[bitcoin-dev] Time to worry about 80-bit collision attacks or not?

Rusty Russell rusty at rustcorp.com.au
Mon Jan 11 03:57:15 UTC 2016

Gavin Andresen via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> writes:
> How many years until we think a 2^84 attack where the work is an ECDSA
> private->public key derivation will take a reasonable amount of time?

vanitygen can generate keypairs pretty fast (on my CPU it's comparable
with hashing time), and there are ways to make it faster.  Since you can
generate multiple script variations, too, I think hashing is the

Antminer S7 can do 4.73 Terahash per second for $1.2k.  (Double SHA, but
let's assume RIPEMD160(SHA256()) is the same speed).

766,760,562,123 seconds to do 3*2^80, so you'd need over 200 million
S7s to do it in an hour.[1] If you want to do that for $1M, wait 27
years and hope Moore's Law holds?

Also, a colleague points out you could use this attack against a site
like bitrated.com which publishes one side's pubkey, giving you a much
longer attack window.
[1] Weirdly, the bitcoin network is doing this much work every 57
    days, for about $92M.  If that's all the attack costs, it's under
    1M in 10 years.

More information about the bitcoin-dev mailing list