If it is any help, you misspelled that pretty severely. Provided your GF did not also do that and your misspelling it here was not intentional to make it slightly more difficult for others to try and find your passphrase, make sure you spell it correctly if you are using it to narrow the search space:

2,4-dinitrophenylhydrazine

(with or without capital "D" for "Dinitro" as per her habits)

Folks.

This whole argument is purely theoretical nonsense.

The practical reality is that there is not one single 3rd party generated key that Evil can crack with his software. The flaw in the hypothesis is the point that "it has to be a weak address".

The word "weak" here does not mean "weak" as in "not strong". It is a misnomer. By deliberately generating a "weak" address you are basically telling the software what the private key is (relatively to feeding the hacking software a random address).

Public private key encryption security is based on ** probabilities **. Please put the word "weak" out of your heads and instead consider the fact that you are drastically modifying the solution domain for the address generation algorithm. This changes the nature of the key because it impacts on the probability of solution.

The correct measure of whether a weakness has been found is being able to crack *any* address with a significant probability, not "pre selected" addresses that happen to suit your particular hack algorithm. As Evil said himself in response to my analogy with sandgrains, it's like sending 100,000 people to all the beaches looking for a blue ball. Well that works if you know they have to go to a beach, but the fact is that you don't. Evil's algorithm **assumes** this by arbitrarily picking the rendezvous points.

Watch Evil's video at 0:20. http://www.youtube.com/watch?v=TC43aOdsf4g&hd=1

He says:

my random address generator is... "just generating bitcoin addresses that are potentially weak". The word "weak" here is used as if those addresses have some kind of hackability about them. Whereas what in fact has happened is that Evil has generated addresses deliberately close to the rendezvous points, thereby "telling" the hacking software where the solution domain is. It's a bit like me telling my password cracker that my password contains the letters "t, e, w, y, s, a and r" and then saying - "hey look - it cracked it" ! Well obviously because I basically told the hacking software what the password was, it just had to re-arrange the letters.

i.e. What evil is doing is modifying the data to fit the required result. He is not finding weaknesses in bitcoin addresses, he is creating a set of locks and then creating a set of keys that fit those locks.

You're interested in cryptography "weaknesses" ? R.O.T.F.W.L. !

Well, you've come to the right place. Don't bother with the worlds greatest computer science labs, PHD research or reading military grade specifications - those folks are clueless. Bitcointalk is the bleeding edge and any new developments will ONLY appear on here !! (Specially when it's supplied by a raving Youtube researcher who thinks he's cracked Elliptic Curve DSA cryptography and can't get hs point across for swearing at his telly   )

Seriously though, EK's software is PISH. It couldn't crack an egg without being given the answer to start with.

It's main design objective is not to create history but to create 2 bitcoins from unsuspecting wide eyed victims *.


(Small Print)
* although I'm having a bit of fun with EK and don't wish him any genuine malice, he is fair game since a) he's trying to claim that he's discovered a phenomenon called "weak address space" which actually only exists within the definitions of his own software and b) he's trying to scam people out of 2 bitcoins for a piece of PISH software and that's actually quite a lot of money these days

If you check-out this link: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html

apparently some hardware wallets have crappy "random" numbers that are not random at all(a very common problem
with code)

another reason I prefer to just stick with the official client

No. it is not "pish" as well and I am genuinely sorry you lost your coins. It's not a pleasant experience to be robbed.

At the same time, there is a huge amount of fearmongering drama surrounding the whole security issues of bitcoin and for that matter other cryptocurrencies. It leaves everyone paranoid, convinced that they have been victims of whatever security "hole" is currently under discussion. You've just been caught up in the crossfire of this and I didn't mean to patronise you, even in jest, so for that I apologise.

Regarding the security "fearmongering" though, it's a bit like everyone being paranoid about terrorism when they've actually got nil chance - practically - of ever being a terrosism victim, while at the same time not caring 2 hoots about thousands of road deaths that go on all around them every day.

We need to separate things out. First of all, Nils Schneider's post (http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html ) is dealing with a very different phenomenon than Evil Keneivil's.  The Schneider phenomenon is basically to do with wallets that don't comply fully with the address generation specification (by repeatedly using the same random number to generate addresses). So it's a problem of the wallet, not the mathematics. It's basically leaving the door unlocked and can be put down to "faulty wallet" design.

On the other hand, EK is claiming that there are certain "legitimate" addresses that are somehow "weak" or "more hackable" than others.

My point is that it is irrelevant because his definition of "weakness" is pre-biased to fit his test of hackability. A bit like if I write down a number between 1 and 10, then ask you do guess it. Then you guess the correct number, I can then retrospectively define my chosen number as having been "weak". The reality is that any other number would have been equally secure by probability.

That's why I say that the only test that matters regarding EK's software is to crack an arbitrary, specification compliant bitcoin public key, which he will not be able to do.

(By the way could you point me to your thread where you discuss your coin loss ?)

Fair enough, tok, thanks - apologies to you too if I went off a bit at you.

Wrt the coin loss, it wasn't a theft. The missus had mined some coins way back in the day on her laptop and the wallet was lost when the machine was binned. We know the address but have no means of accessing it. That's all it is. Probably will never see the light of day again, but when EK started this thread, it immediately caught my interest for that reason.

Anywho, thanks for clarifying that it's not related to the Nils Scneider post. Like I said, I'm not at all well-versed in any of this stuff. Just reading along

Rit.

Using this algorithm would require 2^255 tries on average. Using Shanks' algorithm would require only 2^128 tries (along with O(2^128) space), worst case, currently no better algorithm is known. However, without knowing the public key the dlp-breaking algorithms can't be used, so the only thing that can be done is randomly searching through the whole space, like your first algorithm.

Hah!

Me first me first

That appears to be exactly what the OP is investigating in this thread: https://bt.irlbtc.com/view/433522.0;topicseen

I'm not familiar enough with the mathematics of it to really understand the conclusions, but there was a lot of talk about collisions at one point. I don't know how that reflects on the veracity of the program offered in this thread though.

Rit