user662: I am doing a presentation on Bitcoins and I was looking for some calculations to make people feel safe about the private key encryption.  Please first answer, how long in bytes the private key is, then how many combinations of numbers it will contain, and then what is the fastest computer or network of supercomputers and how long it would take to crack a private key using that computer.  I think the result would be very educational based on my own calculations.  Thank you.

user662: 2^256 = 1.1x10^77  = number of key combinations
2^128 = 3.4x10^38  = the average number of guesses needed
According to this website: http://en.wikipedia.org/wiki/TOP500, the fastest supercomputer is the K computer which has 10.51 petaflops.
A petaflop is 10^15 FLOPS, floating point instructions per second.
So far so good, but I need to know how many FLOPS are needed per guess?
[I will venture a guess:]
Between 1,000 and 10,000 FLOPS (or integer equivalents) per guess.
10.51x10^15 ops/second / 1000 to 10000 ops/guess) = 10.51x10^12 to 10.51x10^11 guess/second.
3.4x10^38 guesses/crack  / 10.51x10^12 guess/second = 3.2x10^25 seconds.
3.2x10^25 seconds / 60 seconds/minute / 60 minutes/hour / 24 hours/day / 365.25 days/year = 1.01x10^18 years
1.01x10^18 years / 1x10^9 / 1x10^9 = 1.014 to 10.014 billion billion years.
So the computers on the Bitcoin network are twice as fast as the single largest laboratory computer.

user1652: There is a vanitygen utility (check out exploitagency's version which is improved fork of samr7's version) which can give you the estimates how long it takes to find the private key for the given pattern (see: vg_output_timing_console()). Some special cases (like repeated characters) are more difficult than the other.

The difficult of finding a vanity address depends on its exact structure (leading letters and numbers) and how likely such an output is given the algorithms involved, which can consist of several pivots where the difficulty suddenly changes. bitcoin wiki

Here is the table which can be found at bitcoin wiki page which provides estimate times for cracking private keys for the given address patterns:


The example table below shows how an increasingly complex vanity affects the difficulty and average time required to find a match only for that vanity, let alone the full address, for a machine capable of looking through 1 million keys per second.
Using vanitygen you might think that you would be able to find the private key for a given address. In practice, this is considered impossible.


Practical example
Let's create the following unspendable bitcoin address:
$ unspendable.py 23456789A123456789A12345678
mainnet: 123456789A123456789A12345678Yr8Dxi

Then using vanitygen I can calculate the performance on my machine (>240 Kkey/s):
$ vanitygen -q -k -o/dev/null 1
[241.29 Kkey/s][total 2880199][Found 11618]

Note: Above was tested on MacBook Pro (2.3GHz Intel Core i7, 16GB 1600MHz DDR3).
Furthermore, it can calculate the estimated time when looking for specific patterns, e.g.

to find first 5 characters out of 26-35 (few seconds):
$ vanitygen -q -k -o/dev/null 12345
[698.17 Kkey/s][total 8192][Prob 0.2%][50% in 4.5s]

6 first characters out of 26-35 (few minutes):
$ vanitygen -q -k -o/dev/null 123456
[701.39 Kkey/s][total 51712][Prob 0.0%][50% in 4.3min]

7 characters out of 26-35 (few hours):
$ vanitygen -q -k -o/dev/null 1234567
[471.87 Kkey/s][total 8192][Prob 0.0%][50% in 6.3h]

8 characters out of 26-35 (few weeks):
$ vanitygen -q -k -o/dev/null 12345678
[658.82 Kkey/s][total 2548480][Prob 0.0%][50% in 10.8d]

9 characters out of 26-35 (few years):
$ vanitygen -q -k -o/dev/null 123456789
[572.50 Kkey/s][total 1631744][Prob 0.0%][50% in 2.0y]

10 characters out of 26-35 (a century):
$ vanitygen -q -k -o/dev/null 123456789A
[630.48 Kkey/s][total 118528][Prob 0.0%][50% in 104.2y]

