<p>Short answer: no.</p>

<p>Long answer:</p>

<ol>
<li>Blocks are exactly 80 bytes long. When have you ever seen an 80 character password?</li>
<li>Blocks start with a bunch of null bytes in the version field. Again, when have you seen that in a password?</li>
<li>Each miner is mining a different block. You don't know the merkle root of what they're mining because that contains a hash of a secret address.</li>
<li>Bitcoin uses SHA256(SHA256(x)) as a hash function, which is not very common in password hashing.</li>
<li>Miners won't publish their results unless they solve a block. They only solve a block if it starts with 12 zeros (at time of writing). The odds of your hash starting with 12 zeros is 0.000000000000003034%.</li>
</ol>

CC BY-SA 3.0
2013-04-08T00:44:43.930Z
2016-05-10T04:01:00.307Z
2016-05-10T04:01:00.307Z
Nick ODell
<p>While you cannot use the bitcoin mining power itself to crack selected passwords, bitcoin makes it for the first time possible to encode and ensure monetary rewards for password cracking through self-enforcing contracts.</p>

<p>For example, you could lock up funds in a transaction that are redeemable only provided that a specific puzzle has been cracked. This can be written as a bitcoin script (scriptPubKey) which takes as input a candidate solution to the puzzle (as scriptSig) and checks that it is a solution. In formal languages lingo, given a language <code>L = { x: R(x, w) = 1 }</code> such that <code>R</code> is polynomially computable (and so <code>R</code> being in <code>P</code> and <code>L</code> being in <code>NP</code>), you can solve the search problem of finding a <code>w</code> given an <code>x</code> in <code>L</code> by encoding <code>R</code> as a scriptPubKey and expecting a <code>w</code> as a scriptSig.</p>

<p>As an example, imagine you wish to find the pre-image of a given SHA256 hash. Your bitcoin redeem script could then look like this:</p>

<pre><code>def spend(witness):
    if SHA256(witness) == 6fe28c0...00000:
        return True
    return False
</code></pre>

<p>Indeed, the only way to spend this script is by providing a witness that cracks this problem. In formal languages lingo, in this case <code>x = 6fe28c0...00000</code> and <code>w</code> is the witness.</p>

<p>Coding it in the bitcoin script language, we get:</p>

<pre><code>OP_HASH256
6fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000
OP_EQUAL
</code></pre>

<p>In fact, <a href="https://blockchain.info/tx/a4bfa8ab6435ae5f25dae9d89e4eb67dfa94283ca751f393c1ddc5a837bbc31b" rel="nofollow">this very transaction was published on the bitcoin network</a> four years ago and paid 1 BTC to have this puzzle solved.</p>

<p>Interestingly, notice that if the puzzle remains unsolved, the money is forever lost – that money is solely dedicated to the puzzle solver, and if there is no one, then no one can get the money. As a sidenode, notice that this kind of transaction is not secure, as the puzzle solver will have to disclose the scriptSig in order to spend the tx – meaning that anyone can double-spend the same amount immediately before the original tx gets confirmed. There are ways to guard against such attacks by performing more complicated schemata, such as revealing the secret in a two-block process possible in Ethereum.</p>

CC BY-SA 3.0
2017-10-23T15:17:39.873Z
So this means you can pay any amount you want to get each password cracked (or does it have to be 1 BTC)? Can this be used to solve bcrypt hashes too? Should we watch for these "evil transactions" and stop them somehow?
NH.
CC BY-SA 3.0
2017-10-24T21:23:49.470Z
Any amount is possible. In generalized scripting languages (such as Ethereum's), you can encode any puzzle, including bcrypt. It's impossible to "stop these evil transactions", because that would require lack of censorship-resistance and therefore some sort of centralized control.
dionyziz
CC BY-SA 3.0
2016-02-18T01:56:54.810Z
2016-02-18T01:56:54.810Z
dionyziz
<p>The processing done by miners is a very highly specific, yet random operation. It could not be reused for a general purpose operation looking for a specific answer.</p>

CC BY-SA 3.0
2013-04-08T02:22:07.697Z
2013-04-08T02:22:07.697Z
Colin Dean
<p>I'm assuming that the Bitcoin economy is rapidly building a computing cluster capable of unprecedented amount of hash searching.</p>

<p>Would it be possible for an attacker to leverage this to crack other systems?</p>

<p>E.g. could an attacker input password hashes into transactions and then deduce useful information from the output of miners with regards to hose hashes?</p>

<p>(I'm not asking about the security of Bitcoin as such, so I don't think it's a duplicate of [1] or [2]) </p>

<p>[1] <a href="https://bitcoin.stackexchange.com/questions/8456/could-mining-calculations-be-used-to-crack-private-key">Could mining calculations be used to crack private key?</a></p>

<p>[2] <a href="https://bitcoin.stackexchange.com/questions/2847/how-long-would-it-take-a-large-computer-to-crack-a-private-key">How long would it take a large computer to crack a private key?</a></p>

CC BY-SA 3.0
2016-02-17T21:22:30.990Z
related: [Bitcoin Mining ASICs used for cryptographic application? Rainbow tables?](http://bitcoin.stackexchange.com/q/7236/5406)
Murch
CC BY-SA 3.0
2016-05-09T17:36:01.727Z
Uhm....so someone says definitely not and the other explains a how to method ! is it a yes or a no simply?
Bannaz
CC BY-SA 3.0
2016-05-09T17:48:41.183Z
@Bannaz: It's a "no" for all practical purposes. The example that dionyziz provides is rather academic, and has no practical application.
Murch
CC BY-SA 3.0
2016-05-09T21:06:57.143Z
Also remember that the security industry has been trying to eradicate the use of SHA256 for password hashing in favor of "memory hard", adjustable algorithms like bcrypt, scrypt, and pbkdf2.  This shift is primarily because of the existence of special purpose SHA256 hardware (aka, asic miners), so it actually is a side effect of the Bitcoin network.  Still, that's not using the network directly.
Jestin
<security><hash><cryptography>
Can the Bitcoin network be used for cracking?
John Nilsson
# Can the Bitcoin network be used for cracking?

