citb0in
|
|
October 08, 2023, 09:10:02 AM |
|
This is just something like scientific interest. I previously spent a lot of time and resources trying to solve puzzle 120 and I'm still curious about its key.
I understand what you wrote, but I don't understand the real interest. Let's assume this is the real key for the 120bit puzzle 9C15FC66A182003BB1BE5D1DF12CAB what did you gain from this insight other than the satisfaction of pure curiosity ?
|
. .HUGE. | | | | | | █▀▀▀▀ █ █ █ █ █ █ █ █ █ █ █ █▄▄▄▄ | ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ . CASINO & SPORTSBOOK ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ | ▀▀▀▀█ █ █ █ █ █ █ █ █ █ █ █ ▄▄▄▄█ | | |
|
|
|
|
|
"The nature of Bitcoin is such that once version 0.1 was released, the
core design was set in stone for the rest of its lifetime." -- Satoshi
|
|
|
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
|
|
|
_Counselor
Member
Offline
Activity: 107
Merit: 61
|
|
October 08, 2023, 09:21:31 AM |
|
I understand what you wrote, but I don't understand the real interest. Let's assume this is the real key for the 120bit puzzle 9C15FC66A182003BB1BE5D1DF12CAB what did you gain from this insight other than the satisfaction of pure curiosity ?
I don’t know what else to answer you other than what I already wrote. Anyway, as I wrote above, if anyone else besides me is still interested in finding out the key to 120 and still has kangaroo's workfiles for 120 puzzle with DP of 30 bits and above, please share them. Workfiles for 125 not interesting me, because I did not work on it.
|
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 08, 2023, 10:35:52 AM |
|
Thanks for the advice. I'll take a look at this code. I just installed 2048 interactions and the keys began to be generated for a very long time.
|
|
|
|
nomachine
Member
Offline
Activity: 264
Merit: 12
|
|
October 08, 2023, 10:49:11 AM Last edit: October 08, 2023, 12:01:22 PM by nomachine |
|
seed = random.getrandbits(128) seed_value = int(seed) random.seed(seed_value) seed = str(seed_value)
It's not even close to 128. The closest I've come up with 8 to 2 ** 65 30568377238562584866, b'\xc9\xd9\x1d\xbc\x16\x9d\xdb\x86' import random puzzle = 65 lower_range_limit = 2 ** (puzzle - 1) upper_range_limit = (2 ** puzzle) - 1 owner_salt = b'\xc9\xd9\x1d\xbc\x16\x9d\xdb\x86' random.seed(owner_salt) dec = random.randint(lower_range_limit, upper_range_limit) print(f"{dec}, {owner_salt}") but even so a part is missing to get a 100% accurate result. it seems most likely that pbkdf2_hmac was used hashlib.pbkdf2_hmac('sha512', os.urandom(8 ), b'', iterations=1024)[:32] some combination like this. https://docs.python.org/3/library/hashlib.html
|
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 08, 2023, 12:01:55 PM |
|
seed = random.getrandbits(128) seed_value = int(seed) random.seed(seed_value) seed = str(seed_value)
It's not even close to 128. The closest I've come up with 8 to 2 ** 65 30568377238562584866, b'\xc9\xd9\x1d\xbc\x16\x9d\xdb\x86' import random puzzle = 65 lower_range_limit = 2 ** (puzzle - 1) upper_range_limit = (2 ** puzzle) - 1 owner_salt = b'\xc9\xd9\x1d\xbc\x16\x9d\xdb\x86' random.seed(owner_salt) dec = random.randint(lower_range_limit, upper_range_limit) print(f"{dec}, {owner_salt}") but even so a part is missing to get a 100% accurate result. it seems most likely that pbkdf2_hmac was used hashlib.pbkdf2_hmac('sha512', os.urandom(8 ), b'', iterations=1024)[:32] some combination like this. In that code, the 512-bit key is normalized by division modulo % CURVE_ORDER from_arbitrary_size_secret() def normalize_secret_bytes(cls, privkey_bytes: bytes) -> bytes: scalar = string_to_number(privkey_bytes) % CURVE_ORDER if scalar == 0: raise Exception('invalid EC private key scalar: zero') privkey_32bytes = number_to_string(scalar, CURVE_ORDER) return privkey_32bytes
As the creator said, you need to trim the high bytes of the key with zeros!
|
|
|
|
EternityMessage
Newbie
Offline
Activity: 15
Merit: 0
|
|
October 08, 2023, 12:09:15 PM |
|
Is all this a robbery/steal/theft attempt?
