This is a scam. This has been known to be a scam since post #125, nearly a week ago now. Why are you still talking about it?

There is no statistical project. There are no rendezvous points. There is no algorithm. He isn't washing Pollard's jockstrap, much less trying to implement any actual math. His script generates keys from a tiny, tiny keyspace, and then his "cracker" searches that same tiny keyspace.

Also, Ritual is almost certainly the same person as Evil-Knievel. Re-read the whole thread and watch out for posts from both accounts that appear to be in the other character's voice.

Quote from: JoTheKhan on January 29, 2014, 02:30:44 AM

Quote from: fpgaminer on January 29, 2014, 01:49:42 AM

Here's what's going on. Evil-Knievel has pre-computed a couple points on the secp256k1 curve. Specifically points where the exponent is of the form 2**N. (see 1,2) He then wrote a program, the "cracker", that can search the area around those points. If a Bitcoin key-pair lies close to one of those points, his program will find it.

This isn't dangerous. It's improbable (~impossible) that any uniformly random Bitcoin key-pairs are weak to his pre-computed points. The secp256k1 keyspace is, for all practical purposes, infinitely large. It doesn't matter if Evil-Knievel had a gabillion-gajillion pre-computed points and all the computing power in the universe. His approach still wouldn't crack a normal Bitcoin key-pair.

To me, having just read Evil-Knievel's thread, it sounds like he's insinuating that there is danger here. He's insinuating that a uniformly random Bitcoin key-pair has a reasonable chance of being tractably close to one of his pre-computed points. There is no reasonable chance of this, and his claims are ridiculous. The thread should be closed as a scam, because he's asking for money on misleading premises.

If he has nothing to hide, why was his HTML generator obfuscated? I'll help and de-obfuscate the generator for everyone. Here's the algorithm:

Code:

Pick a random N, [128, 255].
Pick a random M, [1, 20000000].
Spit out 2**N - M as a private key.

See the problem? He just needs to take a generated public key, add G to it ~20,000,000 until it matches one of the 128 pre-computed keys (which are of the form 2**N), and BAM the private key is "cracked". This doesn't make Bitcoin weak. It never will. It's a rainbow table attack. But mankind will never have enough computational and storage power to make rainbow tables work against secp256k1.

As for the bitprobing.com "project". That's a load of bollocks. If you don't believe what the experts have to say about ECDSA, that's fine. But go learn group theory and number theory first, before asking the public to help run unsubstantiated "experiments."

I know these forums are intentionally soft-modded, and appreciate that to an extent. But it's times like these I wish the forums were more aggressively moderated so that Evil-Knievel could just be banned for misleading and scamming people.

(1) Actually, he fscked this up. He interpretes the decimal result of 2**N as hexadecimal.
(2) 2**128 is 340282366920938463463374607431768211456. Interpret that as a hexadecimal private key and you get a public key of 04864f29af3191e135f5c78499271961f2313110fb2a296bf072733475529da1fb4d5cef64d1212 a946775bfb2db5319fb618089ae8806d618f44d68d3bdb18650. The least significant 32-bits of the X coordinate is 0x529da1fb. That matches one of the constant in his script. I assume the rest match similarly.