I read here:

In Bitcoin, a private key is usually a 256-bit number ...

Although it is a silly question, is this length safe?

Based on this site, Elliptic Curve 256 bit keys are safe until 2040. Does Bitcoin network change its key size in that far future?? If Bitcoin reaches 2040, what happens to many wallets that use 256 bit keys?

up vote 6 down vote accepted

Bitcoin uses the secp256k1 elliptic curve with 256 bit private/public key pair cryptography to render ECDSA functionality. The two bitcoin explorer (bx) commands below replicate statements/results in the site references above. Note the private key is a 256-bit hexadecimal encoded number.

% echo "e9873d79c6d87dc0fb6a5778633389f4453213303da61f20bd67fc233aa33262" | bx base58check-encode -v 128

5Kb8kLf9zgWQnogidDA76MzPL6TsZZY36hWXMssSzNydYXYB9KF - is the associated uncompressed private key that is encoded using base58 check, also called Wallet Input Format (WIF).

% echo "e9873d79c6d87dc0fb6a5778633389f4453213303da61f20bd67fc233aa33262" | bx ec-to-public -u | bx ec-to-address -v 0

1CC3X2gu58d6wXUWMffpuzN9JAfTUWu4Kj - is the address corresponding to the associated uncompressed public key.

If I were a hacker that wanted to compromise secp256k1, I would first compromise the top 100 rich list wallets that are not using multisig first. Bitcoin is the most excellent canary in the cryptographic coal mine to determine when secp256k1 fails. The banking system would never be such a good crypto-Samaritan.

From Table 1 the elliptic curve subject matters experts assert the strength of a 256-bit secp256k1 private key has the strength of 128 bits of encryption when the associated public key is exposed. To brute force attack a public key to obtain a public key with 128 bits of entropy will cost at least $100M in electricity at 5 cents per KW-Hr using almost perfectly efficient quantum computers. It is mostly supposition to arrive at projections for when an mathematical back doors for compromising secp256k1.

You can read about Shor's algorythm. The Bitcoin Community is very shrewd concerning planning for quantum computing attacks. Also, the NSA issued some interesting warnings concerning Suite B technology a few months back, but those pages are no longer publicly visible.

No telling what path the Bitcoin community will take, but I assure you the hardfork will be much faster than trying to double Bitcoin's maximum blocksize.

  • 1
    If the minimum it would cost to brute force is $100M, we may be approaching the point of relevancy. The largest Satoshi wallet now contains $422M of bitcoins. – Eli Aug 9 '17 at 6:30

You merely took a look at what a single entity this website talks about said in a very generic way. There are others which for 256 bit just say for example "> 2030" without stating an upper bound. That's because it isn't known.

You can't simply say that ECDSA with n bit is secure and ECDSA with n-1 bit isn't. There is a lot to be taken into account, like the elliptic curve being used, or the incentive and the resources of an attacker.

One can't simply brute-force their way to a 256 bit key. One has to find a vulnerability a smart way. As long as this doesn't happen, bitcoin is secure. And no one can predict whether, let alone when this will happen (if it will happen) until it is proven to be feasible or proven to be infeasible.

  • 2
    Nice picture, but unfortunately, forging an ECDSA signature for a 256-bit curve only requires around 2^128 EC group operations... equivalent to counting to ~2^140, not 2^256. Still infeasibly much (right now), but many orders of magnitude less than what is claimed there. – Pieter Wuille Aug 25 '16 at 16:08
  • Thanks for your response, I know that the elliptic curve being used, incentive, and the resources of an attacker are important factors. However, in the bitcoin sample incentive and the resources of the attacker could be very large! – Tail of Godzilla Aug 25 '16 at 16:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.