Quote from: shorena on October 14, 2015, 06:33:54 PM

Quote from: Swordsoffreedom on October 14, 2015, 10:51:14 AM

-snip-
Simple Answer: NO
-snip-

Did you even look at the picture you posted? OP is talking about the public key.

It's in the picture did you read each part of the process ?
And the infographic shows the process it merited posting.

Op's question was
Can a bitcoin address can be recovered from public key... If not so how is it related to bitcoin address???

The answer is NO
However you can try if your looking for an atom in the sun or run a defective client.
(you cannot compute the public key without the private key). A problem is that if one private key is leaked the others can easily be computed, but there is no general way to avoid it. )

---

Quote from: johoe on August 23, 2015, 11:21:41 PM

Quote from: sebastian on August 23, 2015, 07:23:31 PM

By publishing Kp, a customer should be able to combine Kp and n, in such a way he gains a public key Kp(1013853254).
If a customer sends Money to the associated adress of this public key Kp(1013853254), then the funds
should be spendable by combining Ks with n in such a way I gain Ks(1013853254).

How is this possible with lets say EC primitives?

The associative law and the distributive law hold for EC and can be used. Kp = Ks * G, hence
(1013+Ks) * G = 1013*G + Ks*G = 1013*G + Kp
and
(1013*Ks) * G = 1013 * (Ks * G) = 1013 * Kp

Note that + and * have two different meanings above. Operator + is point addition or number addition modulo group order. Operator * is point multiplication or number multiplication modulo group order.

So 1013+Ks is the private key for 1013*G + Kp and 1013*Ks is the private key for 1013 * Kp.

I think it doesn't really matter which method you use. See also BIP32, which uses a variant of the first method for non-hardened derivation (hardened derivation is not what you want, because then you cannot compute the public key without the private key). A problem is that if one private key is leaked the others can easily be computed, but there is no general way to avoid it.

--

Quote from: johoe on February 19, 2015, 06:02:21 PM

Quote from: Rintila on February 19, 2015, 02:05:13 PM

We are talking about Private Key generations... Can some guru out there have a look at my posts and give some scientific answer to my concerns?

I think not only me, but the Bitcoin community would appreciate that.

https://bitcointalk.org/index.php?topic=961023.msg10511395#msg10511395

Satoshi, you there?

So lets do the math. vanitygen can generate about 1 MKey/s with a few tweaks (e.g. try positive/negative, compressed and uncompressed keys at the same time) on today's computer. Lets assume that using ASIC technology (which you have to build from scratch, since SHA-256 is not enough to generate private/public key pairs) you can get a speedup of a trillion (the current Bitcoin network has significantly less than a trillion times more computing power than Satoshi's computer). Lets assume there are about 100 million addresses that currently have a non-zero balance (I think it's less). There are only 2^160 addresses (since we hash to 160 bits). So you need on average

Code:

2^160 addresses / (100 million non-empty addreses) / a trillion speedup / 1 million (keys/s) /31.5 million (s/year) = 464*10^12 years/key

This are around 465 trillion years to find a single key for a non-empty address, if I'm not mistaken.

Okay, if Moore's law will still hold for 75 years, then this method might become feasible -- if you want to invest as much money as all miners together and let the computer work for half a year to find a fraction of a Bitcoin in some random address.

BTW, there are faster ways than brute-forcing all addresses. You could take an address with lot of funds where the public key is known (e.g. Bitstamp's cold wallet) and use the big-step, baby-step algorithm that "only" has complexity 2^128. That may be 100 times faster.

And since you asked for quantum computers: The current quantum computers can probably not be used, but if you have a real 65000-qbit quantum computer that can do complex computations without decoherence for a few seconds, then you can probably crack a public key in a few seconds.

--
Since that does not happen in most use cases the simple answer is NO