(Asked by: username_0 on 2013-04-07)

I'm assuming that the Bitcoin economy is rapidly building a computing cluster capable of unprecedented amount of hash searching.

Would it be possible for an attacker to leverage this to crack other systems?

E.g. could an attacker input password hashes into transactions and then deduce useful information from the output of miners with regards to hose hashes?

(I'm not asking about the security of Bitcoin as such, so I don't think it's a duplicate of [1] or [2])

[1] [Could mining calculations be used to crack private key?](https://bitcoin.stackexchange.com/questions/8456/could-mining-calculations-be-used-to-crack-private-key)

[2] [How long would it take a large computer to crack a private key?](https://bitcoin.stackexchange.com/questions/2847/how-long-would-it-take-a-large-computer-to-crack-a-private-key)

**Tags:** security, hash, cryptography

> **Comments:**
> **username_1**: related: [Bitcoin Mining ASICs used for cryptographic application? Rainbow tables?](http://bitcoin.stackexchange.com/q/7236/5406)  
> **username_2**: Uhm....so someone says definitely not and the other explains a how to method ! is it a yes or a no simply?  
> **username_1**: @username_2: It's a "no" for all practical purposes. The example that username_5 provides is rather academic, and has no practical application.  
> **username_3**: Also remember that the security industry has been trying to eradicate the use of SHA256 for password hashing in favor of "memory hard", adjustable algorithms like bcrypt, scrypt, and pbkdf2.  This shift is primarily because of the existence of special purpose SHA256 hardware (aka, asic miners), so it actually is a side effect of the Bitcoin network.  Still, that's not using the network directly.  

---

## 3 answers

### Answer by username_4 on 2013-04-08. Score: 22

Short answer: no.

Long answer:

1. Blocks are exactly 80 bytes long. When have you ever seen an 80 character password?
2. Blocks start with a bunch of null bytes in the version field. Again, when have you seen that in a password?
3. Each miner is mining a different block. You don't know the merkle root of what they're mining because that contains a hash of a secret address.
4. Bitcoin uses SHA256(SHA256(x)) as a hash function, which is not very common in password hashing.
5. Miners won't publish their results unless they solve a block. They only solve a block if it starts with 12 zeros (at time of writing). The odds of your hash starting with 12 zeros is 0.000000000000003034%.


---

### Answer by username_5 on 2016-02-18. Score: 4

While you cannot use the bitcoin mining power itself to crack selected passwords, bitcoin makes it for the first time possible to encode and ensure monetary rewards for password cracking through self-enforcing contracts.

For example, you could lock up funds in a transaction that are redeemable only provided that a specific puzzle has been cracked. This can be written as a bitcoin script (scriptPubKey) which takes as input a candidate solution to the puzzle (as scriptSig) and checks that it is a solution. In formal languages lingo, given a language `L = { x: R(x, w) = 1 }` such that `R` is polynomially computable (and so `R` being in `P` and `L` being in `NP`), you can solve the search problem of finding a `w` given an `x` in `L` by encoding `R` as a scriptPubKey and expecting a `w` as a scriptSig.

As an example, imagine you wish to find the pre-image of a given SHA256 hash. Your bitcoin redeem script could then look like this:

```
def spend(witness):
    if SHA256(witness) == 6fe28c0...00000:
        return True
    return False

```

Indeed, the only way to spend this script is by providing a witness that cracks this problem. In formal languages lingo, in this case `x = 6fe28c0...00000` and `w` is the witness.

Coding it in the bitcoin script language, we get:

```
OP_HASH256
6fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000
OP_EQUAL

```

In fact, [this very transaction was published on the bitcoin network](https://blockchain.info/tx/a4bfa8ab6435ae5f25dae9d89e4eb67dfa94283ca751f393c1ddc5a837bbc31b) four years ago and paid 1 BTC to have this puzzle solved.

Interestingly, notice that if the puzzle remains unsolved, the money is forever lost – that money is solely dedicated to the puzzle solver, and if there is no one, then no one can get the money. As a sidenode, notice that this kind of transaction is not secure, as the puzzle solver will have to disclose the scriptSig in order to spend the tx – meaning that anyone can double-spend the same amount immediately before the original tx gets confirmed. There are ways to guard against such attacks by performing more complicated schemata, such as revealing the secret in a two-block process possible in Ethereum.

> **Comments:**
> **username_6**: So this means you can pay any amount you want to get each password cracked (or does it have to be 1 BTC)? Can this be used to solve bcrypt hashes too? Should we watch for these "evil transactions" and stop them somehow?  
> **username_5**: Any amount is possible. In generalized scripting languages (such as Ethereum's), you can encode any puzzle, including bcrypt. It's impossible to "stop these evil transactions", because that would require lack of censorship-resistance and therefore some sort of centralized control.  

---

### Answer by username_7 on 2013-04-08. Score: 3

The processing done by miners is a very highly specific, yet random operation. It could not be reused for a general purpose operation looking for a specific answer.


---

