Quote from: Bitcoin++ on June 18, 2014, 06:00:42 AM

-snip-
may these conspire and steal my coins, did a screen capture see the private key, did I write them down without any typos?

You could mitigate these risk.
Take the private key and split it in X parts.
Sign each part with the complete private key to make sure noone can temper with the parts.
Safe each pair (signature, part of the key and public key to verify the signature) in a textfile and encrypt each file symmetric with strong passwords.
Talk to a notar to set up your will and release the passwords through that.
Destroy all passwords afterwards (probably best to use some sort of hash as password, so cant "accidently" remember them yourself).
This way the notar cant steal your coins unless he/she works with A, B, C and D, which is unlikely.
Unless you brag that you have this fool proof system to protect your 150,000 Bitcoins Wink

This would however make it pretty impossible to get your coins while you are still alive. Not sure if thats the sort of solution you are looking for. Maybe exchange the part with the will with something less drastic. E.g. Safe, sealed envelopes, lock box etc.

Edit:

Quote from: DeathAndTaxes on June 17, 2014, 09:59:58 PM

-snip-
256 bit ECDSA keys only have 128 bit security. Half of an ECDSA key would be 64 bit security. While a naive attack would be to increment all possible private keys there are more sophisticated attacks ( https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_logarithms ) which are of complexity O( n^(1/2) ) steps where n is the key length.

64 bit security would be breakable but it is very likely the cost to break they key would be greater than the reward. Although if this isn't a hypothetical I would recommend transferring the coins now.

I hope you can help me out here. I have a problem calculating the time needed to crack it under the following assumptions.

2⁶⁴ ~ 1,8 * 10¹⁹. If an attack could be done with a 1TH/s (~1*10¹²) miner, that would take roughly 1,7 * 10¹³ seconds or roughly 2 10⁸ days (556K years).
1 PH/s (~1,1*10¹⁵) miner would need 4,5 hours.

Is it possible to use a ASIC miner for that attack? The way I understand the code[1] sha256 isnt used, which would not allow an attacker to use ASICs, correct? So the best possible machine to attack would be something like sabre? [2]

According to djb sabre can do "... 3000000000000000000000 multiplications per year ..." so 3*10²¹/year or 9,5*10¹³/s

So that beast would plow through 2⁶⁴ multiplications/operations (?) in ~53 hours.

(?) but thats not what it has to do to crack the code, right?

To sum it up, I guess my questions are:
- How do I get from X bit code to Y bit security? (I assume the way to go is: find the best available algorithm for the problem and use the big O approximation) Not sure if this applies for this example since the way I understand OP we dont have the public key.
- How do I get from Y bit security to Z calculations. IIRC big O does this as well, but ...
I dont really know what my but is here, besides that I am a little afraid because I just realized how powerfull the sabre cluster actually is.

-------------

Quote from: Parham6 on June 18, 2014, 06:38:33 AM

Quote from: cp1 on June 17, 2014, 09:36:47 PM

it'd only take you 10^24 years...

Sounds pretty unsecure to me, if you do that maybe someone's grand grand super grandest gran children could crack it in time?

9¹⁰ is very slow, thats a single core CPU running @ ~ 953 MHz, Not sure about the exact numbers but that sounds like trying to crack the code with your smartphone.

[1] https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_logarithms#Example
[2] http://blog.cr.yp.to/20140602-saber.html