Hacker News Reader

Comment by 0x0 | Hacker News Reader

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site?

Edit: probably wrong, see below

View on HN

It requires substantially more compute power to match "facebookcorewwwi" vs just finding a hash with a prefix of "facebook" that looks readable. Good luck hashing the remaining eight characters!

Well, it would just take twice as long as hashing the first 8... /s

I realize that was sarcasm.

But for the non-hash-aware among us, it would take on average 2,147,483,647 as long to brute force the last 8 with the same computing power and 4,294,967,295 as long to hash every combination of the last 8. This all assumes no vulnerabilities in the algorithm, of course.

It's base32, not base16, so you're off by several orders of magnitude - numbers should be 549,755,813,888 and 1,099,511,627,776.

I believe you are correct. I appreciate the correction.

Normally you brute force vanity addresses by having a range of acceptable outcomes, whereas to brute force a specific vanity address* you are only targetting a single outcome.

So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match.

* Actually any address, it's not limited to brute forcing vanity addresses.

I guess I incorrectly assumed the process would be repeatable, but now I see that getting a specific duplicate equals bruteforcing the entire key space - even if the prefix is a chosen vanity name. I confused it with the effort of getting a similar address where just the vanity prefix needs to match.

Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist.

According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key"

I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar.

[1] https://www.reddit.com/r/theydidthemath/comments/1x50xl/time...

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want.

The time calculation assumes our current computers and disregards Moore's law.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here:

> It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key.

Let's assume that Moore's law is true for forever. In 300 years we will have a super computer capable of cracking a single AES-256 key in 37 millennium. However claiming that Moore's law will stay the same for 300 years when many think it won't last 30 is foolhardy.

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference.

What? Why is brute force impossible to code? I don't understand what you're claiming.

I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

Shores algorithm doesn't break anything. It just reduces the key space. Considering the major increase in energy costs and major lag in computational power of quantum computing, shores algorithm won't be a threat to today's crypto for hundreds of years to come.

It reduces key space for most symmetric algorithms, but completely breaks RSA and ECC making them run in polynomial time.

> What? Why is brute force impossible to code? I don't understand what you're claiming.

You claim that a reversible algorithm takes zero time. I said that requires a reversible algorithm that applies to an arbitrary AES-256 key which is currently thought to be impossible.

Brute forcing is not breaking but instead simply enumerating the key space and is subject to the slow downs we are talking about here.

> I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

But you are missing the point of cryptographic systems, the goal typically isn't to be forever uncrackable, it is to be effectively forever uncrackable which includes upgrading the strength of your cryptography over time.

If we were talking about cracking crypto within 100 years then maybe we could talk about reasonable fear, but all of these things involve timelines that are longer than that (including quantum computer work).

>You claim that a reversible algorithm takes zero time.

No, you misread my comment. Reversible computing can take almost no energy.

.onion addresses are just 80 bits, not 256. Someone estimated[1] that the amount of work to brute force one address is approximately the same as the amount of hashing that has been computed by the bitcoin network up to now, so it's clearly not physically impossible. This weakness is apparently a practical problem, because it made people unwilling to automatically issue SSL certificates for .onion addresses [2].

[1] https://news.ycombinator.com/item?id=11388997 [2] https://blog.cloudflare.com/the-trouble-with-tor/

Reply on news.ycombinator.com