Hacker News Reader

Comment by dwaltrip | Hacker News Reader

This is considered one of the most unbreakable aspects of bitcoin. It would take all the hashing power in the world something like 10^50 years to brute force the private key (a.k.a. ain't gonna happen). One cool thing, if the address has never been spent out of it (only received coins), it is theoretically still safe from quantum computers.

View on HN

Second time I read this. How so? The address has been used to receive coins, surely a private key must exist?

A private key is not strictly necessary to receive coins, only to spend them. So while there is still probably a private key with that address (since he intended to actually be able to use those bitcoins), the public key is not revealed unless coins are spent from that address.

But the public key must be linked to the address, or else you could not confirm the public key belongs to that address. Right?

Yes, but this information is not published to the blockchain until you spend it.

The address is literally RIPEMD-160(SHA-256(public key)), plus a 4 byte checksum. To receive coins to that address, the sender publishes the amount they are sending and that address, they never see the public key.

When the owner of the address wants to send bitcoins from it, only then do they publish the public key, along with a transaction signed by their private key.

Ok, so I'm not a cryptography specialist, but I don't see how "address = RIPEMD-160(SHA-256(public key))" makes it impossible to derive the public key from the address if you have a quantum computer. Or is SHA-256 not vulnerable to quantum computing the way public/private keypairs are?

Yes that is correct. SHA256 is not known to be vulnerable to quantum computers[^], ECDSA (Bitcoin's public/private key algorithm) is.

[^] There is a known quantum attack against SHA256 that reduces the brute force search space from 2^256 to 2^128, but that wouldn't really break the Bitcoin protocol. The ECDSA quantum vulnerability, however, would make ECDSA essentially useless.

Reply on news.ycombinator.com