11 characters out of 26-35 (few millennia)
$ vanitygen -q -k -o/dev/null 123456789A1
[579.78 Kkey/s][total 17348352][Prob 0.0%][50% in 6571.6y]

12 characters out of 26-35 (hundreds of millennia):
vanitygen -q -k -o/dev/null 123456789A12
[751.61 Kkey/s][total 6720512][Prob 0.0%][50% in 294013.9y]

13 characters out of 26-35 (thousands of millennia, few million of years):
$ vanitygen -q -k -o/dev/null 123456789A123
[666.93 Kkey/s][total 3886080][Prob 0.0%][50% in 1.921802e+07y]

14 characters out of 26-35 (billion of years):
$ vanitygen -q -k -o/dev/null 123456789A1234
[817.44 Kkey/s][total 3994880][Prob 0.0%][50% in 9.094109e+08y]

15 characters out of 26-35 (50 billion of years):
$ vanitygen -q -k -o/dev/null 123456789A12345
[784.31 Kkey/s][total 4633856][Prob 0.0%][50% in 5.497420e+10y]

... 28 characters (decillion of years if you're lucky)
$ vanitygen -q -k -o/dev/null 123456789A123456789A12345678
[910.34 Kkey/s][total 2723072][Prob 0.0%][50% in 3.981113e+33y]


It's worth to note, that the above-generated address has 34 bytes, but the first character is just the network identifier (for bitcoin it's usually 1 or 3), and the last 4 bytes is just a checksum. For more details about the address, see this bitcoin wiki page.

Keysearch Rates
For sure keysearch rate can be increased by using a better GPU or multiple of CPUs (see: -t), but still, the estimates can be huge.
For example, here is the table of keysearch rates at bitcoin wiki page:

And here are few reports from users for different GPUs:

i7 8700K - ~3Mkey/c
GTX 980TI (v1.42) - ~73Mh
GTX 1050ti - ~23 Mkey/c
GTX 1070 - ~50Mhkey/s
GTX 1080ti - ~108 Mkey/c

Source: List of supported GPU's (GH-46).

user30396: A Bitcoin private key (ECC key) is an integer between one and about 10^77. This may not seem like much of a selection, but for practical purposes it's essentially infinite.
If you could process one trillion private keys per second, it would take more than one million times the age of the universe to count them all. Even worse, just enumerating these keys would consume more than the total energy output of the sun for 32 years. This vast keyspace plays a fundamental role in securing the Bitcoin network.

user85: A Bitcoin private key is a random 256-bit number. However, the public key reveals some information about the private key. The best known algorithms for breaking ECDSA require O(sqrt(n)) operations. That means 2^128 operations would be needed to break a Bitcoin account.
The largest ECDSA key broken to date of the type that Bitcoin uses was 112 bits long. A Bitcoin account is more than 4,000 billion billion times harder to break.
The only realistic risk would be quantum computing.

user659: 
how long in bytes the private key is

32 bytes, or 256 bits

then how many combinations of numbers it will contain

There are 2^256 different private keys.  That's a little larger than a 1 followed by 77 zeroes.

what is the fastest computer or network of supercomputers

At its peak around August 2011, the Bitcoin network was checking 15 trillion sha256 hashes per second.  (See http://bitcoin.sipa.be/)

how long it would take to crack a private key using that computer

If we assume it takes the same time to run an ECDSA operation as it takes to check an sha256 hash (it takes much longer), and we use an optimisation that allows us to only need 2^128 ECDSA operations, then the time needed can be calculated:
>>> pow(2,128) / (15 * pow(2,40)) / 3600 / 24 / 365.25 / 1e9 / 1e9
0.6537992112229596

It's 0.65 billion billion years.
That's a very conservative estimate for the time taken to break one single Bitcoin address.
Edit: it was pointed out that computers tend to get exponentially faster over time, according to Moore's Law.  Assuming computing speed doubles every year (Moore's law says 2 years, but we'll err on the side of caution), then in 59 years it'll only take 1.13 years. So your coins are safe for the next 60 years without a change to the algorithms used to protect the blockchain. However, I would expect the algorithms to be changed long before it's feasible to break the protection they provide.

