Re: [bitcoin-dev] Time to worry about 80-bit collision attacks or not?

[Rusty Russell <rusty@rustcorp.com.au>]

Gavin Andresen via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> writes:
> How many years until we think a 2^84 attack where the work is an ECDSA
> private->public key derivation will take a reasonable amount of time?

vanitygen can generate keypairs pretty fast (on my CPU it's comparable
with hashing time), and there are ways to make it faster.  Since you can
generate multiple script variations, too, I think hashing is the
bottleneck.

Antminer S7 can do 4.73 Terahash per second for $1.2k.  (Double SHA, but
let's assume RIPEMD160(SHA256()) is the same speed).

766,760,562,123 seconds to do 3*2^80, so you'd need over 200 million
S7s to do it in an hour.[1] If you want to do that for $1M, wait 27
years and hope Moore's Law holds?

Also, a colleague points out you could use this attack against a site
like bitrated.com which publishes one side's pubkey, giving you a much
longer attack window.
     
Cheers,
Rusty.
[1] Weirdly, the bitcoin network is doing this much work every 57
    days, for about $92M.  If that's all the attack costs, it's under
    1M in 10 years.