<p>From <em>Applied Cryptography</em>, by Bruce Schneider (pp. 157-158):</p>
<blockquote>
<p>One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)</p>
<p>Given that k = 1.38×10^-16 erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10^-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.</p>
<p>Now, the annual energy output of our sun is about 1.21×10^41 ergs. This is enough to power about 2.7×10^56 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2^192. Of course, it wouldn't have the energy left over to perform any useful calculations with this counter.</p>
<p>But that's just one star, and a measly one at that. A typical supernova releases something like 10^51 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.</p>
<p>These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.</p>
</blockquote>
<p>Essentially, the laws of physics prevent the existence of classical computers which can count to 2^256, let alone break 256-bit encryption. Moore's law alone won't ever stop Bitcoin's proof of work from working.</p>
<p>There are two ways around this, however. The first is a break in SHA-256. This is quite unlikely, as Bitcoin uses twice as many rounds of SHA-256 as the usual implementation, as block headers are actually hashed twice. If SHA-256
is ever broken, Bitcoin will actually probably be one of the last programs to suffer from the break, and will have ample time to switch algorithms.</p>
<p>The second way to get around the aforementioned laws of physics is with a computer not made of bits; a quantum computer. Any function can have its domain searched in O[N^(1/2)] on a quantum computer by Grover's algorithm. For SHA-256, with a domain and codomain size of N = 2^256, a string of zero bits twice as long as that of a classical computer running at the same speed can be found in the same time. This would still not be enough to exhaust the remaining bits, and in any case, an attacker with a quantum computer would make much more money by cracking Bitcoin public keys and stealing their balance.</p>
<p>EDIT: Fixed exponents getting mangled in the copy-pasting from PDF.</p>

CC BY-SA 3.0
2016-10-21T16:29:43.290Z
So it IS twice as hard... ?
Gabriel
CC BY-SA 3.0
2016-10-19T15:05:13.033Z
2016-10-19T16:51:18.460Z
2020-06-16T11:10:03.350Z
maservant
<blockquote>
  <p>So what did I miss ?</p>
</blockquote>

<p><a href="https://en.wikipedia.org/wiki/Conservation_of_energy" rel="nofollow">Conservation of energy</a></p>

CC BY-SA 3.0
2016-10-18T18:52:51.763Z
Please elaborate, I'm still missing it.
Gabriel
CC BY-SA 3.0
2016-10-18T19:54:30.113Z
I think you can expand this answer and make it much, *much* better.  You're not wrong, but you need to lead readers to the conclusion.
Jestin
CC BY-SA 3.0
2016-10-18T19:58:47.133Z
OK, take one more link: https://en.wikipedia.org/wiki/Landauer's_principle
amaclin
CC BY-SA 3.0
2016-10-18T20:04:27.030Z
I do not want to answer this question, but give you useful links for studying yourself
amaclin
CC BY-SA 3.0
2016-10-19T09:01:09.583Z
Then maybe you should have commented instead of answering it :)
karask
CC BY-SA 3.0
2016-10-19T12:56:58.587Z
So you think there's an upper limit to computational power so that calculating an all-zero hash in less than 10 minutes is impossible ? Yeah, and 640k should be enough for everyone.
Gabriel
CC BY-SA 3.0
2016-10-19T16:47:25.860Z
@Gabriel, amaclin's answer is correct...but doesn't do a great job of explaining why.  You should check out the other answer.
Jestin
CC BY-SA 3.0
2016-10-19T18:55:41.897Z
@Jestin, I did, and I'm baffled (:
Gabriel
CC BY-SA 3.0
2016-10-19T19:06:35.987Z
@Gabriel, basically our primitive little computers, despite Moore's law, are no match for the vastness of the 256-bit space.  It's not just the Moore's law trend line that shows this, but the physical limitations of the universe we live in.  Cryptography is really about the closest thing we have to magic :)
Jestin
CC BY-SA 3.0
2016-10-18T18:50:07.137Z
2016-10-18T18:50:07.137Z
amaclin
<p>If</p>

<ul>
<li>the size of the block hash, the one that has to be below a certain value, is fixed (256b, right?), and</li>
<li>finding a hash with one more bit set to zero is, I suspect, twice as hard, and</li>
<li>Moore's law (doubling of cpu power every 18 months. I know, that's not Moore's law, he meant storage in a given space) persists for long enough, and</li>
<li>the total hashing power follows Moore's law (bitcoin does not take over and remains somewhat underground)</li>
</ul>

<p>then we can calculate when the protocol will have to change.</p>

<p>As far as I've seen on recent bloks, 17 hex characters are already zero in the hash, meaning 188 bits are left with a value. This means that in 188*1.5 years, we'll collectively be able to calculate an all-zero hash in less than 10 minutes.</p>

<p>So what did I miss ? Is my assumption about hash calculation difficulty correct ?</p>

<difficulty><hashpower>
How harder is it on average to find a block with one more zero in its hash?
Gabriel
# How harder is it on average to find a block with one more zero in its hash?

