3

After reading the Bitcoin wiki page for brainwallets it seems to me that mining equipment can be used to brute force brainwallet passphrases. Is this correct?

"...so hackers can collectively try multiple trillions of passwords every second in the privacy of their own homes with the very same equipment they use for mining bitcoins (in the usual sense)."

How would one use an ASIC miner to brute force the blockchain with a dictionary attack? What would the application logic look like? Can a standalone(The Antminer S1 for instance) miner be "tricked" into believing it is doing normal work for a pool when actually just hashing random strings or would it need custom drivers?

Improve this question

2 Answers 2

Reset to default
2

No. Most brainwallets (assuming a more conventional brainwallet like one from brainwallet.org and not a seed-based one) are made by passing a passphrase through one round of SHA256. ASICs are designed to do two rounds.

Improve this answer
4
  • Yeah, that's what I thought. So we can conclude the quote from the bitcoin.it wiki is actually incorrect?
    – Anders Braüner Nielsen
    Apr 13, 2014 at 17:39
  • Assuming what I have said is correct, they are probably talking about GPU/CPU mining. According to bitcoin.it, the article was last updated in August 2012. I don't think ASICs were even thought about much back then.
    – Brian Kieffer
    Apr 14, 2014 at 17:53
  • 1
    All Bitcoin mining ASCIs that I am aware of are incapable of hashing arbitrary data even with double-SHA256 - they have bitcoin block hashing hardwired in so they can brute force the nonce on-chip.
    – ryanc
    Aug 19, 2015 at 15:14
  • I was thinking you might be able to make it work for strings that are as long as a block header but then technically, an optimal ASIC chip takes only as input a partial block header (difficulty is encoded) and will only output an arbitrary hash (maybe even only the nonce) of something guaranteed to be different from the input so yeah...you couldn't even get the double-SHA256 of string of the right length even.
    – jeteon
    Feb 13, 2016 at 7:39
3

What follows is an educated guess, not certain statements, and is based on Electrum's brainwallet phrases (just figured it'd be a good example), not other schemes or human-generated ones.

No, a miner can't easily be tricked into doing it (e.g. solely by a rogue pool), but can be programmed to try to crack brainwallet phrases. This is because ordinary hashing involves totally different inputs (a block header and nonce, hashed twice) than brainwallet cracking (a random 128 bit seed, hashed 100,000 times).

You'd do this by trying random 128-bit seeds, through Electrum's algorithm, which involves taking the seed and running 100,000 SHA256 hashes on it (maybe some other stuff I'm missing would make it more difficult). You can then do a few more calculations to come up with the addresses that the key generates, and check the blockchain to see if any of these match.

The current network hashrate is ~50,000,000 GH/s. If all of that were instead put towards breaking everybody's Electrum keys, and all it takes is the 100K hashes, there'd be 5*10^11 out of 2^128 checked every second. You could check all of the keys in about 2*10^19 years, or 1.6*10^9 times the age of the universe. While you'd probably get collisions long before this (dependent on how many Electrum-generated addresses are in use), I think this gives you an idea of the infeasibility of this sort of attack.

Improve this answer
3
  • Thanks you for the good answer - good to know we're safe with Electrum.
    – Anders Braüner Nielsen
    Apr 10, 2014 at 23:11
  • In the Bitcoin.it Brainwallet wiki the example seems to be just one SHA256("Passphrase") to generate one private key though - does this make sense? Does the "using the same equipment" quote make sense? (As in running billions of SHA256(dictionary[eg "correct horse battery staple"])-like private key generations?)
    – Anders Braüner Nielsen
    Apr 10, 2014 at 23:18
  • Yes, I think that you'd be able to give your miner different common phrases/word combinations to try with that scheme as well. You'd have to guess what phrases and schemes (e.g. single SHA256, double, or anything else to come up with a 256 bit number/private key) people are likely to come up with for it to be most effective.
    – Tim S.
    Apr 11, 2014 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.