<p>There are ~ 2^256 private keys and 2^160 p2pkh addresses.
Each private key produces two p2pkh addresses (hash of classic public key and hash of compressed public key).
So, there are ~ 2^97 private keys for each p2pkh address.
You do not need to find <code>original</code> public key. You can find <code>any</code> private key (from a set of 2^97) which corresponds to p2pkh address.</p>

CC BY-SA 4.0
2024-12-31T06:51:30.403Z
2024-12-31T08:39:46.427Z
2024-12-31T08:39:46.427Z
amaclin
<p>It is commonly said that Bitcoin has 128 bits of security because there is an algorithm that can find the private key of a given public key in an average of 2^128 steps.</p>
<p>However, this assumes that the attacker knows the public key associated with the funds, so this attack is only possible with P2PK outputs or with addresses that have already been spent from.</p>
<p>In the case of an unspent P2PKH or P2WPKH, the attacker only knows the 160-bit address. Therefore, they must first brute force to find the public key associated with the given address. For each attempt, they have a 1 in 2^160 chance of succeeding, meaning the security here is effectively 160 bits. Once the attacker finds the public key, they can then apply the algorithm to find the private key.</p>
<p>So doesn't this imply 160 bits of security? Even if the attacker immediately found the private key corresponding to a public key, they would still need to perform a 160-bit brute-force attack first.</p>

<security><attack>
Why does Bitcoin have 128 bits of security?
mathboi
# Why does Bitcoin have 128 bits of security?

(Asked by: username_0 on 2024-12-30)

It is commonly said that Bitcoin has 128 bits of security because there is an algorithm that can find the private key of a given public key in an average of 2^128 steps.

However, this assumes that the attacker knows the public key associated with the funds, so this attack is only possible with P2PK outputs or with addresses that have already been spent from.

In the case of an unspent P2PKH or P2WPKH, the attacker only knows the 160-bit address. Therefore, they must first brute force to find the public key associated with the given address. For each attempt, they have a 1 in 2^160 chance of succeeding, meaning the security here is effectively 160 bits. Once the attacker finds the public key, they can then apply the algorithm to find the private key.

So doesn't this imply 160 bits of security? Even if the attacker immediately found the private key corresponding to a public key, they would still need to perform a 160-bit brute-force attack first.

**Tags:** security, attack


---

## 1 answers

### Answer by username_1 on 2024-12-31. Score: 1

There are ~ 2^256 private keys and 2^160 p2pkh addresses.
Each private key produces two p2pkh addresses (hash of classic public key and hash of compressed public key).
So, there are ~ 2^97 private keys for each p2pkh address.
You do not need to find `original` public key. You can find `any` private key (from a set of 2^97) which corresponds to p2pkh address.


---

