

brainwallet.org  - no brainwallets are not for newbies. Its far too easy to choose a bad passphrase (basically anything you can google that will come back with a hit, or any simple variation of said). There are crooks out there generating rainbow tables of all conceivable passphrases and the first you'll know of it is when your coin is stolen.

No: Bitcoin exist on the blockchain. A wallet simply stores the keys needed to authorise a transaction moving that coin to another address. You can import the keys into multiple wallets, any of which can then spend that coin (but only one spend, ever).

Yes

Yes

Finally: Bitcoin is moved via a transaction in which the "owner" authorises the transfer by signing with the private key associated with the address. The destination address merely needs to exist, there is no requirement for its private key to be known. The transferred bitcoin will remain at the new address until another transaction is signed using a valid private key. If the private key is lost (or was never known in the first place since destination addresses can be created without knowing the private key, eg 1BitcoinEaterAddressDontSendf59kuE), then the bitcoin is unspendable, lost for eternity.

If you mean that you could generate an offline key that corresponds to an already existing address, then that is just astronomically unlikely (the address space is 2^160 which is just a vastly huge number). The only way this could happen is if you are using a seriously broken random number generator, or a brain wallet (just don't go there, you will lose your coin unless you know exactly what you are doing).

And props to anyone who manages to convert a private key to an address using just pen and paper. Possible, yes, but the process is so mind-numbingly intricate that the chances of getting it right without making a mistake along the way are pretty tiny.

Just for LOLs, a link to my very first post where I do indeed generate the private key to existing address 1EHNa6Q4Jz2uvNExL497mE43ikXhwF6kZm (its 1 by the way).

You should edit your first post and include a link to your main thread https://bitcointalk.org/index.php?topic=317730.0

More info on SSS for newbies at the genesisblock article and also here

Why have you posted this? Is it a challenge? And why necro an ancient thread, in newbie land to boot?

Instead I'll add some useful information for newbies ...

DO NOT USE A BRAINWALLET - IT IS NOT A SAFE WAY TO STORE YOUR BITCOIN

Of course this oversimplifies, but unless you understand exactly how the concept of entropy applies to key selection (and brainwallets in particular), then you've only yourself to blame when somebody steals your coins.

And yeah, electrum may well be secure, but its not what's being talked about here.

And its actually pretty close to the subject of the very first question I asked on this forum ...

bitaddress.org lets you input a hexadecimal private key, and trying some different values (including all FFFF and all 0000) I thought I'd found a collision. It actually turned out that all 0000 broke the (bitaddress.org) algorithm and just returned the same key as the previous try. But further playing confirmed that the key values do wrap around at the n value (at least in the sense of generating the same public key value, and hence address, from the private key). This is also the case with the  version of the ECDSA algorithm used by pywallet. As for bitcoin-qt, I'll leave it to the developers to comment as I haven't got my head around that code yet.

Oh, and some advice. Don't use SHA256 for your brainwallet. Far too many crooks generating rainbow tables and sweeping transactions. If you must, then at the very least use some sort of salt to make their job harder.

Perhaps, but at a whole hour long we could do with a TL;DR summary.

Anyway my understanding (without watching the video yet) was that FTL communication would break way too much physics (allowing both time travel and causality violation). If it were invented the universe would probably instantly disappear in a puff of infinite improbability.

And this is an ideal point to link to The goddamn airplane on the goddamn treadmill