Quote from: DannyHamilton on June 22, 2016, 08:03:13 PM

A public key is a 256 bit X-value and a 256 bit Y-value, but the Y-value can be calculated from the X-value.
A bitcoin address is 160 bits.

I keep hearing that an unspent address has more security. So if the pubkey adds 256bit, and a bitcoin address is by default 160 bit, then an unspent bitcoin address is 416 bit?

Why do people say that a private key has only 128 bit because ECDSA provides only 128, see the quotes below

Quote from: DeathAndTaxes on April 20, 2014, 07:58:06 PM

Quote from: jonald_fyookball on April 20, 2014, 05:50:16 PM

I get it... However, bitcoin already has key stretching.

Bitcoin the protocol does not use key stretching.

Bitcoin-core "the client" uses key stretching to harden to the WALLET DECRYPTION PASSPHRASE against brute force attack. Nothing more. Electrum doesn't copy that code from bitcoin-core wallet so it isn't key stretching "again".

Quote

edit: actually i dont think it would increase the entropy, just add more stretching, since the seed has less entropy than a 160 bit "normal" priv key

Private keys only have 128 bit key strength. Not 160 bit and not 256 bit.

Quote from: DeathAndTaxes on April 20, 2014, 03:58:44 PM

256 bit ECDSA keys have 128 bits of key strength. It requires 2^128 operations to brute force the privKey from the PubKey. This assumes the PubKey is known. If it isn't the an attacker would need to attempt a hash collision against the PubKeyHash, looking for any privKey which produces the same PubKeyHash. That would require on average 2^160 operations. Yes the PubKeyHash is oversized. Bitcoin would have similar security (when PubKey is known) is the PubKeyHash was only 128 bits (i.e. RIPEMD-128 or XOR the left and right 128 bit sequence of SHA-256).

As for key stretching reducing entropy is depends on how it is implemented. I haven't looked at Electrum source code but PBKDF2 was created to remove the entropy loss associated with PBKDF1.

Quote from: dabura667 on June 02, 2016, 07:55:31 AM

There is a cap to the maximum security possible on secp256k1 at n/2 of key size.

256 bit keys therefore only provide 128 bits of security.

Anything more than 128 bit for bitcoin is just "feel good" territory.

It's kinda hard to tell who is right and wrong, so please enlighten me