<p>No. Most brainwallets (assuming a more conventional brainwallet like one from brainwallet.org and not a seed-based one) are made by passing a passphrase through one round of SHA256. ASICs are designed to do two rounds.</p>

CC BY-SA 3.0
2014-04-13T17:39:34.050Z
Yeah, that's what I thought. So we can conclude the quote from the bitcoin.it wiki is actually incorrect?
Anders Braüner Nielsen
CC BY-SA 3.0
2014-04-14T17:53:45.380Z
Assuming what I have said is correct, they are probably talking about GPU/CPU mining. According to bitcoin.it, the article was last updated in August 2012. I don't think ASICs were even thought about much back then.
Brian Kieffer
CC BY-SA 3.0
2015-08-19T15:14:22.397Z
All Bitcoin mining ASCIs that I am aware of are incapable of hashing arbitrary data even with double-SHA256 - they have bitcoin block hashing hardwired in so they can brute force the nonce on-chip.
ryanc
CC BY-SA 3.0
2016-02-13T07:39:05.047Z
I was thinking you might be able to make it work for strings that are as long as a block header but then technically, an optimal ASIC chip takes only as input a partial block header (difficulty is encoded) and will only output an arbitrary hash (maybe even only the nonce) of something guaranteed to be different from the input so yeah...you couldn't even get the double-SHA256 of string of the right length even.
jeteon
CC BY-SA 3.0
2014-04-12T16:56:43.843Z
2014-04-14T17:55:41.583Z
2014-04-14T17:55:41.583Z
Brian Kieffer
<p>What follows is an educated guess, not certain statements, and is based on <a href="https://electrum.org" rel="nofollow">Electrum's</a> brainwallet phrases (just figured it'd be a good example), not other schemes or human-generated ones.</p>

<p>No, a miner can't easily be tricked into doing it (e.g. solely by a rogue pool), but can be programmed to try to crack brainwallet phrases. This is because ordinary hashing involves totally different inputs (a block header and nonce, hashed twice) than brainwallet cracking (a random 128 bit seed, hashed 100,000 times).</p>

<p>You'd do this by trying random 128-bit seeds, through Electrum's algorithm, which involves taking the seed and running <a href="https://github.com/spesmilo/electrum/blob/master/lib/account.py" rel="nofollow">100,000</a> SHA256 hashes on it (maybe some other stuff I'm missing would make it more difficult). You can then do a few more calculations to come up with the addresses that the key generates, and check the blockchain to see if any of these match.</p>

<p>The current network hashrate is ~50,000,000 GH/s. If all of that were instead put towards breaking everybody's Electrum keys, and all it takes is the 100K hashes, there'd be 5*10^11 out of 2^128 checked every second. You could check all of the keys in about 2*10^19 years, or 1.6*10^9 times the age of the universe. While you'd probably get collisions long before this (dependent on how many Electrum-generated addresses are in use), I think this gives you an idea of the infeasibility of this sort of attack.</p>

CC BY-SA 3.0
2014-04-10T23:11:41.373Z
Thanks you for the good answer - good to know we're safe with Electrum.
Anders Braüner Nielsen
CC BY-SA 3.0
2014-04-10T23:18:14.743Z
In the Bitcoin.it Brainwallet wiki the example seems to be just one SHA256("Passphrase") to generate one private key though - does this make sense? Does the "using the same equipment" quote make sense? (As in running billions of SHA256(dictionary[eg "correct horse battery staple"])-like private key generations?)
Anders Braüner Nielsen
CC BY-SA 3.0
2014-04-11T02:28:27.047Z
Yes, I think that you'd be able to give your miner different common phrases/word combinations to try with that scheme as well. You'd have to guess what phrases and schemes (e.g. single SHA256, double, or anything else to come up with a 256 bit number/private key) people are likely to come up with for it to be most effective.
Tim S.
CC BY-SA 3.0
2014-04-10T12:06:32.520Z
2014-04-10T12:06:32.520Z
Tim S.
<p>After reading the Bitcoin wiki page for brainwallets it seems to me that mining equipment can be used to brute force brainwallet passphrases. Is this correct?</p>

<blockquote>
  <p>"...so hackers can collectively try multiple trillions of passwords every second in the privacy of their own homes with the very same equipment they use for mining bitcoins (in the usual sense)."</p>
</blockquote>

<p>How would one use an ASIC miner to brute force the blockchain with a dictionary attack? 
What would the application logic look like? 
Can a standalone(The Antminer S1 for instance) miner be "tricked" into believing it is doing normal work for a pool when actually just hashing random strings or would it need custom drivers?</p>

<asic><sha256><brain-wallet>
Can ASIC miners easily be used to guess brainwallet passphrases?
Anders Braüner Nielsen
# Can ASIC miners easily be used to guess brainwallet passphrases?