662: <p>I am doing a presentation on Bitcoins and I was looking for some calculations to make people feel safe about the private key encryption.  Please first answer, how long in bytes the private key is, then how many combinations of numbers it will contain, and then what is the fastest computer or network of supercomputers and how long it would take to crack a private key using that computer.  I think the result would be very educational based on my own calculations.  Thank you.</p>
 662: <p>2^256 = 1.1x10^77  = number of key combinations</p>

<p>2^128 = 3.4x10^38  = the average number of guesses needed</p>

<p>According to this website: <a href="http://en.wikipedia.org/wiki/TOP500" rel="nofollow">http://en.wikipedia.org/wiki/TOP500</a>, the fastest supercomputer is the K computer which has 10.51 petaflops.</p>

<p>A petaflop is 10^15 FLOPS, floating point instructions per second.</p>

<p>So far so good, but I need to know how many FLOPS are needed per guess?</p>

<p>[I will venture a guess:]</p>

<p>Between 1,000 and 10,000 FLOPS (or integer equivalents) per guess.</p>

<p>10.51x10^15 ops/second / 1000 to 10000 ops/guess) = 10.51x10^12 to 10.51x10^11 guess/second.</p>

<p>3.4x10^38 guesses/crack  / 10.51x10^12 guess/second = 3.2x10^25 seconds.</p>

<p>3.2x10^25 seconds / 60 seconds/minute / 60 minutes/hour / 24 hours/day / 365.25 days/year = 1.01x10^18 years</p>

<p>1.01x10^18 years / 1x10^9 / 1x10^9 = 1.014 to 10.014 billion billion years.</p>

<p>So the computers on the Bitcoin network are twice as fast as the single largest laboratory computer.</p>
 1652: <p>There is a <a href="https://en.bitcoin.it/wiki/Vanitygen" rel="nofollow noreferrer"><code>vanitygen</code> utility</a> (check out <a href="https://github.com/exploitagency/vanitygen-plus" rel="nofollow noreferrer">exploitagency's version</a> which is improved fork of <a href="https://github.com/samr7/vanitygen" rel="nofollow noreferrer">samr7's version</a>) which can give you the estimates how long it takes to find the private key for the given pattern (see: <a href="https://github.com/exploitagency/vanitygen-plus/blob/3101a6abe2b263debf183420231ff93c836afb3c/pattern.c#L397" rel="nofollow noreferrer"><code>vg_output_timing_console()</code></a>). Some special cases (like repeated characters) are more difficult than the other.</p>

<blockquote>
  <p>The difficult of finding a vanity address depends on its exact structure (leading letters and numbers) and how likely such an output is given the algorithms involved, which can consist of several pivots where the difficulty suddenly changes. <sup><a href="https://en.bitcoin.it/wiki/Address" rel="nofollow noreferrer">bitcoin wiki</a></sup></p>
</blockquote>

<p>Here is the table which can be found at <a href="https://en.bitcoin.it/wiki/Address" rel="nofollow noreferrer">bitcoin wiki page</a> which provides estimate times for cracking private keys for the given address patterns:</p>

<p><a href="https://i.stack.imgur.com/Mn7hEl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Mn7hEl.png" alt="bitcoin, vanitygen to try to attack addresses, Vanitygen, Keysearch Rates table, Mkey/s, CPU/GPU, table, decillion years, average time"></a></p>

<blockquote>
  <p>The example table below shows how an increasingly complex vanity affects the difficulty and average time required to find a match only for that vanity, let alone the full address, for a machine capable of looking through 1 million keys per second.</p>
  
