Ethereum users could generate new accounts for each transaction they make, which would greatly increase the number of accounts being used to receive ether.

Would it be possible (and profitable) for someone to find collisions in the ethereum address space in order to steal ether or access contracts?


What you are talking about is sometimes referred to as "mining private keys". Since every 64 hex string technically is a private key, you could hypothetically guess random strings of numbers, check to see if they have any ETH in them, and then run off with the funds.

However, it's not profitable or really even plausible. The number of combinations you would need to test would take thousands and thousands of years using a massively expensive computer, and even then, the amount for electricity used "mining" would not cover the the amount of ETH found. Not even close.

I have been doing a bit more research since people seem to be concerned about this. Ethereum uses 256 bit keys, which is what a LOT of technology uses to secure things. So, if someone manages to break 256 bit keys then there is a LOT more that is going to go wrong than your lost Ethereum. Like, a LOT more. You should also know that Bitcoin also uses 256 bit keys and it hasn't been a problem there even though there are waaaay more keys in use than Ethereum.

Longer key lengths are better, but only up to a point. AES will have 128-bit, 192-bit, and 256-bit key lengths. This is far longer than needed for the foreseeable future. In fact, we cannot even imagine a world where 256-bit brute force searches are possible. It requires some fundamental breakthroughs in physics and our understanding of the universe.

One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)

Given that k = 1.38 × 10−16 erg/K, and that the ambient temperature of the universe is 3.2 Kelvin, an ideal computer running at 3.2 K would consume 4.4 × 10−16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.

Now, the annual energy output of our sun is about 1.21 × 1041 ergs. This is enough to power about 2.7 × 1056 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2192. Of course, it wouldn't have the energy left over to perform any useful calculations with this counter.

But that's just one star, and a measly one at that. A typical supernova releases something like 1051 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.

These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Shameless stolen from lynks over on the security StackExchange


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.