<blockquote>
  <p>I am not asking because I want to do this, rather I want to understand what mitigates this threat vector. I understand the total number of key pairs is massive, but it seems like someone could build a collision farm to hammer out key pairs.</p>
</blockquote>

<p>Someone could, but because the total number of key pairs is massive, there would be no point. They could instead build a mining farm or put their money in interest bearing securities and have a probability of making a profit several trillion times higher.</p>

<p>Let's look at the probability of them making at least a single Bitcoin. At most, 21 million accounts can contain one Bitcoin or more. So they have to find one of 21 million key hashes out of 2^160 possible hashes. Let's assume their farm includes a billion cores, each of which can try 2 billion keys per second. In one hundred years, their probability of success would be approximately one in a ten billion billion.</p>

<p>So for a one in ten billion billion chance of making one bitcoin in a hundred years, they'd need a billion cores, each of which is trying two billion keys per second. Seems like they'd find something else to do with their time, doesn't it?</p>

CC BY-SA 3.0
2014-06-09T15:32:59.610Z
I understand the math hurdle for computing all possible addresses, but one wouldn't have to find **all** addresses in order to get a return on the investment.  I would assume there would be low hanging fruit from people using bad brain wallets, no?
Dscoduc
CC BY-SA 3.0
2014-06-09T19:49:57.583Z
@Dscoduc The question is about key collisions, not bad brain wallets. Of course a bad wallet will be insecure.
David Schwartz
CC BY-SA 4.0
2021-12-04T01:37:25.167Z
why are the amount of hashes 2^160?
Maxim
CC BY-SA 4.0
2021-12-16T21:22:10.270Z
160 bit hashes are used. Each bit has two possible values.
David Schwartz
CC BY-SA 3.0
2014-06-09T04:38:54.353Z
2014-06-09T13:35:50.883Z
2014-06-09T13:35:50.883Z
David Schwartz
<p>Is it possible to be profitable by developing a collision application that continually and automatically generate a key pair, check for the existence of the public address in the block chain, and then extract any funds that are found on matching key pairs?</p>

<p>I am not asking because I want to do this, rather I want to understand what mitigates this threat vector.  I understand the total number of key pairs is massive, but it seems like someone could build a collision farm to hammer out key pairs.</p>

CC BY-SA 3.0
2014-06-09T01:43:46.740Z
I found this [article](http://download.wpsoftware.net/bitcoin-birthday.pdf) which has some interesting points...
Dscoduc
<security><key-collision>
How likely are key pair collision attacks?
Dscoduc
# How likely are key pair collision attacks?

(Asked by: username_0 on 2014-06-08)

Is it possible to be profitable by developing a collision application that continually and automatically generate a key pair, check for the existence of the public address in the block chain, and then extract any funds that are found on matching key pairs?

I am not asking because I want to do this, rather I want to understand what mitigates this threat vector. I understand the total number of key pairs is massive, but it seems like someone could build a collision farm to hammer out key pairs.

**Tags:** security, key-collision

> **Comments:**
> **username_0**: I found this [article](http://download.wpsoftware.net/bitcoin-birthday.pdf) which has some interesting points...  

---

## 1 answers

### Answer by username_1 on 2014-06-09. Score: 4

> I am not asking because I want to do this, rather I want to understand what mitigates this threat vector. I understand the total number of key pairs is massive, but it seems like someone could build a collision farm to hammer out key pairs.

Someone could, but because the total number of key pairs is massive, there would be no point. They could instead build a mining farm or put their money in interest bearing securities and have a probability of making a profit several trillion times higher.

Let's look at the probability of them making at least a single Bitcoin. At most, 21 million accounts can contain one Bitcoin or more. So they have to find one of 21 million key hashes out of 2^160 possible hashes. Let's assume their farm includes a billion cores, each of which can try 2 billion keys per second. In one hundred years, their probability of success would be approximately one in a ten billion billion.

So for a one in ten billion billion chance of making one bitcoin in a hundred years, they'd need a billion cores, each of which is trying two billion keys per second. Seems like they'd find something else to do with their time, doesn't it?

> **Comments:**
> **username_0**: I understand the math hurdle for computing all possible addresses, but one wouldn't have to find **all** addresses in order to get a return on the investment.  I would assume there would be low hanging fruit from people using bad brain wallets, no?  
> **username_1**: @username_0 The question is about key collisions, not bad brain wallets. Of course a bad wallet will be insecure.  
> **username_2**: why are the amount of hashes 2^160?  
> **username_1**: 160 bit hashes are used. Each bit has two possible values.  

---

