Bitcoin Puzzle 135 / Satoshi Wallet Update
ContextEarlier this year, we found (and it sounds silly) that we can train a neural network on the x-coordinates of a bitcoin wallet’s public key and (with non-random accuracy) recover the first 4 to 5 bits. . .
ContextEarlier this year, we found (and it sounds silly) that we can train a neural network on the x-coordinates of a bitcoin wallet’s public key and (with non-random accuracy) recover the first 4 to 5 bits of the private key. We spent the past 4 months investigating why this approach was working*. *Be warned. We wade deep into elliptic curve theory. FindingsHere’s a summary of our findings:There exists an unorthodox hidden number problem that relates a private key to the division polynomials of the elliptic curve. The hidden number problem can be ‘massaged’ to only involve the x-coordinates of the curve. We can use a lattice to recover the private key in polynomial time. Division Polynomial Hidden Number ProblemWe found (in Section 4. 1) an obscure hidden number problem in thedivision polynomials of the curve:We coded this in Section 4. 1. We know the left hand sideIf you massage the equation above, then you get this identity*:Massaging the obscure hidden number problemYou can’t see the hidden number problem until you take logarithms. Look:Hidden number problem is revealed after taking logarithms*b, c and r are division polynomial constants defined in (Shipsey, 2000)1. We have a hidden number problem involving the x-coordinates of the curve! Observe:It’s logarithmic ie. we solve for k modulo the largest factor of the field characteristic minus one. (It’s a 237-bit problem now, not 256 bits). We’re literally masters of the hidden number problem! We coded all the papers in thePractical Hidden Number Problems for Programmersseries:Part 1: Quantum Computing and Intro to Hidden Number ProblemsPart 2: Increasing Lattice Volume for Improved HNP AttacksPart 3: Hidden Number Problems with Multiple Noise HolesPart 4:Hidden Number Problems with Chosen MultipliersPart 5: Hidden Number Problems with Chosen ErrorsPart 6 : Solving Hidden Number Problems Without LatticesPart 7 : Fourier Analysis Attacks on HNPs with Bleichenbacher’s algorithm. Part 8 : Hidden Number Problems with Small Unknown Multipliers. So now we know why the x-coordinate approach was working. We also coded the entire paper on division polynomials in case you missed it:Division Polynomials of Elliptic Curves in PythonMurage Kibicho·Jul 4Read full storyActual AttackSo, I know what you’re saying. Too much talk. Show me the lattice and the attack. I recorded this 9 minute video for one of my benefactors. Thumbnail of video on our division polynomial approach to attacking bitcoinHere it is for all our paying subscribers. It walks you through all the constants, all the lattice attack steps and how we’re going to touch Satoshi’s wallet. Let me know if you’d like to collaborate!