Note for cryptographers/matematicians: I know that "reversing" isn't the correct term here, so you could accuse me of the same sin I'm calling out in my previous comment. But it makes the explanation shorter while still conveying the correct meaning in the end.
Having the public key is easier than having an address because an address is the hash of a public key. So in order to crack an address, you must first find a public key that produces that address, and then find a private key corresponding to the public key.
Sure, finding a private key whose public key's hash is given might be 2x slower, but Pollard's rho algorithm is 2^128 times faster.
Asymptotically, an additional hash at the end doesn't matter when you brute force. But it prevents you from using Pollard's rho algorithm, which does make a difference asymptotically.
"Here's $400,000 sitting on the table, hope nobody takes it" which triggers an alarm telling us to replace all our old prequantum cryptography.
Or getting hacked. This is super common among people who are known to have high value wallets. Between physical attacks and zero days in everyday software, there's no chance to stay safe when you put that kind of target on your back.
Vitalik Buterin seems to be a counter example here, his net worth peaked around $1.46 billion. He has some interesting writing on how he stays secure. At one point the SHIBA token sent a huge amount of funds to his cold wallet and he details what he did to securely access those funds:
https://decrypt.co/91000/ethereum-founder-vitalik-buterin-du...
> The funds, he said, were initially in a cold wallet in the form of two numbers written on separate pieces of paper. Buterin said he had to combine the two numbers to get the private key. "One of those numbers was with me; the other number was with my family in Canada," he said. "So I had to call up my family in Canada and tell them to read their number to me."
> Buterin said that he entered the numbers into the computer he purchased from Target after putting the two numbers together. "I sent my ETH out by generating a transaction and then on a computer that I bought from Tarjay [Target] for about $300 bucks for just this purpose."
> Before disconnecting the laptop from the internet entirely, Buterin said he downloaded a program to generate QR codes. After generating the Ethereum transaction, he scanned the QR code with his phone, copied it to the laptop, and then put it into etherscan.io/push Tx. Finally, Buterin said he began sending out the tokens.
Maybe not the best example of cryptographic security.
the DAO hack happened, immutably, no one disputes it. the hashes and blocks and transactions are well-known. so there was a "schism", that explicitly validates the fact that without this large-scale cooperation, without the redefinition of what Ethereum is, it would be still be what is on that other branch. these both provide evidence for the immutably and decentralization.
The fact that there are far fewer users of Ethereum Classic (and the market cap is significantly lower) is a testament to how much people care about the community which chose to follow a different history of the Ethereum network.
But in one chain the whole community decided to disown the attacker by injecting hard coded transactions that would send the Ethers back to their original owners.
Vitalik (and all DAO ETH hodlers) luckboxed in that the ETHs locked in the DAO, although "stolen", couldn't be withdrawn by the attacker before a few weeks.
There has been zero pause and zero rollback. Most people don't understand that: by chance the stolen funds were inaccessible to the attacker for a few weeks.
What Vitalik did is he forked (soft fork) the ETH blockchain to modify the rules. That soft fork happened before the cooldown period expired, so the attacker never got to access his funds.
Some members of the community said "adding new rules is against the spirit of decentralization, so we keep using the old chain". The old chain was named "Ethereum classic" while the forked chain kept the name "Ethereum".
But there's been no rollback.
The proof of this is that some people didn't agree with undoing that transaction. They stayed on the old chain, which is now worthless.
This is such a boring and widely known story now, but it has to come up literally any time someone wants to play crypto tribalisim.
The reason why people got confused with your comment is because ex. you purport it was fine, it can never happen again, and everyone who didn't agree went to 0.
Lot of tensions between those things.
We also understand how one person could have those views and even steelman it into something intellectually consistent. But then the post seems really off because it's sort of a rushed, poor, justification for why you believe something, coupled to bemoaning some sort of unrelated group none of us are privy to.
How exactly was Vitalik "indirectly pwned"?
I think pretty much all stores still accept cash, but most people here just never withdraw any. It's pretty much just old people and people buing illegal stuff
So this is why cash IS a good thing. Sex workers want to do their thing and Johns want to not be instantly called out for using sex workers. The people who long ago realized magic mushrooms work to cure depression want to be be able to get it without being jailed. Now, here in Canada, sex work is protected and magic mushrooms will not get you thrown in jail.
So even though you may deem things illegal, I ask you think of a greater good that cash allows as everything being digital reveals a lot of information that not all people are comfortable their government knowing. Be it homosexuals, depressed people trying illicit treatments, or extremely lonely discarded individuals reaching out to sex workers verses suicide.