(Asked by: username_0 on 2016-10-18)

If

* the size of the block hash, the one that has to be below a certain value, is fixed (256b, right?), and
* finding a hash with one more bit set to zero is, I suspect, twice as hard, and
* Moore's law (doubling of cpu power every 18 months. I know, that's not Moore's law, he meant storage in a given space) persists for long enough, and
* the total hashing power follows Moore's law (bitcoin does not take over and remains somewhat underground)

then we can calculate when the protocol will have to change.

As far as I've seen on recent bloks, 17 hex characters are already zero in the hash, meaning 188 bits are left with a value. This means that in 188\*1.5 years, we'll collectively be able to calculate an all-zero hash in less than 10 minutes.

So what did I miss ? Is my assumption about hash calculation difficulty correct ?

**Tags:** difficulty, hashpower


---

## 2 answers

### Answer by username_1 on 2016-10-19. Score: 3

From *Applied Cryptography*, by Bruce Schneider (pp. 157-158):

> One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)
>
> Given that k = 1.38×10^-16 erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10^-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.
>
> Now, the annual energy output of our sun is about 1.21×10^41 ergs. This is enough to power about 2.7×10^56 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2^192. Of course, it wouldn't have the energy left over to perform any useful calculations with this counter.
>
> But that's just one star, and a measly one at that. A typical supernova releases something like 10^51 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.
>
> These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Essentially, the laws of physics prevent the existence of classical computers which can count to 2^256, let alone break 256-bit encryption. Moore's law alone won't ever stop Bitcoin's proof of work from working.

There are two ways around this, however. The first is a break in SHA-256. This is quite unlikely, as Bitcoin uses twice as many rounds of SHA-256 as the usual implementation, as block headers are actually hashed twice. If SHA-256
is ever broken, Bitcoin will actually probably be one of the last programs to suffer from the break, and will have ample time to switch algorithms.

The second way to get around the aforementioned laws of physics is with a computer not made of bits; a quantum computer. Any function can have its domain searched in O[N^(1/2)] on a quantum computer by Grover's algorithm. For SHA-256, with a domain and codomain size of N = 2^256, a string of zero bits twice as long as that of a classical computer running at the same speed can be found in the same time. This would still not be enough to exhaust the remaining bits, and in any case, an attacker with a quantum computer would make much more money by cracking Bitcoin public keys and stealing their balance.

EDIT: Fixed exponents getting mangled in the copy-pasting from PDF.

> **Comments:**
> **username_0**: So it IS twice as hard... ?  

---

### Answer by username_2 on 2016-10-18. Score: 0

> So what did I miss ?

[Conservation of energy](https://en.wikipedia.org/wiki/Conservation_of_energy)

> **Comments:**
> **username_0**: Please elaborate, I'm still missing it.  
> **username_3**: I think you can expand this answer and make it much, *much* better.  You're not wrong, but you need to lead readers to the conclusion.  
> **username_2**: OK, take one more link: https://en.wikipedia.org/wiki/Landauer's_principle  
> **username_2**: I do not want to answer this question, but give you useful links for studying yourself  
> **username_4**: Then maybe you should have commented instead of answering it :)  
> **username_0**: So you think there's an upper limit to computational power so that calculating an all-zero hash in less than 10 minutes is impossible ? Yeah, and 640k should be enough for everyone.  
> **username_3**: @username_0, username_2's answer is correct...but doesn't do a great job of explaining why.  You should check out the other answer.  
> **username_0**: @username_3, I did, and I'm baffled (:  
> **username_3**: @username_0, basically our primitive little computers, despite Moore's law, are no match for the vastness of the 256-bit space.  It's not just the Moore's law trend line that shows this, but the physical limitations of the universe we live in.  Cryptography is really about the closest thing we have to magic :)  

---