(Asked by: username_0 on 2014-04-10)

After reading the Bitcoin wiki page for brainwallets it seems to me that mining equipment can be used to brute force brainwallet passphrases. Is this correct?

> "...so hackers can collectively try multiple trillions of passwords every second in the privacy of their own homes with the very same equipment they use for mining bitcoins (in the usual sense)."

How would one use an ASIC miner to brute force the blockchain with a dictionary attack?
What would the application logic look like?
Can a standalone(The Antminer S1 for instance) miner be "tricked" into believing it is doing normal work for a pool when actually just hashing random strings or would it need custom drivers?

**Tags:** asic, sha256, brain-wallet


---

## 2 answers

### Answer by username_1 on 2014-04-12. Score: 2 | Accepted answer

No. Most brainwallets (assuming a more conventional brainwallet like one from brainwallet.org and not a seed-based one) are made by passing a passphrase through one round of SHA256. ASICs are designed to do two rounds.

> **Comments:**
> **username_0**: Yeah, that's what I thought. So we can conclude the quote from the bitcoin.it wiki is actually incorrect?  
> **username_1**: Assuming what I have said is correct, they are probably talking about GPU/CPU mining. According to bitcoin.it, the article was last updated in August 2012. I don't think ASICs were even thought about much back then.  
> **username_2**: All Bitcoin mining ASCIs that I am aware of are incapable of hashing arbitrary data even with double-SHA256 - they have bitcoin block hashing hardwired in so they can brute force the nonce on-chip.  
> **username_3**: I was thinking you might be able to make it work for strings that are as long as a block header but then technically, an optimal ASIC chip takes only as input a partial block header (difficulty is encoded) and will only output an arbitrary hash (maybe even only the nonce) of something guaranteed to be different from the input so yeah...you couldn't even get the double-SHA256 of string of the right length even.  

---

### Answer by username_4 on 2014-04-10. Score: 3

What follows is an educated guess, not certain statements, and is based on [Electrum's](https://electrum.org) brainwallet phrases (just figured it'd be a good example), not other schemes or human-generated ones.

No, a miner can't easily be tricked into doing it (e.g. solely by a rogue pool), but can be programmed to try to crack brainwallet phrases. This is because ordinary hashing involves totally different inputs (a block header and nonce, hashed twice) than brainwallet cracking (a random 128 bit seed, hashed 100,000 times).

You'd do this by trying random 128-bit seeds, through Electrum's algorithm, which involves taking the seed and running [100,000](https://github.com/spesmilo/electrum/blob/master/lib/account.py) SHA256 hashes on it (maybe some other stuff I'm missing would make it more difficult). You can then do a few more calculations to come up with the addresses that the key generates, and check the blockchain to see if any of these match.

The current network hashrate is ~50,000,000 GH/s. If all of that were instead put towards breaking everybody's Electrum keys, and all it takes is the 100K hashes, there'd be 5\*10^11 out of 2^128 checked every second. You could check all of the keys in about 2\*10^19 years, or 1.6\*10^9 times the age of the universe. While you'd probably get collisions long before this (dependent on how many Electrum-generated addresses are in use), I think this gives you an idea of the infeasibility of this sort of attack.

> **Comments:**
> **username_0**: Thanks you for the good answer - good to know we're safe with Electrum.  
> **username_0**: In the Bitcoin.it Brainwallet wiki the example seems to be just one SHA256("Passphrase") to generate one private key though - does this make sense? Does the "using the same equipment" quote make sense? (As in running billions of SHA256(dictionary[eg "correct horse battery staple"])-like private key generations?)  
> **username_4**: Yes, I think that you'd be able to give your miner different common phrases/word combinations to try with that scheme as well. You'd have to guess what phrases and schemes (e.g. single SHA256, double, or anything else to come up with a 256 bit number/private key) people are likely to come up with for it to be most effective.  

---