Lastly according to a quick google search and a few spots I looked at, most only showing 2022 as latest information, most point of sale transactions in Europe are made with cash not card [1]. [1] https://www.statista.com/statistics/786680/share-of-cash-tra...
And in northern Europe, pretty much nobody uses cash. In the rest of Europe, at least the places I've been, pretty much every store accepts card and often other digital payment methods.
I don't doubt your statistics, just stating my experience. I just think it's strange that people prefer cash for legitimate purchases. I definitely want cash to stay around, but these days we can use crypto for illegal stuff anyway do it's not really a big deal.
Then he didn't have to worry about the Shiba related transactions affecting his ETH?
The basic problem was that they transferred into his "cold wallet" https://www.nerdwallet.com/article/investing/hot-wallet-vs-c...
He didn't want to have the signal be that he was happy holding SHIBA and was uncomfortable with that much power & control over SHIBA. So he wanted to be able to transfer his SHIBA out to a hot wallet and then burn most of it and donate the rest, given the amount of money involved he took extra steps like buying a new computer to generate the new keys, airgapping it from the internet while it held the cold wallet keys etc
This problem is harder if you want to pass on your crypto after you can't use them anymore.
If you want to enable recovery, you should give ownership of things to smart contracts, which enable things like succession rules and a heatbeat checkin etc.
Public/private keys are not designed to solve that kind of governance problem.
The $400,000 is an inducement for any participant in that engineering effort to break the conspiracy and take the bag. It's effective during the period between the time that a quantum Shor's solver has been achieved for a given algorithm in theory for 256 bits (and in practice for 66 bits), and the time that a practical solution at 256 bits has been implemented.
I don't know how plausible that timeline is either in spacing or accuracy.
Sometime in early 2029, a bunch of people suddenly find that they're eligible for a $400,000 cash prize if they manage to secretly steal a bit of time on a working quantum computer. In 2030, that group of people doubles, and incorporates a new agency with its own security weaknesses. By 2031 we're talking about four separate countries with their own engineers that have managed to achieve the capability to claim that cash prize. Private corporations are somewhere on the horizon. Very soon this becomes an urgent imperative to anyone inclined, because the prize, like cash, disappears the moment that somebody else seizes it.
It's hard to keep conspiracies, particularly with a verifiable open offer of large amounts of highly portable money on the table to the first person to reveal secrets, and a gradually widening circle of access. The gradually expanding circle of access is what ensures we get some kind of alarm LONG before 2038. Keeping that secret to even 2033 requires hundreds of people and four agencies with diverse motivation and values to consistently turn down cash money for years on end in the interest of keeping their quantum capabilities hidden from the world.
I just think maybe public key crypto is not broken so far because there is no motivation for enough people to work on that. What whould one get, without endangering himself, if he breaks integer factorization?
The reason that we use elliptic curves these days, or if we must then something like 8k bit keys to get 128 bits of security over finite fields, is that for the old Z^*_q/Z_p setup, such a faster algorithm exists (index calculus).
Someone could in theory find a better calculus that works only for groups with some specific characteristics of Curve25519, for example. No quantum computers needed.
EDIT: we know that no _generic_ faster algorithm exists, that is one independent of the representation of the group involved, for the traditional computing model. But that doesn't exclude algorithms, as I said above, that work for very particular cases.
You can get a brief introduction at https://soatok.blog/2020/04/26/a-furrys-guide-to-digital-sig... (your own choice if you want that open in a tab at work or not, but there's nothing NSFW in the usual sense in there), and then read the details of each scheme in the RFCs. Some of the RFCs even talk about security implications.
"djb" as he is known in the crypto world has a good paper at https://eprint.iacr.org/2024/1265 , it's 68 pages so "almost a book". He also has a lot of resources on his page https://cr.yp.to . Be aware that he is sometimes ... controversial (not racist or anything, just has strong opinions on FIPS and the NSA and has actually taken the US government to court in the past over this). He's the author of Curve25519.
(disclaimer, I don't know statistics, cryptography, bitcoin or chances)
You don't even need to travel far. A second or so is enough to break all cryptography, even the post-quantum one.
If someone had a quantum-supreme solution they would go after the sitoshi wallets. Some addresses have like $1B+ and combined represent ~$200B.
I would not be shocked if trying to sell $200B in bitcoin gets you far less than half.
Granted, moving a sitoshi era wallet to a coinbase wallet would raise red flags, but those sized deals are done otc.
