How does this OpenCL BTC private-key cracker work? Is it a real threat to bitcoins?

I am specifically referring to this over at bitcointalk.org.

The general consensus I gathered from reading the thread is that this is not a hoax. There seems to be a group of generated bitcoin addresses that can be considered weak where its private key can be recovered in a reasonable amount of time. There's currently no known way to determine if a given btc address is weak or not.

What is not clear to be me is how it is able to accomplish this. What is the basic idea behind this attack that allows it to even work? Explain it to me like I was 5, if possible. Is this is a potential break of the ECC algorithm?

greatwolf

Posted 2014-01-29T00:44:17.247

Reputation: 580

The argument that those keys are weak is flawed. A particular search algorithm happens to search those keys first, thus allowing it to break those keys more quickly. But if people stop using those keys because they are "weak", then the search algorithm will just start elsewhere, making those keys stronger and other keys weaker. If you avoid weak keys, then someone trying to break your key need not search any weak keys, making everyone's keys less secure. (ECDSA has no weak keys of the type that's actually weak unless your RNG is broken.) – David Schwartz – 2014-01-29T06:29:53.183

Answers

I hope this post by Greg Maxwell is convincing enough: https://bitcointalk.org/index.php?topic=421842.msg4809012#msg4809012

Unless your private key is generated by a weak random number generator, there is no need to worry. It effectively takes around 10^42 operations to crack a 256-bit elliptic curve private key.

He's using names of some well-known algorithms for solving the discrete logarithm problem (which is what you must do to find the private key from a public key in our case). They are significantly faster than a brute force search, but cannot break the limit posted above.

The explanation seems to boil down to "we pick some keys to start with, and if yours is close to any of them, we'll find it quickly". That shouldn't surprise anyone. The odds of being "close" to any of the keys someone chooses to start with are astronomically small however. Even being able to try millions or billions of keys per second will not change that.

Pieter Wuille

Posted 2014-01-29T00:44:17.247

Reputation: 54 032

Whilst I am not an crypto expert, I guess, in some programs that generate "wallet" keys (official or not), there may be a problem with the random number source that is used to create the keys (biased towards some numbers maybe). That will allow the attacker to create a link between target X variable (pub. key, user id, time created, or whatever, I don't know...) and private key. Naturally, it would reduce the amount of possible private keys to a reasonable amount and let it be cracked.

Wallet system is asymmetric cryptography after all and this is the only reason I can think of. Further reading on wiki on asymmetric cryptography.

Etherealone

Posted 2014-01-29T00:44:17.247

Reputation: 111