<p>You could in theory build an ASIC to brute force private keys of any cryptographic scheme, like EC or RSA. </p>

<p>But ASICs only give <em>linear</em> improvements. That means that they 'accelerate' some search only by a constant factor, like 2, 3 or 100. Even if your ASIC does something a million times faster than a normal CPU, it's still a linear improvement.</p>

<p>If guessing a private key takes the current age of the universe in a CPU, an ASIC a million times faster would still take 13 thousand years.</p>

<p>Cryptography relies on problems being <em>exponential</em> on the key size. Exponential growth beats linear growth. If some day a powerful ASIC or CPU could guess a ECDSA private key, users of ECDSA would only have to increase their key sizes.</p>

<p>To yield a better than linear improvement, you would need a better algorithm. Implementing current day algorithms in faster hardware only gives linear improvements. It's widely believed, even if we still don't have formal proof, that it's not possible to get better algorithms for prime factorization and elliptic-curve factorization. (At least in non-quantum computers.) In other words, they are considered <strong>intractable problems</strong>.</p>

CC BY-SA 3.0
2018-03-07T15:19:09.570Z
2018-03-08T21:41:07.813Z
2018-03-08T21:41:07.813Z
Osias Jota
<p>ASIC does SHA256 hashes continuously. Getting Private key from Public key requires Elliptic Curve Multiplication in reverse. Elliptic Curve Multiplication is assumed to be very hard problem. i.e. By having point on the elliptic curve , You can add or multiply it as many times as you want but by having a point which has been multilpicated, you won't know its generator point. That is the hardness You have to solve in order to get that point. So no machine in this world can efficiently compute Private key by having Public Key.</p>

CC BY-SA 3.0
2018-03-05T09:19:56.493Z
Doesn't an ASIC do whatever it is designed to do very fast? sha256 ASIC does sha256 very fast, but what about other ASIC? ASIC is not limited to only one task but a specific ASIC can only ever do one task.
Willtech
CC BY-SA 3.0
2018-03-08T15:54:23.433Z
Solving a problem faster doesn't mean magically faster, see my answer above
Osias Jota
CC BY-SA 3.0
2018-03-05T08:42:18.183Z
2018-03-05T08:42:18.183Z
DOLLY PATWA
<p>Just looking at <a href="https://github.com/exploitagency/vanitygen-plus" rel="nofollow noreferrer">vanitygen-plus</a> (currently supporting almost one-hundred crypto-currencies) do its stuff, and it is capable of over 548,990 keys/sec on my CPU alone.</p>

<p>Well developed ASIC is several orders of magnitude faster than my CPU, wouldn't it be profitable for a company with the resources to do so to develop such a key miner, even if it is a one-off?</p>

<p>The reward (actually, theft) is access to the private keys of any address. Surely the development costs are not so prohibitive for ASIC as they are for general-purpose CPU's?</p>

<p>Future developments in this area seem like the most realistic threat to crypto-currency security so far.</p>

CC BY-SA 3.0
2018-03-04T12:18:59.687Z
Multiple organisations have tried that. I think, there is still 1 active "brute-forcing-pool (forgot the name)", but mining transactions is always worth it (over brute force) unless you win the lottery and find one of Satoshi's keys. I think, the brute forcing pool got 7 private keys of used addresses with 3 of them having Bitcoins on it (but less than 1 Bitcoin all in all). (but they wasted a lot of energy to do that)...
hardfork
CC BY-SA 3.0
2018-03-04T20:48:01.160Z
https://lbc.cryptoguru.org/about - there are positive and negative comments on the project. On the onehand side it proofs, that the math is incredibly “big”, and a good use for the bitcoin setup. On the otherhand side there are comments, that the found addresses are not really “found”, but merely “known” to be found. There was a longer thread in bitcointalk forums last year... Hint: ASICs do sha256, whereas keys is ECDSA logic. Haven’t seen ASICs yet to do ECDSA math.
pebwindkraft
CC BY-SA 3.0
2018-03-05T09:07:52.247Z
@pebwindkraft True, neither have I. I am aware that vanitygen-plus uses Open-SSL for the EC math and figured that any process that does 'do this, this, this and then this' every time might be ASIC-able. ASIC performs any one function it is designed to do, it is only the Bitcoin mining ASIC that do sha256 but there are I, I make the presumption, plenty of varieties in industry purposes.
Willtech
CC BY-SA 3.0
2018-03-08T19:56:10.803Z
If you could steal everyone's bitcoins, no one would want bitcoins anymore; the market and the value of the coins would fall to zero.  You would have successfully stolen coins that no longer have any value.  (Alternatively, you could try to steal a few coins at a time in a sneaky, undetectable way.  But then your payoff becomes much slower, and also not worth the effort)
abelenky
<private-key><academic-research>
Wouldn't it be profitable to make an ASIC capable of calculating private keys?
Willtech
# Wouldn't it be profitable to make an ASIC capable of calculating private keys?