Obviously if you found a shortcut in the hash you might do other things first, but I think that's the idea.
also, if you were the type that thinks bitcoin is lame, this could be a way of undermining the concept to the point that people no longer use it because it's not secure as it was touted
I'd claim the prize, sell for USD, then watch BTC crash
But I think you are one of those people that threw out that baby with the bath water long ago.
[0] https://www.anwb.nl/energie (Dutch)
In fact solar panel sales are dropping very fast.
Custom silicon and all kinds of related optimizations were likely used to successfully brute-force this number.
The main discussion thread on the bitcoin forum is this but it has a low signal-to-noise ratio: https://bitcointalk.org/index.php?topic=1306983.0
There is a secondary thread here: https://bitcointalk.org/index.php?topic=5218972.0
The point of the puzzle is indeed to brute force some private keys (not public keys), but not all, as 2^256 is computationally impossible. The private keys that have been discovered so far have obviously many zeros in them, so in practice you are never going to accidentally steal from a legitimate address with actually 256 bits of entropy.
The creator of the puzzle is anonymous and never came forward (to my knowledge). The point of the puzzle is (1) to be a fun game, and (2) to be a publicly observable way of measuring current brute forcing capabilities.
This is one of the reasons it is advised never to reuse an address. After using it once, your private key may still be private but your public key is exposed, reducing security.
You don't need the public key, and IIRC most algorithms allow you to derive the public key from the private key, though I'm not sure that's the case with Bitcoin. I have vague memories that there are algorithms where this is not that case, but it's been a while.
1. SHA-256: Used twice (double SHA-256) for block hashing and once in address generation.
2. RIPEMD-160: Used once in address generation (after SHA-256).
3. ECDSA: Used once for transaction signing and verification.
4. Base58Check: Used once for address encoding (includes a checksum generated using SHA-256).
[1] https://www.ledger.com/academy/crypto/what-are-hierarchical-...
The basic idea is you pick one private key that's a sequence of 256 bits or so, call this k. When you need a keypair, you compute H(k, tag) to get another bitstring, then turn that into an ECDSA private key (minding the bear traps here) and that then has a single public key.
For example in U2F, the key derivation is H(k, domain, ...) where k is the secret baked into the USB token, domain is the domain you're logging in to (this is the part that protects against phishing, among other things) and further protocol-specific information.
I'm also unclear on where you got the 'multiple of 5' bit about. It seems the keys corresponding to numbers divisible by 5 were used in a spend transaction by the puzzle creator. Using those addresses in spend transactions reveals the public key and saves compute that would be wasted hashing. It also enables direct attacks using Pollard's rho (which someone already posted a link for above).
Src: https://bitcointalk.org/index.php?topic=1306983.msg51466379#... https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_...
Another interesting discussion on bitcointalk about using Pollard's kangaroo: https://bitcointalk.org/index.php?topic=5244940.0
As shown by the graph [0], adoption slowed down after 2016 when BTC blocks got consistently full and transaction fees rose to $50 and more. I believe if BTC had scaled to support more transactions the price would be much higher today, as Bitcoin would likely be used as a means of payment across the Internet and in many physical stores at well.
Discussions regarding the decentralization of larger blocks aside, something that is not clear to many people is that scaling a blockchain to handle more transactions doesn't mean a linear increase in energy use. In the case of BTC its Proof-of-Work algorithm operates over the root of the last block's Merkle tree, which is a hash of all the transactions in the block. Being a fixed-size hash it doesn't matter if the block contains 1,000, 1 million or 1 billion transactions. Arguably a more popular Bitcoin would be more valuable and therefore would attract more miners, increasing its energy consumption, but that just reinforces my original point.
What I strongly disagree with is that a Bitcoin with bigger blocks and hence larger transaction capacity is inherently less valuable. That is an unfair comparison because Bitcoin Cash, when the split happened in Aug 2017, could have been recognized as Bitcoin by the ecosystem, but it wasn't, and Bitcoin Core retained the BTC ticker. Because of that Bitcoin Cash had to start adoption from the beginning, losing Bitcoin's established network effects.
My original argument was that if Bitcoin had increased its blocksize before 2016 as Satoshi Nakamoto originally intended [1], then the Bitcoin Cash split wouldn't have happened, Bitcoin adoption would have continued growing (remember that back in the day big players like Microsoft, Dell, Steam and Newegg started accepting Bitcoin payments) and miners would progressively see more of their rewards coming from transaction fees and less from the block rewards.