After spending really too much time of my life trying different code and algorithms, buying and running loud hot hardware to solve #66 & #130 I started to wander about ethics of what I am trying to do ! OK, if I have a really really good luck, I will find the key after 1-2 more years! ... BUT !!! Do I have the right to take the coins in the address? ... The coins (the money) are not mine, and the owner (the assumed puzzle creator) never said that, if I brake the private key, I have the right to take the money !!! (Also the fact that the person has more money than us, does not give us the right to take his money!) So .. did I spent so much time of my life trying to become a thief? ... The assumption when I started was ... That is a challenge .. I can do my best .. BUT Do I have the moral right to get money assuming it is by the rules ? ... There are no official rules? We conveniently assume the owner intentions and are ready to get his money ... but what if we are wrong?
Mr./Mrs. Puzzle creator and puzzle addresses money owner, Please sign a message with any known non-broken puzzle address, and state your will! Are you fine, if money from these addresses are taken?" Or "you consider us thieves?" or ... (the signing #150, #155... public keys are already known and will not compromise security)
Thanks
|
|
|
|
nomachine
Member
Offline
Activity: 264
Merit: 12
|
|
October 08, 2023, 12:41:41 PM Last edit: October 08, 2023, 12:52:35 PM by nomachine |
|
As the creator said, you need to trim the high bytes of the key with zeros!
I think it's obvious that he has his own custom deterministic wallet. Based on an existing one or completely new one from scratch.
That said, I'm not sure it can sign a message with that tool.
|
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 08, 2023, 01:33:45 PM Last edit: October 08, 2023, 02:05:59 PM by alek76 |
|
As the creator said, you need to trim the high bytes of the key with zeros!
I think it's obvious that he has his own custom deterministic wallet. Based on an existing one or completely new one from scratch.
That said, I'm not sure it can sign a message with that tool. Maybe. And it’s not even necessary, just add your own salt, and that will be enough - going over SEED will be useless. string seed = Timer::getSeed(32);
//seed = "bla bla bla";// Mnemonic code words
string salt = "Bitcoin seed";// = "VanitySearch"; unsigned char hseed[64];
pbkdf2_hmac_sha512(hseed, 64, (const uint8_t *)seed.c_str(), seed.length(), (const uint8_t *)salt.c_str(), salt.length(), //2048);// 2048 rounds of hashing required by the BIP 39 Standard ??? //2048);// Used 2048 rounds ??? //0);// Used 0 rounds !!! 1024);// Electrum ?
|
|
|
|
digaran
Copper Member
Hero Member
Offline
Activity: 1330
Merit: 899
🖤😏
|
|
October 08, 2023, 01:40:19 PM |
|
Thanks
Welcome. Did you think about this before buying/ spending money on it? Or after failing to find a key you realized what you are doing is morally wrong? Consider yourself as a security testing expert, but before getting to work, first calculate the cost and the profit and then continue, when you are done, just show us how you did it if you want to earn honestly. I don't see solving these puzzles and taking the coins morally wrong.
|
🖤😏
|
|
|
zahid888
Member
Offline
Activity: 260
Merit: 19
the right steps towerds the goal
|
|
October 08, 2023, 01:51:57 PM |
|
Is all this a robbery/steal/theft attempt?
After spending really too much time of my life trying different code and algorithms, buying and running loud hot hardware to solve #66 & #130 I started to wander about ethics of what I am trying to do ! OK, if I have a really really good luck, I will find the key after 1-2 more years! ... BUT !!! Do I have the right to take the coins in the address? ... The coins (the money) are not mine, and the owner (the assumed puzzle creator) never said that, if I brake the private key, I have the right to take the money !!! (Also the fact that the person has more money than us, does not give us the right to take his money!) So .. did I spent so much time of my life trying to become a thief? ... The assumption when I started was ... That is a challenge .. I can do my best .. BUT Do I have the moral right to get money assuming it is by the rules ? ... There are no official rules? We conveniently assume the owner intentions and are ready to get his money ... but what if we are wrong?
Mr./Mrs. Puzzle creator and puzzle addresses money owner, Please sign a message with any known non-broken puzzle address, and state your will! Are you fine, if money from these addresses are taken?" Or "you consider us thieves?" or ... (the signing #150, #155... public keys are already known and will not compromise security)
Thanks
I am the creator. Finally, I wish to express appreciation of the efforts of all developers of new cracking tools and technology. The "large bitcoin collider" is especially innovative and interesting!
