69

Here's a what-if scenario:

Person A has a Bitcoin address with 25BTC. Person B opens up their Bitcoin client:

  • which may or may not have the complete blockchain (the latter would mean no copies of Person A's transactions)

Person B presses "New Address", and Person A's address happens to somehow be generated. Now, the blockchain finishes synchronizing.

What happens? Is this a possibilty, sans the astonishing improbability? After all, random number generation can be influenced.

Improve this question
7

5 Answers 5

Reset to default
40

If this happens, then Person B will be able to spend person A's bitcoins. However, there are only two ways this can happen:

a) Person B generates the same keypair (private key) as person A

or b) Person B generates a different keypair, which (public key) hashes to person A's address (a hash collision)

Take a look at the specification for at bitcoin address: https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses

A Bitcoin address is a 160-bit hash of the public portion of a public/private ECDSA keypair

For "a" to happen, person B would need to break "secp256k1". I am no expert on this field, but from what I can find on bitcointalk.org, then the "strength" of this is 2^128 bits. And if you're wondering how strong that is, then look for the video "Exhaustive search attacks" from Dan Boneh. 11 minutes in the video he says "anything that's bigger than 2^90 is considered sufficiently secure" (its about attacking 3DES, which is a symmetric block cipher so I'm not sure it actually apply to secp256k1, but I really have no better argument for why 2^128 is "so secure that you won't never, ever, ever generate the same key as someone else"

And for "b" to happen, you would need to find a collision on RIPEMD-160(SHA-256(pk)). As far as I know, then neither RIPEMD-160 nor SHA-256 is known to have any vulnerabilities to hash collision attacks. So somehow breaking both or randomly generation a key which hashes is exactly the same as another bitcoin address, is highly unlikely.

There is also a chance for you computer to catch on fire, and some of the materials to melt together into a lotto coupon with winning numbers on (and a valid barcode), but it just won't happen because of the chance is so unbelievably small (it's the same with the "click and generate another persons bitcoin address").

EDIT Woops, one important thing: This all assumes that all bitcoin addresses are properly generated using "true random". All brain-addresses and addresses generated using a bad PRG, might be easy to find by either using a flaw in the PRG or exploit the (flaws in the) human brain.

Improve this answer
7
  • 2
    Your case "b" is a (multi target) second pre-image, not a collision. You want to match the hash of an existing message you can't influence. A collision would be Person B creating two distinct inputs with the same hash.
    – CodesInChaos
    Mar 19, 2013 at 11:51
  • 2
    But are all addresses verified to check for duplicates when the blockchain is synchronised by your address generating client? If there is an address collision, wouldn't it cause serious confusion and possibly substantial financial loss (if funds are transferred to person b's account since they were under the illusion they controlled it?) Can we avoid person b losing funds by alerting them an address they generated, has actually since been detected while they caught up with the blockchain? At least then person b knows to wait for sync before asking for payments to this address.
    – deed02392
    Oct 20, 2013 at 12:16
  • 1
    I'd say "collision" is the right concept here, because any address being regenerated (by anybody) is trouble already. The suggested alternative would imply that a single person would actively try to find such a collision, which I guess could then indeed be described as some kind of ("second"?) pre-image attack.
    – user6049
    Dec 15, 2013 at 15:27
  • 1
    I believe case A will be far more common once Bitcoin becomes mainstream. Lots of people will use weak private keys, and plenty of them will use the same as another random guy, resulting in them both spending each other's coins :(
    – Joe Pineda
    Mar 24, 2014 at 13:09
  • 2
    There is also a chance that the software in your bitcoin client is fubar. Or that the network service that it uses for random seed fails. Such as arstechnica.com/security/2015/05/… !!!
    – user13120
    Oct 8, 2015 at 8:00
30

This is the way I see it. The total number of bitcoins that will ever be mined is 21 million. The smallest bitcoin unit is a satoshi (0.00000001 BTC). If we place all possible satoshis into a wallet of their own, we would get the maximum number of wallets that could have any balance to them (so the actual number of wallets with bitcoins is obviously less). This is 21x10^6(BTC) x 10^8 (satoshi/BTC) = 21 x10^14 wallets. It's a huge number, but it's eclipsed by 2^256 possible wallets. So in this worst case scenario, the probability of guessing a wallet with one satoshi is 21x10^14/(2^256)=1.813595x10^-62. An incredibly small number.

