There are 2^256 private keys out there: how big is that number?

[pooya87]

Now, in Bitcoin, I'm thinking of a number between one and 2^160 (in fact, it's a little less, but let's not delve into technical details too much).

there is a tiny mistake here. that "number" that we choose in bitcoin (aka private key) is between 1 and a little less than 2²⁵⁶ then that number is "converted" and "compressed" using one way operations to a smaller size (2¹⁶⁰).

It's actually a little more complicated than that.
There is (AFAIK) no really good answer to how many "guesses" we're talking about in this "game".
There are indeed 2^256 private keys (or slightly less), but they translate to a "mere" 2^160 addresses.
More than one private key translates to one address, but it's not as simple as saying "x private keys translate to one address".

that's a different topic though.
if we are talking about collision then it is not just about finding a hash collision in 2¹⁶⁰ range, that would be pointless. we have to find two "private keys" that collide to the same hash result. so the bounds for the loop that is used to choose the keys are from 1 to 2²⁵⁶ instead.

now how many keys should be checked before we find a collision is what you are pointing out here. and in cryptography it usually is half of the final size meaning theoretically after checking 2⁸⁰ keys we may start seeing collisions.

At this moment the hash rate of bitcoin network is about 2^67 hashes/s, i.e. about 2^92 hashes/year.

that is a good number but also a bit of an unfair comparison. the hashrate is the result of computing double SHA256 of a mostly fixed 80 bytes message whereas a collision is going to be computing multiple things starting from an elliptic curve multiplication then 1 SHA256 followed by 1 RIPEMD160 of either a 33 byte input or a 65 byte input. most of the optimization that has gone into mining won't work here not to mention that there isn't much room to optimize RIPE-MD algorithm. the result should be a lot less than 2⁹² for this process even if ASICs were made for it.

[qwk]

How much energy would be necessary? Well, a lot, according to this infographic:

I was never truly happy with that picture, so your thread got me thinking how to explain the energy requirements in a different way:

"If you had a computer that could do those calculations within a human's lifetime and were the size of the earth or smaller, and you actually somehow had an energy source to power it, as soon as you'd turn it on, you'd turn the earth into a supernova."

More detailed explanation in a more technical thread about it:
https://bitcointalk.org/index.php?topic=5216788

[FP91G]

https://keys.lol/ethereum/904625697166532776746648320380374280100293470930272690489102837043110636675



https://etherscan.io/address/0x3f17f1962B36e491b30A40b2405849e597Ba5FB5

I found a private key, how do I get my money 

[fillippone]

https://keys.lol/ethereum/904625697166532776746648320380374280100293470930272690489102837043110636675



https://etherscan.io/address/0x3f17f1962B36e491b30A40b2405849e597Ba5FB5

I found a private key, how do I get my money  

LOL.
I see what you did here  

Let's explain:
https://bitcoin.stackexchange.com/questions/65969/invalid-public-key-was-spent-how-was-this-possible

[odolvlobo]

https://etherscan.io/address/0x3f17f1962B36e491b30A40b2405849e597Ba5FB5

I found a private key, how do I get my money 

You don't because the private key is invalid.

[Elliptic23]

How much energy would be necessary? Well, a lot, according to this infographic:

https://i.imgur.com/MnBkXUo.jpg

I was never truly happy with that picture, so your thread got me thinking how to explain the energy requirements in a different way:

"If you had a computer that could do those calculations within a human's lifetime and were the size of the earth or smaller, and you actually somehow had an energy source to power it, as soon as you'd turn it on, you'd turn the earth into a supernova."

More detailed explanation in a more technical thread about it:
https://bitcointalk.org/index.php?topic=5216788

I've never liked that image because its misleading.

We already know of ways to crack private keys that dont require 2^256 work.

[BlackHatCoiner]

p.s. a bit nitpick-y but there are 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 private keys which is a little smaller than 2²⁵⁶

I'm trying to understand it but failed. Why not 2^256? They are hashes right? Like strings. All possible combinations. Where is the mistake? 

[nc50lc]

I'm trying to understand it but failed. Why not 2^256? They are hashes right? Like strings. All possible combinations. Where is the mistake?  

He's just nitpicking and explained that it's not actually 2 to the power of 256 but only until the highest valid private key to be exact.