This last point is one of the big problems with BTC right now: the network security will decrease in the face of dwindling block rewards unless transaction fees rise. I argue that Bitcoin was always supposed to scale in number of transactions, so the aggregate of transaction fees, even if individually inexpensive (roughly 1 cent), would become larger than the block reward. In other words: the block reward was just an economic incentive to kick-start the Bitcoin network, to attract miners that would secure it, but the transaction volume was meant to keep increasing to replace it.
[1] https://bitcointalk.org/index.php?topic=1347.msg15366#msg153...
In my opinion there are two main issues that prevent crypocurrencies from being actually used as currency:
1. How many transactions per seconds can be handled 2. Their extremely high volatility compared to fiat currency
While blockchains can scale to fix point 1, point 2 is driven by forces outside the technology.
Regarding volatility I agree that it's currently an issue, but not an insurmountable problem in my opinion:
1. Payment gateways can offer automatic asset conversion to minimize volatility risk for payment takers. This means I could pay in whichever cryptocurrency the payment gateway would take and the receiver would get whatever currency they have set up in their account. They might want to keep some currencies and convert others, so the payment gateway could offer an option to decide that, and in which amounts (e.g. "keep 10% of each BTC payment, convert the rest to USD").
2. Price volatility should reduce as a cryptocurrency is more widely used. In the alternate universe where BTC scaled to be larger than all credit card networks combined its price could be more stable than many fiat currencies.
[0] https://blog.vermorel.com/journal/2017/12/17/terabyte-blocks...
My new public key search system is almost ready. I had to reinvent my binary database system because, although the database was lightweight https://bitcointalk.org/index.php?topic=5475626, I had efficiency issues with binary search. This is now a thing of the past. I have designed a system that stores 100 million public keys in an 80 KB file, yes, what you read 80KB!(in the future it will be smaller) that meets maximum efficiency. We would only be limited by the current speed of Secp256k1 when generating the 100 million or more public keys while creating the database. I am finishing designing the search script after months of being stuck due to personal issues, I am finally back on track.
I love these kind of mad inventor rabbit hole corners of the Internet. Kind of brings back the 90s for me when everything was exciting.
That’s 0.0064 bits per public key - so either there are lots of duplicates, or something is amiss here?
Edit: they don’t actually store the keys, so the quote is misleading.
Assuming there are no duplicates, which is a sensible assumption, you’d need a minimum of 100,000,000 bits to store 100,000,000 unique entries larger than 1 bit with even a perfect hash function.
Also they already did follow the link. That's why they said "they don’t actually store the keys, so the quote is misleading", which you responded to with a laugh and nothing else. And that happened many hours before you made this new comment.
I'm not sure that guy really understood what was going on. If he'd followed the links he would've found the code. Or at least a technical description. So why need to play dumb and ask here, while trying to control the discussion?
I don't like that kind of thing. If you're okay with it, alright. But that's not me.
The easiest one to think about is storing the deltas between each number. Let's say 80% of your deltas are 5. If you use arithmetic encoding, then storing a 5 only takes about 1/3 of a bit. It's not hard to come up with probability distributions where the average amount of bits per entry is less than 1.
Also, back in the realm of perfect hashes, once you're more than half full it becomes more efficient to store the missing numbers. If your perfect hash has 100,003,000 possible outputs, then your worst case is around 50k unique entries. By the time you encounter 100k unique entries you only need to keep track of the 3000 you haven't seen yet.
Bitcoin puzzles are private keys with just a few unknown bits so that anyone can bruteforce them to collect a reward. Puzzle 66 contained 66 unknown bits and had 6.6 BTC deposited into it by the initial puzzle creator. The private key was 0x000000000000000000000000000000000000000000000002832ed74f2b5e35ee or 256 bits with mostly zeroes but 66 random ones.
The next Bitcoin puzzle, #67, has 67 unknown bits, and contains 6.7 BTC up for grabs: https://www.blockchain.com/explorer/addresses/btc/1BY8GQbnue...
The previous puzzle by order of difficulty was #64 (not #65, because see below) and was solved on 9/9/2022, so about 2 years ago. In other words, it took about 2 years of compute time to run the 2^66 bruteforcing task.
Puzzles that are multiple of 5 (#65 or #70) are special: they have twice more entropy. So that private key #65 doesn't have 65-bit of entropy but 130-bit of entropy. And the creator of the puzzle intentionally published their public key on the blockchain. When you know the public key, brutetforcing the n-bit private key only requires 2^(n/2) work. So puzzle #65 with a 130-bit key actually require bruteforcing up to only 2^65 keys.