Brute Force Search Space

A backup password, a private key authorizing bitcoin spending, and the input to the generator that created a key are different things. Both the possible guesses and their checks differ. If a faulty generator chose from a small set of inputs, the search may be easier than the resulting key’s length suggests. An attacker may try that limited input set rather than every mathematically possible key. We therefore need to understand how the secret was created before counting possibilities. [1] [3]

Imagine 16 equally likely possibilities with exactly one correct answer. We test them in order without repeating any. Sometimes we succeed early, sometimes near the end; the average is 8.5 checked guesses. For a general count N, the relationship is E = (N+1)/2. At a steady 2 attempts per second, that means an average of 4.25 seconds. The fraction of an attempt belongs to the average, not to one particular search. This illustrates the idea; it is not a measured Bitcoin wallet recovery time. [1]

Favourite words, names and memorable patterns occur more often than random combinations. An attacker can therefore start with more likely guesses. A faulty generator that produces some outputs more often creates a similar problem. The average from the previous example no longer applies. Min-entropy describes the chance of the best first guess, but cannot by itself tell us the total search effort or a guaranteed success time. A possibility count without the probabilities is incomplete. [1] [2]

Checking a guess need not be instant. PBKDF2 is a function that derives a key from a password and other inputs; repeated computation makes each guess more work. Another input is the salt. This is usually public data that distinguishes derivations: different salts prevent straightforward reuse of the same precomputed result table. Salt is not another secret password and does not replace a strong input. Estimating speed requires the specific function, its settings and the hardware used. [3]

BIP39 converts recovery words and an optional passphrase—an additional password—into a seed, the secret starting value for deriving keys. It uses PBKDF2 with HMAC-SHA512 as its internal computational function and 2048 iterations, or repetitions, to produce a 512-bit seed. Here the salt parameter is the text “mnemonic” followed by the passphrase; any additional secrecy comes from the passphrase itself. Every passphrase produces a valid seed, so the recovery words’ checksum does not confirm that you entered the right one. When recovering your own wallet, you can recognize it using a known address with the correct key-derivation settings, for example. A long result does not turn a weak password into a strong one. [4]

Some mathematical methods do more than guess values one after another. In elliptic-curve cryptography (ECC), a private key lets you calculate a public key; finding the private value in the reverse direction is the hard task called the discrete logarithm problem. SEC 2 describes the parameters of Bitcoin’s secp256k1 curve. Counting all 256-bit strings therefore misses other possible attack paths. NIST SP 800-57 distinguishes key length from security strength, the estimated effort to break protection under stated assumptions. The existence of a mathematical approach does not make it practically easy. [5] [6]

More processors can share independent attempts, but the benefit also depends on memory and how the computation is organized. Mining hashrate measures mining computations; it is not PBKDF2 throughput or the speed of ECC operations. There is also a difference between a website login and a backup copy. A service may restrict access after failed attempts. Someone with a copy of an encrypted file can instead check guesses offline on their own machine. Website login limits alone do not stop those attempts. [3] [6]

Someone who obtains the entire seed does not need to search an enormous space. Malicious software or a flaw in the software handling keys may achieve the same result. Security therefore goes beyond choosing an unpredictable secret: storage and use matter too. When you hear a claim about cracking time, ask which attack it assumes, what the attacker already knows and how speed was measured. A large number alone guarantees neither device security nor successful recovery of a lost wallet. [6]