2^256 = 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936
isn't equal to 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140,
in decimal = 115,792,089,237,316,195,423,570,985,008,687,907,852,837,564,279,074,904,382,605,163,141,518,161,494,336

Those aren't hash, 0-F character strings are Hexadecimal (HEX).
Most Hashing algorithms' outputs are just represented as HEX by most tools, that's why it looks the same.

[Elliptic23]

p.s. a bit nitpick-y but there are 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 private keys which is a little smaller than 2²⁵⁶

I'm trying to understand it but failed. Why not 2^256? They are hashes right? Like strings. All possible combinations. Where is the mistake? 

They are not hashes. Public keys are X,Y points on a very large curve which has just under 2^256 points.

[pooya87]

p.s. a bit nitpick-y but there are 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 private keys which is a little smaller than 2²⁵⁶

I'm trying to understand it but failed. Why not 2^256? They are hashes right? Like strings. All possible combinations. Where is the mistake? 

to add to what @nc50lc and to understand "why not all possible combinations" aka 2²⁵⁶ you have to know that in elliptic curve cryptography we are working with a finite group of points. these points are generated by a generator point on curve that can only generate a sub group (again finite group) of points. in other words G can not generate all points on the curve only some of them.
the number of points this generator point (G) can generate is equal to N so we can only have N private keys not any more (a point is private-key*G). and for bitcoin's curve (sekp256k1) value of N is what i posted above in hexadecimal format.

[odolvlobo]

Most Hashing algorithms' outputs are just in HEX, that's why it looks the same.

Not really. A hash is just a number (or perhaps more accurately, a string of bits). Hexadecimal is a way of representing numbers in base-16.  A hash can be represented in many ways because it is just a string of bits. For example, a Bitcoin address is a hash (plus some other things), but you normally see it as base-58, and not hexadecimal. Base-64 is also a common way to represent hashes.

[nc50lc]

Not really. A hash is just a number (or perhaps more accurately, a string of bits). Hexadecimal is a way of representing numbers in base-16.  A hash can be represented in many ways because it is just a string of bits. For example, a Bitcoin address is a hash (plus some other things), but you normally see it as base-58, and not hexadecimal. Base-64 is also a common way to represent hashes.

A re-post, I see.
Perhaps I should edit it as "represented as HEX by most tools" to clear things up, thanks.
That part of the reply is based from Blackhatcoiner's previous post that mistakenly identified the 'private key in hex' as hash because hexadecimal outputs are most likely what he's been seeing in hashing tools.

[fillippone]

Today I discovered another website:

privatekeys.pw/scanner

Free online tool for fast scanning random Bitcoin, Bitcoin Cash, Bitcoin SV, Litecoin, Dogecoin, Dash, Zcash private keys and finding addresses with balance.

This website scans private keys, and check balances. I don’t exactly know what it should happen if a positive balance is found, but I suspect you can transfer to your custom address.

I have been running the program for a few hours, and I checked 1,000,000,000 addresses.

Let’s say I can run this program all day and  long 10 times this amount.
 If everyone on the planet would run the same program 24/7 for 100 years, we would get to 3*10^24 tries.


Looks, like a big number!

Remember that the number of private keys are roughly (please, bear some  patience with this one) equal to the number of atoms in the universe?

Look what I found in Quora:
How many grams of water are in 2.31 x 10^24 molecules of water (H2O)?

Not going to spoil the answer.

[BlackHatCoiner]

Remember that the number of private keys are roughly (please, bear some  patience with this one) equal to the number of atoms in the universe?

If we assume that there are ~10⁷⁸ atoms in the Universe, then yes, it's a "little" greater than that. Your chances of finding a collision aren't that many, though. Remember, there are ~2⁹⁶ different private keys for each single-sig address on average. That leaves you with less than 10⁵⁰ different addresses.

[larry_vw_1955]

Bitcoin could easily upgrade to 512 Bit security.

If someday we "upgrade" bitcoin i don't think it would be to a bigger size curve (which the bigger keys come from) but i suppose it would be a migration to another different asymmetric cryptography algorithm instead of elliptic curve and keep it small at possibly the same 256 bit key size.

it's not like bigger size curves can just be plucked off a tree. so you probably right.

[nullius]

So, this thread contains some substantial inaccuracies—some of which were corrected by a Newbie account that has not posted since 2020.  (Thanks, Elliptic23; please come back.  Anyway, merit sent.)  Beyond that...

