<p>If the attacker just tries random public keys and guesses the correct one, they obviously won't be able to spend the funds. What they can do is try random <em>private</em> keys and derive the public keys from those, then if they're successful they'll have the private key as well. In any case, Bitcoin keys and addresses are large enough that brute-forcing them should be infeasible.</p>
<p>Side note, what's being descibed here is called a <a href="https://en.wikipedia.org/wiki/Preimage_attack" rel="noreferrer">preimage attack</a>, which is not the same as a <a href="https://en.wikipedia.org/wiki/Collision_attack" rel="noreferrer">collision attack</a>.</p>

CC BY-SA 4.0
2024-03-07T14:18:14.173Z
2024-03-07T14:18:14.173Z
Vojtěch Strnad
<p>From &quot;Mastering Bitcoin: Programming the Open Blockchain 3d edition, Ch4&quot; :</p>
<blockquote>
<p>All addresses based on hash functions are theoretically vulnerable to an attacker independently finding the same input that produced the hash function output (com‐ mitment). In the case of Bitcoin, if they find the input the same way the original user did, they’ll know the user’s private key and be able to spend that user’s bitcoins.</p>
</blockquote>
<p>Bitcoin uses elliptic curve arithmetics for private and public keys, the only thing which is hashed is a public key, so the best thing we can reveal is a public key, isn't it?
<strong>(I'm not considering P2SH)</strong> <br />
Or we can somehow get a private key with successful collision attack?</p>

<private-key><hash><attack><mastering-bitcoin><key-collision>
How can a collision attack reveal the private key?
Vanconts
# How can a collision attack reveal the private key?

(Asked by: username_0 on 2024-03-07)

From "Mastering Bitcoin: Programming the Open Blockchain 3d edition, Ch4" :

> All addresses based on hash functions are theoretically vulnerable to an attacker independently finding the same input that produced the hash function output (com‐ mitment). In the case of Bitcoin, if they find the input the same way the original user did, they’ll know the user’s private key and be able to spend that user’s bitcoins.

Bitcoin uses elliptic curve arithmetics for private and public keys, the only thing which is hashed is a public key, so the best thing we can reveal is a public key, isn't it?
**(I'm not considering P2SH)**   
Or we can somehow get a private key with successful collision attack?

**Tags:** private-key, hash, attack, mastering-bitcoin, key-collision


---

## 1 answers

### Answer by username_1 on 2024-03-07. Score: 7 | Accepted answer

If the attacker just tries random public keys and guesses the correct one, they obviously won't be able to spend the funds. What they can do is try random *private* keys and derive the public keys from those, then if they're successful they'll have the private key as well. In any case, Bitcoin keys and addresses are large enough that brute-forcing them should be infeasible.

Side note, what's being descibed here is called a [preimage attack](https://en.wikipedia.org/wiki/Preimage_attack), which is not the same as a [collision attack](https://en.wikipedia.org/wiki/Collision_attack).


---