  <p>Using vanitygen you might think that you would be able to find the private key for a given address. In practice, this is considered impossible.</p>
</blockquote>

<hr>

<h3>Practical example</h3>

<p>Let's create the following <a href="https://github.com/adamkrellenstein/unspendable" rel="nofollow noreferrer"><code>unspendable</code></a> <a href="https://en.bitcoin.it/wiki/Address" rel="nofollow noreferrer">bitcoin address</a>:</p>

<pre><code>$ unspendable.py 23456789A123456789A12345678
mainnet: 123456789A123456789A12345678Yr8Dxi
</code></pre>

<p>Then using <code>vanitygen</code> I can calculate the performance on my machine (>240 Kkey/s):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 1
[241.29 Kkey/s][total 2880199][Found 11618]
</code></pre>

<p><sup>Note: Above was tested on <em>MacBook Pro</em> (2.3GHz Intel Core i7, 16GB 1600MHz DDR3).</sup></p>

<p>Furthermore, it can calculate the estimated time when looking for specific patterns, e.g.</p>

<ul>
<li><p>to find first 5 characters out of 26-35 (few seconds):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 12345
[698.17 Kkey/s][total 8192][Prob 0.2%][50% in 4.5s]
</code></pre></li>
<li><p>6 first characters out of 26-35 (few minutes):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456
[701.39 Kkey/s][total 51712][Prob 0.0%][50% in 4.3min]
</code></pre></li>
<li><p>7 characters out of 26-35 (few hours):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 1234567
[471.87 Kkey/s][total 8192][Prob 0.0%][50% in 6.3h]
</code></pre></li>
<li><p>8 characters out of 26-35 (few weeks):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 12345678
[658.82 Kkey/s][total 2548480][Prob 0.0%][50% in 10.8d]
</code></pre></li>
<li><p>9 characters out of 26-35 (few years):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789
[572.50 Kkey/s][total 1631744][Prob 0.0%][50% in 2.0y]
</code></pre></li>
<li><p>10 characters out of 26-35 (a century):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A
[630.48 Kkey/s][total 118528][Prob 0.0%][50% in 104.2y]
</code></pre></li>
<li><p>11 characters out of 26-35 (few millennia)</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A1
[579.78 Kkey/s][total 17348352][Prob 0.0%][50% in 6571.6y]
</code></pre></li>
<li><p>12 characters out of 26-35 (hundreds of millennia):</p>

<pre><code>vanitygen -q -k -o/dev/null 123456789A12
[751.61 Kkey/s][total 6720512][Prob 0.0%][50% in 294013.9y]
</code></pre></li>
<li><p>13 characters out of 26-35 (thousands of millennia, few million of years):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A123
[666.93 Kkey/s][total 3886080][Prob 0.0%][50% in 1.921802e+07y]
</code></pre></li>
<li><p>14 characters out of 26-35 (billion of years):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A1234
[817.44 Kkey/s][total 3994880][Prob 0.0%][50% in 9.094109e+08y]
</code></pre></li>
<li><p>15 characters out of 26-35 (50 billion of years):</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A12345
[784.31 Kkey/s][total 4633856][Prob 0.0%][50% in 5.497420e+10y]
</code></pre></li>
<li><p>... 28 characters (<a href="https://en.wikipedia.org/wiki/Names_of_large_numbers" rel="nofollow noreferrer">decillion</a> of years if you're lucky)</p>

<pre><code>$ vanitygen -q -k -o/dev/null 123456789A123456789A12345678
[910.34 Kkey/s][total 2723072][Prob 0.0%][50% in 3.981113e+33y]
</code></pre></li>
</ul>

<p>It's worth to note, that the above-generated address has 34 bytes, but the first character is just the network identifier (for bitcoin it's usually <code>1</code> or <code>3</code>), and the last 4 bytes is just a checksum. For more details about the address, see this <a href="https://en.bitcoin.it/wiki/Address" rel="nofollow noreferrer">bitcoin wiki page</a>.</p>