Wait a minute.  For the past three years, nobody noticed that fillippone is a wannabe wallet thief?  This is way beyond Asch.

fillippone will never find anything unless someone tells him about Brainflayer, but that is not the point:  He is audaciously proclaiming wallet-thief intentions that rico666 evasively dissimulated with LBC.  rico666 got tagged for that.  Worse, fillippone claims that this is “legitimate” (!).  And he claims that as a trusted pillar of the community, who should be responsible to the highest standards.  Tagged accordingly.

This isn’t a matter of learning about Bitcoin:  To dream of snatching people’s life savings or business funding, and treat it as a lottery winning or money found lying in the street, it is a matter of base character and lack of decency.  At least, an honest blackhat admits a desire to take away other people’s money.  By comparison, I wouldn’t criticize such candid malevolence too much—and why would I bother, when there is this:

Wow!
If you find a positive balance in this client side generated pages, you are actually owner of the private keys, so you are legitimate owner of such balance, and nothing prevents you from transferring to your own wallet.

I spent a few hours on that website, generating thousands of private keys, of course without finding anything, not a single used address, let alone one with a balance.

Then, I started to think I could engineer a little bit the process, and speaking with some fellow users here in the forum, I thought we could have a script generating random private keys, then ask my own bitcoin node the balance in such address and eventually transfer any balance to my own wallet. Working in local should speed up a little bit the process, I thought.

I knew from start the  possibilities to find something were tiny, but I wanted to try because looking for balances and finding nothing, would reassure me that nobody could do the same with my own bitcoin so jealously held in my cold wallet.

While waiting for @babo to disclose his script, I thought to myself “Fillippone only pawn in the game of life”...how come nobody ever thought about that?

Back into the rabbit hole, I quickly discovered the Large Bitcoin Collider.

https://lbc.cryptoguru.org/about

Wow this is a serious project.
Basically thousands of distributed servers generating and checking 26 Trillions (!!!) of private keys on a daily basis.
Over the first three years, they managed to find 7 private keys. That’s a lot! I imagined the odds were much lower., but probably there is some kind of bug in some wallet utilising a suboptimal random number generator to create keys. (Further research needed here!)

That’s not why—IIRC, they made sure there was money they could find—but I will not rehash all the years worth of LBC discussions, debates, and flamewars.  Some of which I coincidentally engaged with against a delusional and/or dishonest LBC believer/promoter, ten days before the fillippone account was registered.

So, fillippone is full blackhat:  Seeking to exploit buggy code for profit.  Except that he pretends it’s “legitimate”.  I intend hereby no offense to real blackhats, who are sufficiently honest to relish being evil predators, and who think that’s cool.

How much energy would be necessary? Well, a lot, according to this infographic:

I was never truly happy with that picture, so your thread got me thinking how to explain the energy requirements in a different way:

"If you had a computer that could do those calculations within a human's lifetime and were the size of the earth or smaller, and you actually somehow had an energy source to power it, as soon as you'd turn it on, you'd turn the earth into a supernova."

More detailed explanation in a more technical thread about it:
https://bitcointalk.org/index.php?topic=5216788

I've never liked that image because its misleading.

We already know of ways to crack private keys that dont require 2^256 work.

That image always annoyed me, too.  If the public key is known, it has a notional 2¹²⁸ security level.

• Bitcoin’s Public-Key Security Level

p.s. a bit nitpick-y but there are 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 private keys which is a little smaller than 2²⁵⁶ :P

I'm trying to understand it but failed. Why not 2^256? They are hashes right? Like strings. All possible combinations. Where is the mistake?  ???

They are not hashes. Public keys are X,Y points on a very large curve which has just under 2^256 points.

Thank you.  (I am not sure why everyone ignored this account.  Because it’s a “Newbie” account?)

Yesterday while browsing down the Bitcoin rabbit hole I stumbled on the infamous keys.lol website

https://keys.lol
(Warning: time sink!)

Basically it’s a website that randomly generates 128 private keys on each page, then checks the balance of the related addresses (compressed and uncompressed) on the blockchain reporting eventual positive balances or past transactions.

