1

Someone has a standard (non-compressed) bitcoin private key (256 bits) and wishes to store it on paper. Being paranoid about someone finding the sheet of paper, he/she cuts the private key up and stores the two (or more) equally sized pieces separately. There is no overlap between the different pieces.

Assume a malicious party found one (or more, but not all) of the different chunks. Is the malicious actor able to spend the funds? If so, what steps would be required?

Attempt to answer: My understanding would be, that a malicious actor would have to compute the remaining part of the private key to spend the funds. Though this is easier than 'guessing' the whole key, it should be technically unfeasible after about 100 bits at the time of this writing source. Splitting the key into more chunks would only make guessing more difficult (assuming only one is found), yet easier to recover (assuming all but one are owned). Is there some flaw in my reasoning?

Note: I am aware that multi-sig is the standard way of achieving better security. What I am asking is non-standard.

PS: I'm new to Bitcoin (and to StackExchange as well). Feel free to edit as needed and remove this notice afterwards. Thank you!

Improve this question
1
  • Your intuition is right, if I split a key in two and someone has one part, and they are independent, he/she must guess the remaining 128 bits, which is infeasible.
    – Davidson Souza
    Jan 21, 2022 at 17:36

1 Answer 1

Reset to default
1

The security of half a key would have to be more carefully considered. Suppose the key is n-bits long, and you know n/2. This paper suggests that generically, Pollard's kangaroo algorithm would mean you have n/4-bit security (i.e. an attack running in expected ~2^64 operations). However this doesn't mean that's the best attack possible, and it may be better to ask this on crypto.se

But as you note, there are better ways to do it. As well as multisig which you mentioned, there is also a concept known as Shamir's secret sharing which allows you to divide a secret into multiple pieces such that any chosen number of them together can recover the whole secret, but with fewer than that chosen threshold, you learn absolutely nothing about the secret.

Improve this answer
2
  • 1
    Are you sure that's right? I can imagine that e.g. knowing that the private key is in a particular 128-bit range may permit lattice attacks that are faster than brute-force, or than DLP.
    – Pieter Wuille
    Jan 21, 2022 at 21:53
  • Hmm maybe you're right. I feel like it should be fine but I have edited my answer just in case. It feels like the best attack on half an n-bit key would still be 2^(n/4). Maybe it should be asked on crypto.se
    – meshcollider
    Jan 21, 2022 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.