(Asked by: username_0 on 2018-03-04)

Just looking at [vanitygen-plus](https://github.com/exploitagency/vanitygen-plus) (currently supporting almost one-hundred crypto-currencies) do its stuff, and it is capable of over 548,990 keys/sec on my CPU alone.

Well developed ASIC is several orders of magnitude faster than my CPU, wouldn't it be profitable for a company with the resources to do so to develop such a key miner, even if it is a one-off?

The reward (actually, theft) is access to the private keys of any address. Surely the development costs are not so prohibitive for ASIC as they are for general-purpose CPU's?

Future developments in this area seem like the most realistic threat to crypto-currency security so far.

**Tags:** private-key, academic-research

> **Comments:**
> **username_1**: Multiple organisations have tried that. I think, there is still 1 active "brute-forcing-pool (forgot the name)", but mining transactions is always worth it (over brute force) unless you win the lottery and find one of Satoshi's keys. I think, the brute forcing pool got 7 private keys of used addresses with 3 of them having Bitcoins on it (but less than 1 Bitcoin all in all). (but they wasted a lot of energy to do that)...  
> **username_2**: https://lbc.cryptoguru.org/about - there are positive and negative comments on the project. On the onehand side it proofs, that the math is incredibly “big”, and a good use for the bitcoin setup. On the otherhand side there are comments, that the found addresses are not really “found”, but merely “known” to be found. There was a longer thread in bitcointalk forums last year... Hint: ASICs do sha256, whereas keys is ECDSA logic. Haven’t seen ASICs yet to do ECDSA math.  
> **username_0**: @username_2 True, neither have I. I am aware that vanitygen-plus uses Open-SSL for the EC math and figured that any process that does 'do this, this, this and then this' every time might be ASIC-able. ASIC performs any one function it is designed to do, it is only the Bitcoin mining ASIC that do sha256 but there are I, I make the presumption, plenty of varieties in industry purposes.  
> **username_3**: If you could steal everyone's bitcoins, no one would want bitcoins anymore; the market and the value of the coins would fall to zero.  You would have successfully stolen coins that no longer have any value.  (Alternatively, you could try to steal a few coins at a time in a sneaky, undetectable way.  But then your payoff becomes much slower, and also not worth the effort)  

---

## 2 answers

### Answer by username_4 on 2018-03-07. Score: 2 | Accepted answer

You could in theory build an ASIC to brute force private keys of any cryptographic scheme, like EC or RSA.

But ASICs only give *linear* improvements. That means that they 'accelerate' some search only by a constant factor, like 2, 3 or 100. Even if your ASIC does something a million times faster than a normal CPU, it's still a linear improvement.

If guessing a private key takes the current age of the universe in a CPU, an ASIC a million times faster would still take 13 thousand years.

Cryptography relies on problems being *exponential* on the key size. Exponential growth beats linear growth. If some day a powerful ASIC or CPU could guess a ECDSA private key, users of ECDSA would only have to increase their key sizes.

To yield a better than linear improvement, you would need a better algorithm. Implementing current day algorithms in faster hardware only gives linear improvements. It's widely believed, even if we still don't have formal proof, that it's not possible to get better algorithms for prime factorization and elliptic-curve factorization. (At least in non-quantum computers.) In other words, they are considered **intractable problems**.


---

### Answer by username_5 on 2018-03-05. Score: 0

ASIC does SHA256 hashes continuously. Getting Private key from Public key requires Elliptic Curve Multiplication in reverse. Elliptic Curve Multiplication is assumed to be very hard problem. i.e. By having point on the elliptic curve , You can add or multiply it as many times as you want but by having a point which has been multilpicated, you won't know its generator point. That is the hardness You have to solve in order to get that point. So no machine in this world can efficiently compute Private key by having Public Key.

> **Comments:**
> **username_0**: Doesn't an ASIC do whatever it is designed to do very fast? sha256 ASIC does sha256 very fast, but what about other ASIC? ASIC is not limited to only one task but a specific ASIC can only ever do one task.  
> **username_4**: Solving a problem faster doesn't mean magically faster, see my answer above  

---

