OK - that's a solid statement.
But he only makes the stats for the least 32 bits, and not for the entire numbers - it doesn't matter?

So you are saying that there is no way for the numbers ending with a certain value (of the last LSBs) to have a certain set of the optimal "randezvouz points" to start with, for cracking?
I mean, a different set of "randezvouz points" for different values of the last LSBs - obviously.

EDIT:
Maybe not even a set of points - maybe it is as simple as a single "randezvouz point" for each specific value of the LSBs.
Are you sure that we are talking about a total nonsense here?
Because if he manages to prove by statistics that there is such a correlation, then building a complete rainbow table for mapping N LSBs to a specific randezvouz point should be just a matter of time.
And when/if it happens - then it is 'goodbye bitcoin'.

gweedo why dont u put there 1BTC o nthe wallet if you believe he cant crack it. 16$ doesnt sound like u really are not worried.

I'd like to see what happens with this. Just because it hasn't been done in a couple of hours doesn't mean it CAN'T be done.

As has been well established on this thread, this is a rainbow table attack, and one of those 200,000 keypairs could lie within reach. Remember that we have NO IDEA how keypairs are spread along the curve, so it's not possible to tell how "weak" an address is before it's tried.

gmaxwell has the massive advantage of the entire space to choose from, obviously, but there is a possibility (however vanishingly small) that he could get caught here.

Give it some time

Rit.

PS: I also agree this is a valuable experiment, even if it comes to nothing. A security system claiming to be this unbreakable *needs* someone to try to prove it wrong sometimes - otherwise stagnancy sets in and no progress is made.

oih missed that post somehow.

Not necessarily. It would prove one of two things. It's either been broken or that he's lying that he can break it. Not the fact that it "could still" be broken .

That is only 20000 addresses - gmaxwell gave 10 times more...
It's BTW also a good input into the research - so if he loses I promise to refund him with 10BTC

What are you watching?  This thread?  Sorry.

Hey, I remember that from when you first posted it!  That was a very long time ago in Bitcoin time.

Can I ask one of you mathematical guys to tell me what is the difference in what EK is doing, as opposed to what I am doing atm.

A little background:

My missus mined BTC back in early 2010 on her laptop. She got 200 BTC and paid out 1 for something. She had the wallet on a defunct macbook, long since gone to the great landfill in the sky. But she has her address. So...we work from that. I've found her on the Blockchain, and am trying to crack the wallet to get the BTC back. I know 199 seems a small amount, but it's life-changing for us. She did remember <something> about her wallet - she used a brainwallet system, picked a passphrase, and promptly forgot it. She's unsure, but she reckons it was about 8-12 words long, and one of the words was "2,4 Dynitrophenylhydrazone". In other words, she was being a smartarse and trying to show off her vocab and education.

So I've run a dictionary attack (cobbled together from many different sources) against it for about 6 months now, with no success.

Recently I've adopted a different approach, which I am running in parallel.

Her address starts with "12g". I have been using Vanitygen64 to generate keys at approx 25000 per sec with this pattern. This then compares against her (our) key to see if it fits. It's been running for several weeks now with no result (I won't lie, I've also picked a few other interesting, apparently dead addresses starting with 12g to attack in the meantime - the compare time is negligible). The range of "interesting" keys is approx 1500.

So, to multiply 1500 by 25000, we get 37500000. Every second.

Looking at the size of the name space, this is irrelevantly small. I can probably expect a result shortly after the sun puts on it's snowhat, but nevertheless, I want that damn wallet.

Can someone knowledgeable please answer this question:

Is what I am doing any less efficient than EKs method? I think not. I'm reducing the namespace (in theory) by a factor of 58^2. But this is not enough to make a difference. I might be here all yea, I might hit it tomorrow.

The man obviously has serious mathematical knowledge, but in the case of trying to crack an elliptic curve, is it actually any use? And I have about the same odds to hit I reckon?

Thanks,

Rit./