Wow!
If you find a positive balance in this client side generated pages,

The generation is done server-side.  I can’t see the pages, because it throws me a Javascript-requiring CAPTCHA that I refuse to comply with; and the code for the frontend website was apparently un-open-sourced.  But I can see the code for the backend, which is rather embarrassing:

Code:

	// convert the "int" to "string" because i dont know how to create a bigInt from an "int"
	stringInt := fmt.Sprintf("%d", keysPerPage)

I don’t know who first came up with that concept for a website; it is clever, but trivial to implement.  There used to be a better site, but it seems to have disappeared long ago.  I don’t recall when I first saw it, but this seems to be when I first posted about it, about four days after I started to post on the Bitcoin Forum as a “Newbie”:

Yes, “straight up brute forcing” is indeed possible.  I sincerely suggest that you try this.  It will keep you busy and out of trouble.  To make it easier, there is a public directory of all Bitcoin private keys.  Yes, that site really does list all Bitcoin private keys.  Get rich!  Happy hunting!

(P.S., why are highly intelligent people in a “Development & Technical Discussion” forum seriously answering questions about bruteforcing secp256k1!?  Doubly-hashed, undisclosed public keys are just gravy.)

I found the following amidst discussion of your very own clone of directory.io (!):

On a legit note, I was bored as shit sitting in this hotel room as I travel for work.

I found an address with exactly the miner fee by randomly searching http://btckey.space. I instantly ran down to the "news station" (What the UK calls a convenience store) and bought two scratch off lottery tickets, I didn't win, haha.

[...]

By the way, I see that you run LBC (and vehemently defend it).  Have you seen rico666’s trust feedback?  I wouldn’t trust anything executable from that guy on my machines.  Just saying.

[babo]

I'm here because there is a

Code:

@babo

who triggered me
I don't know if you drank or didn't take your pills

but to allege that a person is a blackhats because he uses such sites is at least imaginative not to say bad taste

maybe you are joking, or maybe you are not kidding, please explain what you mean because I want to know if it's a game or if you are serious

[nullius]

[Will not repeat for the benefit of those who evidently have difficulty reading.]

I'm here because there is a

Code:

@babo

who triggered me
I don't know if you drank or didn't take your pills

but to allege that a person is a blackhats because he uses such sites is at least imaginative not to say bad taste

maybe you are joking, or maybe you are not kidding, please explain what you mean because I want to know if it's a game or if you are serious

Question:  Do you, babo, believe that if you had a script that could find people’s private keys, it would be quote-unquote “legitimate” to transfer their bitcoins to your wallet?

The general futility of such an exercise is irrelevant:  What matters here is the intent.  The LBC author duplicitously denies having such an intent as quoted in my prior post; nonetheless, he been tagged for years as a wallet thief.  Anyway, the same would apply to malicious use of Brainflayer; and anyway, fillippone explicitly suggested finding weak keys from buggy wallets.

(Please focus on the above-stated question.  Your nonsense is beneath reply—save to remark that it is inadvisable to insult me, and about as futile as attempting to crack securely created Bitcoin keys.)

[LoyceMobile]

Question:  Do you, babo, believe that if you had a script that could find people’s private keys, it would be quote-unquote “legitimate” to transfer their bitcoins to your wallet?

The general futility of such an exercise is irrelevant:  What matters here is the intent.

See the topic title: the intent is to show how secure Bitcoin is. That's why I Merited the post.
If I had a script to find people's private keys, Bitcoin would be worthless. I'm glad I can just tell people to try and find a funded private key, so they can prove to themselves that it won't work.

[babo]

Question:  Do you, babo, believe that if you had a script that could find people’s private keys, it would be quote-unquote “legitimate” to transfer their bitcoins to your wallet?

The general futility of such an exercise is irrelevant:  What matters here is the intent.  The LBC author duplicitously denies having such an intent as quoted in my prior post; nonetheless, he been tagged for years as a wallet thief.  Anyway, the same would apply to malicious use of Brainflayer; and anyway, fillippone explicitly suggested finding weak keys from buggy wallets.

(Please focus on the above-stated question.  Your nonsense is beneath reply—save to remark that it is inadvisable to insult me, and about as futile as attempting to crack securely created Bitcoin keys.)

I can't insult you, nature has already done this for me
the uselessness of your accusations and your post are there for all to see
I certainly don't have to tell others what to do or what to think about

if you are serious, then I make the right decisions about you

people like you do not bring benefits to the forum or to the people who attend it, as shown by your latest red trusts taken