As the creator had appreciated all the developers, especially LBC, who solved puzzles from 51 to 56, I hope you have found the answer to your question.
|
1BGvwggxfCaHGykKrVXX7fk8GYaLQpeixA
|
|
|
digaran
Copper Member
Hero Member
Offline
Activity: 1330
Merit: 899
🖤😏
|
|
October 08, 2023, 04:59:50 PM |
|
Here, if anyone is interested, I have managed to divide puzzle 115 by 2^23 without reaching fractions, but in order to do that, you'd need to guess the last 6 characters. from sympy import mod_inverse
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
def ters(scalar, target): k = mod_inverse(2, N) scalar_bin = bin(scalar)[2:] for i in range(len(scalar_bin)): if scalar_bin[i] == '0': result = (target * k) % N else: result = ((target * k) % N + N - 1) % N target = result return result
target1 = 31464123230573852164273674364426950 target2 = 6331078
print("Target results:") for x in range(8388608, 8388700): result1 = ters(x, target1) (f"T1: {result1:x}") for x in range(8388608, 8388700): result2 = ters(x, target2) (f"T2: {result2:x}") for x in range(8388608, 8388700): result1 = ters(x, target1) result2 = ters(x, target2) subtraction = (result1 - result2) % N print(f"S:{subtraction:x}") I am working on something new, I want to know how we could just guess the last 4 characters and divide our target by e.g, 2^120 etc, I'm sure there is a way, yesterday I figured a way to divide a target by 10, 20, 30 etc, but the results were mixed with n/10, n/20, n/30, meaning by subtracting n/10 from target/10 we could reach the actual target/10, I haven't tried that yet. God willing I will start working on it, I just don't know why I am not interested to work with my laptop anymore, it causes distraction.😉
Do share your findings after doing your thing.
Some tips, try subtracting 2^116 from puzzle 115 and then put the result on target 2, then try dividing by different values. Grind your way through this giant iron made mountain we call elliptic curve.😂
|
🖤😏
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 09, 2023, 02:41:55 AM Last edit: October 09, 2023, 05:53:41 AM by alek76 |
|
I made a new key generator. Tested the HMAC-SHA512 function, the data output is correct. Added a split of the 512 bit key into 2 keys - respectively 256 bits each. It may not be necessary to add anything more, all the initial data is not known... // Get Keys from SEED void VanitySearch::getKeysFromRandomSeed(int nbitL, int nbitU, bool master, int nbThread, Int *keys) { // Generate a seed byte sequence S of a chosen length (between 128 and 512 bits; 256 bits is advised) from a (P)RNG. // Calculate I = HMAC-SHA512(Key = "Bitcoin seed", Data = S) // Split I into two 32-byte sequences, IL and IR. // Use parse256(IL) as master secret key, and IR as master chain code. // Variables Int IL;// IL as master secret key Int IR;// IR as master chain code Int pKey; Int sKey; // Master key generation for (int i = 0; i < nbThread; i++) { newSeed: string seed = Timer::getSeed(32);// Used the random seed ??? // test seed //seed = "bla bla bla";// Mnemonic code words string salt = "Bitcoin seed";// = "VanitySearch"; unsigned char hseed[64]; pbkdf2_hmac_sha512(hseed, 64, (const uint8_t *)seed.c_str(), seed.length(), (const uint8_t *)salt.c_str(), salt.length(), hmac_sha512_nb_round);// 1024 Electrum ? //2048);// 2048 rounds of hashing required by the BIP 39 Standard ??? // Reverse bytes (not use sha256) unsigned char hseed_r[64]; int b = 0; for (b = 0; b < 64; b++) hseed_r[63 - b] = hseed[b]; // Split I into two 32-byte sequences, IL and IR. // Use parse256(IL) as master secret key, and IR as master chain code. // Split IL and IR unsigned long long *vTmp_IL = (unsigned long long *)&hseed_r[32];// IL as master secret key unsigned long long *vTmp_IR = (unsigned long long *)&hseed_r;// IR as master chain code IL.bits64[0] = vTmp_IL[0]; IL.bits64[1] = vTmp_IL[1]; IL.bits64[2] = vTmp_IL[2]; IL.bits64[3] = vTmp_IL[3]; IL.bits64[4] = 0; // IR.bits64[0] = vTmp_IR[0]; IR.bits64[1] = vTmp_IR[1]; IR.bits64[2] = vTmp_IR[2]; IR.bits64[3] = vTmp_IR[3]; IR.bits64[4] = 0; // end Split // debug printf printf("\n[i] Nb: %d Key IL: %s ", i, IL.GetBase16().c_str()); printf("\n[i] Nb: %d Key IR: %s ", i, IR.GetBase16().c_str()); // Set Keys 256 bits pKey.SetInt32(0); sKey.SetInt32(0); // Switch IL or IR if (master) { pKey.Set(&IL);// IL as master secret key } else { pKey.Set(&IR);// IR as master chain code } // Set Key in ranges nbitL and nbitU uint32_t nb = nbitU / 32; uint32_t leftBit = nbitU % 32; uint32_t mask = 1; mask = (mask << leftBit) - 1; uint32_t j = 0; for(j = 0; j < nb; j++) sKey.bits[j] = pKey.bits[j]; sKey.bits[j] = pKey.bits[j] & mask; //sha256(hseed, 64, (unsigned char *)sKey.bits64);// No used this function // Trim with zeros ??? // We do not know how the high byte of the key were edited. 32 BTC Puzzle. if (nbitU == 66) { //printf("\n[i] Nb: %d sKey: %s ", i, sKey.GetBase16().c_str()); //sKey.SetByte(8, 0x02);// The high byte is 0x02 sKey.SetByte(8, (unsigned char)KEY66_HIGH_BYTE);// The high byte is 0x03 //printf("\n[i] Nb: %d sKey: %s ", i, sKey.GetBase16().c_str()); } // Check length int len = sKey.GetBitLength(); if (len < nbitL) goto newSeed; keys[i].Set(&sKey);// Set Keys // Hi ;-) The END ??? } }
VanitySearch cannot divide a 512-bit number modulo the Order (only 320 bits). For this need BigNum from the OpenSSL library. Here again need OpenSSL, no matter what
|
|
|
|
nomachine
Member
Offline
Activity: 264
Merit: 12
|
|
October 09, 2023, 07:00:09 AM Last edit: October 09, 2023, 07:50:16 AM by nomachine |
|
For this need BigNum from the OpenSSL library. Here again need OpenSSL, no matter what if we want to trim the high bytes of the derived key with zeros, can we do so by copying only the lower bytes of the key to the BIGNUM ? #include <openssl/evp.h> #include <openssl/rand.h> #include <openssl/bn.h>
// Function to generate a random private key with PBKDF2-HMAC-SHA512 using OpenSSL's EVP library BIGNUM* generateRandomPrivateKey(const BIGNUM* minKey, const BIGNUM* maxKey) { BIGNUM* randomPrivateKey = BN_new(); BIGNUM* range = BN_new();
// Calculate the range (maxKey - minKey) BN_sub(range, maxKey, minKey);
unsigned char salt[16]; // Generate a random salt if (RAND_bytes(salt, sizeof(salt)) != 1) { // Handle error return nullptr; }
unsigned char derivedKey[64]; // SHA-512 produces a 64-byte key if (PKCS5_PBKDF2_HMAC((const char*)BN_bn2hex(minKey), BN_num_bytes(minKey), salt, sizeof(salt), 0, EVP_sha512(), sizeof(derivedKey), derivedKey) != 1) { // Handle error return nullptr; }
// Copy the entire derived key to the BIGNUM BN_bin2bn(derivedKey, sizeof(derivedKey), randomPrivateKey);
// Ensure that the derived key is within the desired range BN_mod(randomPrivateKey, randomPrivateKey, range, nullptr);
// Add the minimum value to the generated random number BN_add(randomPrivateKey, randomPrivateKey, minKey);
// Cleanup the range BIGNUM BN_free(range);
return randomPrivateKey; }
|
|
|
|
rosengold
Jr. Member
Offline
Activity: 149
Merit: 7
|
|
October 09, 2023, 09:59:46 AM |
|
Here, if anyone is interested, I have managed to divide puzzle 115 by 2^23 without reaching fractions, but in order to do that, you'd need to guess the last 6 characters. from sympy import mod_inverse
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
def ters(scalar, target): k = mod_inverse(2, N) scalar_bin = bin(scalar)[2:] for i in range(len(scalar_bin)): if scalar_bin[i] == '0': result = (target * k) % N else: result = ((target * k) % N + N - 1) % N target = result return result
target1 = 31464123230573852164273674364426950 target2 = 6331078
print("Target results:") for x in range(8388608, 8388700): result1 = ters(x, target1) (f"T1: {result1:x}") for x in range(8388608, 8388700): result2 = ters(x, target2) (f"T2: {result2:x}") for x in range(8388608, 8388700): result1 = ters(x, target1) result2 = ters(x, target2) subtraction = (result1 - result2) % N print(f"S:{subtraction:x}") I still don't understand what you need to do to find the private key after find the key subtraction result, if I understand it maybe I could write a CUDA version for it.
|
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 09, 2023, 12:48:52 PM |
|
if we want to trim the high bytes of the derived key with zeros, can we do so by copying only the lower bytes of the key to the BIGNUM ?