Improve this answer
4
  • 6
    By the Birthday Problem, the odds of two people have the same address in that situation would be about 1-e**(-((21*1014)**2)/(2*(2256))) . That's like 1 atom compared to the number of atoms in the Earth. Quite small.
    – Eyal
    May 3, 2013 at 7:08
  • 6
    This answer doesn't address the main question "What would happen if two users generated the same address?", rather just evaluates the likelihood of the question being relevant, which the asker already seems to have been aware of. This answer would be a better fit on e.g. How many Bitcoin addresses are there? or Is it possible to brute force bitcoin address creation in order to steal money?.
    – Murch ♦
    Mar 24, 2014 at 12:51
  • +1 for details on how unlikely (unprofitable) brute forcing an existing address is
    – Ron
    Sep 29, 2015 at 4:51
  • 3
    Actually, there are only 2^160 possible addresses. More than one private key (of which there are 2^256 possible ones) would hash to the same address.
    – jeteon
    Nov 12, 2016 at 20:45
3

A slight addition to the existing answers:

If B has not downloaded enough of the block chain to see A's transaction, then the situation will be as described above. When blocks are downloaded by a wallet client, the transactions therein are checked to see whether any of them send coins to addresses held in this wallet. If so, those coins are added to the wallet's balance. So B will see an extra 25 BTC appear in his wallet. As mentioned in the other answers, he'll be able to spend them as if they were his own. So it's a race between A and B to see who spends them first - either can do it.

If B has already downloaded the relevant transactions before generating the colliding address, the situation is a little different. As far as I know, most Bitcoin clients, when generating a fresh random address, will not rescan the block chain to see whether it contains any transactions sending coins to that address. (As described above, the probability of this happening is infinitesimally small, so for all practical purposes, such a scan would just be a waste of time and resources.) So although B now has a private key which can spend A's bitcoins, he will not be aware of it, unless/until he manually forces a block chain rescan (e.g. with Bitcoin Core's -rescan option), or checks his address balance using an online block explorer, or something of the kind.

Of course, barring RNG faults, this question is sort of like asking "If all 50 US state governors were simultaneously struck by lightning, how would the stock market be affected?" It's based on such an improbable assumption that it's kind of absurd to draw any conclusion.

Improve this answer
1
  • This answer actually answers the question the OP asked, rather than a completely different question that answerer wants to answer. But even this answer could not resist throwing in a disclaimer about why it is dumb to even ask such a question, despite the fact that the OP explicitly acknowledged the "the astonishing improbability" in the question. Such is the level of discourse in the bitcoin universe (which, everyone must chime will not exist long enough for any undesirable bitcoin thing to ever happen).
    – bigjosh
    Dec 29, 2022 at 23:17
1

I suspect the simple answer is that Person B would be able to spend Person A's bitcoins, as he would show up in the ledger as owning them. Not dissimilar from simply giving someone your wallet.

Improve this answer
1
  • 3
    I'm not sure that this is fundamentally different than Nicolai's answer. Nicolai just goes into more details. i.e. whether it was just a public key hash that collided or a true duplicate key pair. As well as details on the improbability of that happening.
    – David Ogren
    May 3, 2013 at 13:20
-5

Funny how people claiming to know about crypto can't calculate probabilities.

The address space of 2128 is not the probability or "strength" of anything (other than the probability of picking a value in the address space).

The probability of 2 people having the same bitcoin address is actually a lot higher than people may suspect by (faulty) intuition.

In fact, the likelihood of collision is related to the Birthday Problem (read about it).

As the number of people and addresses generated increases, likelihood of a collision increases close to exponentially.

Given a few million users each generating a new address per month, the likelihood of a collision is such that it could occur several times in a lifetime, especially as we're dealing with hashes (or hashes of hashes).

Make it a billion users and you have regular stories of collisions appearing.

Improve this answer
4
  • 6
    Actually, the probability of a collision goes up as the square (i.e. quadratically) of the number of bitcoin addresses used. Not exponentially. Now, with that correction the probability of a collision is approximately zero in the lifetime of the solar system.
    – Neal Gafter
    Feb 17, 2013 at 6:47
  • 1
    I believe that I am reading wikipedia there needs to be ~2.2×10^19 bitcoin address until there is a 50% probability that there has been at least one collision. So basically don't worry.
    – placeybordeaux
    Feb 18, 2013 at 3:05
  • 1
    Birthday problem on 160 bit bitcoin addresses doesn't apply, since collisions are irrelevant. It's a second pre-image attack which has cost (2^160)/n where n is the number of targets. So if all 21 million bitcoins are already mined, you need to calculate (2^160)/(21*10^6) = 7*10^40 = 2^135 hashes per stolen bitcoin. Which is not profitable (by far), even if you assume bitcoin is used for all of our economy.
    – CodesInChaos
    Mar 19, 2013 at 11:57
  • -1 for this incorrect answer. Here's my attempt at explaining the issue: Having users generate N addresses (which could be 1000 times the number of users) leads, typically, to approximately one bitcoin address collision in the entire system of addresses (yes, it is bad enough if any two addresses match) once N^2 = 2^160 or N = 2^80. So until we come into the vicinity of a billion times a billion users, we won't see a collision. The only reason we don't have N^2 = 2^256 or N = 2^128 is that the public key is weakened by hashing to a 160 bit public bitcoin address.
    – user6049
    Dec 15, 2013 at 15:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.