<hr>

<h3>Keysearch Rates</h3>

<p>For sure keysearch rate can be increased by using a better GPU or multiple of CPUs (see: <code>-t</code>), but still, the estimates can be huge.</p>

<p>For example, here is the table of keysearch rates at <a href="https://en.bitcoin.it/wiki/Vanitygen" rel="nofollow noreferrer">bitcoin wiki page</a>:</p>

<p><a href="https://i.stack.imgur.com/Nd5WOl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Nd5WOl.png" alt="Vanitygen, Keysearch Rates table, Mkey/s, CPU/GPU"></a></p>

<p>And here are few reports from users for different GPUs:</p>

<ul>
<li>i7 8700K - ~3Mkey/c</li>
<li>GTX 980TI (v1.42) - ~73Mh</li>
<li>GTX 1050ti - ~23 Mkey/c</li>
<li>GTX 1070 - ~50Mhkey/s</li>
<li>GTX 1080ti - ~108 Mkey/c</li>
</ul>

<p><sup>Source: <a href="https://github.com/samr7/vanitygen/issues/46" rel="nofollow noreferrer">List of supported GPU's (GH-46)</a>.</sup></p>
 30396: <p>A Bitcoin private key (ECC key) is an integer between one and about 10^77. This may not seem like much of a selection, but for practical purposes it's essentially infinite.
If you could process one trillion private keys per second, it would take more than one million times the age of the universe to count them all. Even worse, just enumerating these keys would <a href="https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html" rel="nofollow">consume more than the total energy</a> output of the sun for 32 years. This vast keyspace plays a fundamental role in securing the Bitcoin network.</p>
 85: <p>A Bitcoin private key is a random 256-bit number. However, the public key reveals some information about the private key. The best known algorithms for breaking ECDSA require O(sqrt(n)) operations. That means 2^128 operations would be needed to break a Bitcoin account.</p>

<p>The largest ECDSA key broken to date of the type that Bitcoin uses was 112 bits long. A Bitcoin account is more than 4,000 billion billion times harder to break.</p>

<p>The only realistic risk would be quantum computing.</p>
 659: <blockquote>
  <p>how long in bytes the private key is</p>
</blockquote>

<p>32 bytes, or 256 bits</p>

<blockquote>
  <p>then how many combinations of numbers it will contain</p>
</blockquote>

<p>There are 2^256 different private keys.  That's a little larger than a 1 followed by 77 zeroes.</p>

<blockquote>
  <p>what is the fastest computer or network of supercomputers</p>
</blockquote>

<p>At its peak around August 2011, the Bitcoin network was checking 15 trillion sha256 hashes per second.  (See <a href="http://bitcoin.sipa.be/" rel="noreferrer">http://bitcoin.sipa.be/</a>)</p>

<blockquote>
  <p>how long it would take to crack a private key using that computer</p>
</blockquote>

<p>If we assume it takes the same time to run an ECDSA operation as it takes to check an sha256 hash (it takes much longer), and we use an optimisation that allows us to only need 2^128 ECDSA operations, then the time needed can be calculated:</p>

<pre><code>&gt;&gt;&gt; pow(2,128) / (15 * pow(2,40)) / 3600 / 24 / 365.25 / 1e9 / 1e9
0.6537992112229596
</code></pre>

<p>It's 0.65 billion billion years.</p>

<p>That's a very conservative estimate for the time taken to break one single Bitcoin address.</p>

<p>Edit: it was pointed out that computers tend to get exponentially faster over time, according to <a href="http://en.wikipedia.org/wiki/Moore&#39;s_law" rel="noreferrer">Moore's Law</a>.  Assuming computing speed doubles every year (Moore's law says 2 years, but we'll err on the side of caution), then in 59 years it'll only take 1.13 years. So your coins are safe for the next 60 years without a change to the algorithms used to protect the blockchain. However, I would expect the algorithms to be changed long before it's feasible to break the protection they provide.</p>