Yes. Only he edited the high bits. Or maybe bytes I just replaced the high byte with 0x2. Why divide modulo Range? Modulo the Order is probably correct, it gives a different result. And then cut off the 32-bit string. I found an error again unsigned char derivedKey[64]; // SHA-512 produces a 64-byte key if (PKCS5_PBKDF2_HMAC((const char*)BN_bn2hex(minKey), BN_num_bytes(minKey), salt, sizeof(salt), 0, EVP_sha512(), sizeof(derivedKey), derivedKey) != 1) { // Handle error return nullptr; } **************************************************************************************** int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, const EVP_MD *digest, int keylen, unsigned char *out); ****************************************************************************************
pass the seed - Input data passlen salt = "Bitcoin seed"; // Salt is always constant ! iter = 1 // Didn't look at the code? 0 gives 1 intervention? or 2048 intervention? // in VanitySearch version function 0 gives 1 iteration. keylen = 64 ------------------------------------------------------------------------------------------- Where is the Input data
|
|
|
|
digaran
Copper Member
Hero Member
Offline
Activity: 1330
Merit: 899
🖤😏
|
|
October 09, 2023, 12:59:30 PM |
|
I still don't understand what you need to do to find the private key after find the key subtraction result, if I understand it maybe I could write a CUDA version for it.
The main goal is to find a way to divide an unknown key( a puzzle key) as first target and use a known key as second target then do the division until you find a known key in the subtraction results, if you find 1 known key in sub result, you can derive the private key for the puzzle out of it. Some examples to simplify the method used: P= 2678845/52453 = 51.07134005681277 What do we need here? We need to divide n by a number to get this : 0.07134005681277 then if we subtract the result of p/52453 from this 0.07134005681277 we will get 51, bingo, since we can generate 1 up to 51 and store on device, whenever we hit 51 we can immediately notice there is a match found. But in reality we would need to store at least 1 TB public keys to compare for a match. The problem is finding a way to divide n by scalar to reach 0.07134005681277 or even close enough to that depending on how many of such results we can store.
On another note, I'm interested to figure out, when we divide n by e.g, n/45, if we then multiply the result by 450, we get something like 1/45*450 = 9 .9999999 finding the part in bold will help solving the key, but these are just ideas, needs testing.
|
🖤😏
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 09, 2023, 01:17:56 PM |
|
I still don't understand what you need to do to find the private key after find the key subtraction result, if I understand it maybe I could write a CUDA version for it.
It is impossible to determine whether a point on a curve is even or odd - without a known private key. Therefore, factoring a known private key into factors is a waste of time.
|
|
|
|
nomachine
Member
Offline
Activity: 264
Merit: 12
|
|
October 09, 2023, 04:22:32 PM Last edit: October 09, 2023, 06:33:27 PM by nomachine |
|
Where is the Input data Puzzle creator tattooed on the upper arm. I don't see any other solution than that the input is random.
|
|
|
|
digaran
Copper Member
Hero Member
Offline
Activity: 1330
Merit: 899
🖤😏
|
|
October 09, 2023, 05:29:13 PM |
|
It doesn't matter what our target is, even or odd you just need to correctly guess the last 2 hex characters and then you can use the script I posted above to divide your key by 1024, but first you'd need to subtract n/4 from the result on 1024 - index. Try it yourself and you will see, even if we guess the last 2 chars incorrectly, there is a way to again calculate p/1024 no matter what. God willing I should be able to figure that out, it's complicated I know but once it's solved you realize how easy it was.
|
🖤😏
|
|
|
alek76
Member
Offline
Activity: 93
Merit: 16
|
|
October 09, 2023, 06:16:25 PM Last edit: October 10, 2023, 08:41:40 PM by Mr. Big |
|
At the Puzzle creator tattooed on the upper arm. I don't see any other solution than that the input is random. Tattoo with QR code. Yes .
It doesn't matter what our target is, even or odd you just need to correctly guess the last 2 hex characters and then you can use the script I posted above to divide your key by 1024, but first you'd need to subtract n/4 from the result on 1024 - index. Try it yourself and you will see, even if we guess the last 2 chars incorrectly, there is a way to again calculate p/1024 no matter what. God willing I should be able to figure that out, it's complicated I know but once it's solved you realize how easy it was.
Spent a lot of time, but I haven't gotten the correct result.
|
|
|
|
|