<p>The security of half a key would have to be more carefully considered. Suppose the key is <code>n</code>-bits long, and you know <code>n/2</code>. <a href="https://link.springer.com/chapter/10.1007/978-3-540-77026-8_17" rel="nofollow noreferrer">This paper</a> suggests that generically, Pollard's kangaroo algorithm would mean you have <code>n/4</code>-bit security (i.e. an attack running in expected ~2^64 operations). However this doesn't mean that's the best attack possible, and it may be better to ask this on <a href="https://crypto.stackexchange.com/">crypto.se</a></p>
<p>But as you note, there are better ways to do it. As well as multisig which you mentioned, there is also a concept known as <a href="https://en.m.wikipedia.org/wiki/Shamir%27s_Secret_Sharing" rel="nofollow noreferrer">Shamir's secret sharing</a> which allows you to divide a secret into multiple pieces such that any chosen number of them together can recover the whole secret, but with fewer than that chosen threshold, you learn absolutely nothing about the secret.</p>

CC BY-SA 4.0
2022-01-21T21:53:02.783Z
Are you sure that's right? I can imagine that e.g. knowing that the private key is in a particular 128-bit range may permit lattice attacks that are faster than brute-force, or than DLP.
Pieter Wuille
CC BY-SA 4.0
2022-01-21T22:49:47.073Z
Hmm maybe you're right. I feel like it should be fine but I have edited my answer just in case. It feels like the best attack on half an n-bit key would still be 2^(n/4). Maybe it should be asked on crypto.se
meshcollider
CC BY-SA 4.0
2022-01-21T21:34:58.640Z
2022-01-21T23:08:56.727Z
2022-01-21T23:08:56.727Z
meshcollider
<p>Someone has a standard (non-compressed) bitcoin private key (256 bits) and wishes to store it on paper. Being paranoid about someone finding the sheet of paper, he/she cuts the private key up and stores the two (or more) equally sized pieces separately. There is no overlap between the different pieces.</p>
<p>Assume a malicious party found one (or more, but not all) of the different chunks. Is the malicious actor able to spend the funds? If so, what steps would be required?</p>
<p>Attempt to answer:
My understanding would be, that a malicious actor would have to compute the remaining part of the private key to spend the funds. Though this is easier than 'guessing' the whole key, it should be technically unfeasible after about 100 bits at the time of this writing <a href="https://stackoverflow.com/questions/4376751/is-it-possible-to-break-a-128-bit-key#4376820">source</a>. Splitting the key into more chunks would only make guessing more difficult (assuming only one is found), yet easier to recover (assuming all but one are owned). Is there some flaw in my reasoning?</p>
<p>Note: I am aware that multi-sig is the standard way of achieving better security. What I am asking is non-standard.</p>
<p>PS: I'm new to Bitcoin (and to StackExchange as well). Feel free to edit as needed and remove this notice afterwards. Thank you!</p>

CC BY-SA 4.0
2022-01-21T17:36:04.153Z
Your intuition is right, if I split a key in two and someone has one part, and they are independent, he/she must guess the remaining 128 bits, which is infeasible.
Davidson Souza
<security><private-key>
If someone cuts a standard Bitcoin private key into two (or more) equal parts, would another person be able to spend the coins after finding one part?
David
# If someone cuts a standard Bitcoin private key into two (or more) equal parts, would another person be able to spend the coins after finding one part?

(Asked by: username_0 on 2022-01-21)

Someone has a standard (non-compressed) bitcoin private key (256 bits) and wishes to store it on paper. Being paranoid about someone finding the sheet of paper, he/she cuts the private key up and stores the two (or more) equally sized pieces separately. There is no overlap between the different pieces.

Assume a malicious party found one (or more, but not all) of the different chunks. Is the malicious actor able to spend the funds? If so, what steps would be required?

Attempt to answer:
My understanding would be, that a malicious actor would have to compute the remaining part of the private key to spend the funds. Though this is easier than 'guessing' the whole key, it should be technically unfeasible after about 100 bits at the time of this writing [source](https://stackoverflow.com/questions/4376751/is-it-possible-to-break-a-128-bit-key#4376820). Splitting the key into more chunks would only make guessing more difficult (assuming only one is found), yet easier to recover (assuming all but one are owned). Is there some flaw in my reasoning?

Note: I am aware that multi-sig is the standard way of achieving better security. What I am asking is non-standard.

PS: I'm new to Bitcoin (and to StackExchange as well). Feel free to edit as needed and remove this notice afterwards. Thank you!

**Tags:** security, private-key

> **Comments:**
> **username_1**: Your intuition is right, if I split a key in two and someone has one part, and they are independent, he/she must guess the remaining 128 bits, which is infeasible.  

---

## 1 answers

### Answer by username_2 on 2022-01-21. Score: 1 | Accepted answer

The security of half a key would have to be more carefully considered. Suppose the key is `n`-bits long, and you know `n/2`. [This paper](https://link.springer.com/chapter/10.1007/978-3-540-77026-8_17) suggests that generically, Pollard's kangaroo algorithm would mean you have `n/4`-bit security (i.e. an attack running in expected ~2^64 operations). However this doesn't mean that's the best attack possible, and it may be better to ask this on [crypto.se](https://crypto.stackexchange.com/)

But as you note, there are better ways to do it. As well as multisig which you mentioned, there is also a concept known as [Shamir's secret sharing](https://en.m.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) which allows you to divide a secret into multiple pieces such that any chosen number of them together can recover the whole secret, but with fewer than that chosen threshold, you learn absolutely nothing about the secret.

> **Comments:**
> **username_3**: Are you sure that's right? I can imagine that e.g. knowing that the private key is in a particular 128-bit range may permit lattice attacks that are faster than brute-force, or than DLP.  
> **username_2**: Hmm maybe you're right. I feel like it should be fine but I have edited my answer just in case. It feels like the best attack on half an n-bit key would still be 2^(n/4). Maybe it should be asked on crypto.se  

---

