Live data from Hacker News

94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

twitter.com

731–740 of 747 posts

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#731

Earlier quoted context omitted.

Maybe this is dumb/naive, but I've wondered for quite a while - what if you take the latest deep learning/AI techniques and try to train a system to predict the approximate size of the hash from the input number? Has anyone seriously tried and failed?

If you could do it, you'd be famous for more than BTC. It would mean that you could factor numbers in polynomial time. Long story short, calculating the hash for BTC is intended to be a non-polynomial problem. If you can find a method (any method) that will reduce the search space of the answer such that you can calculate it in polynomial time, then you have proved that NP=P (If you can find a way to solve any non-po…

In some ways you are correct, but you have made some errors.

As schoen pointed out, no common hash function, including the ones used in Bitcoin, has a proof of NP-completeness.

Moreover, none of those hash functions involve factoring numbers, and factoring numbers is also not known to be NP-complete, although it is also not known to be tractable in polynomial time. One reason commonly-used proof-of-work functions do not involve integer factorization is that, while integer factorization is not known to be doable in polynomial time, there are a number of algorithms that require subexponential time, so an integer-factorization-based proof-of-work witness would be much larger than an equivalent hash-function-based proof-of-work witness.

Also, it is not the case that efficient integer factorization would completely break all current encryption. Not only do no commonly-used hash functions depend on it, neither do any commonly-used symmetric ciphers (such as AES), and the currently-most-popular asymmetric cryptosystems also do not depend on the difficulty of integer factorization; instead they depend on the difficulty of the elliptic-curve discrete logarithm problem.

ECDLP is also not known to be NP-complete, but the currently-known algorithms for it are much worse than currently-known algorithms for integer factorization, so elliptic-curve cryptosystems require much smaller keys and less computation to resist the known attacks than integer-factorization-based cryptosystems.

As little as ten years ago, algorithms that could be broken by better integer factorization algorithms were relatively much more important than they are today, because elliptic-curve cryptography was much less widely used. Many vulgar accounts of the situation intended for the ignorant are not up to date.

Finally, it is not true that a proof that P=NP would "completely break all current encryption", for two reasons. First, it might not be a constructive proof — it might show that a polynomial-time algorithm for factoring integers, solving ECDLP, or computing hash preimages exists without actually telling you how to compute it. Second, even a constructive proof of P=NP might not provide an algorithm that was adequately efficient — if it takes O(n²) time to encrypt and decrypt, where n is the size of a key, but O(n⁸) time to break a message or a key, you might be adequately safe with, say, RSA-4096. But an O(n⁸) algorithm for 3-SAT would definitely be a constructive proof of P=NP.

(Shor's algorithm on a quantum computer can break RSA, because it does depend on integer factorization, in O(n³) time, if quantum computers can exist, which they probably can. This would not make it impossible to do RSA encryption securely, but it would require much larger keys than are currently used.)

However, your fundamental point is that a successful attack on Bitcoin's hashing algorithm, using artificial neural networks or anything else, would be very surprising and have major implications, because that proof-of-work scheme is designed to require exponential work, and as far as anyone knows, it does. And that fundamental point is correct, even though you have made a number of errors in your supporting points.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#732
post #726

Earlier quoted context omitted.

Maybe this is dumb/naive, but I've wondered for quite a while - what if you take the latest deep learning/AI techniques and try to train a system to predict the approximate size of the hash from the input number? Has anyone seriously tried and failed?

A different angle from the sibling comment's: the hash functions used here are meant to approximate pseudorandom functions, which are functions that, while deterministic, literally have no structure at all relating their inputs to their outputs in any way. Hash functions used in the real world haven't been proven to have this property (and there are various theoretical limits on how readily they could be proven to ha…

This is correct.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#734
post #706

Earlier quoted context omitted.

> "And with the proper graph theory tools, much more complex interactions could be tracked." So you've said, and I already agreed that it isn't impossible. But do you have any real-world examples where someone followed reasonable OPSEC (fixed denominations, mixers, randomized timing) and still had their transactions successfully traced via these "proper graph theory tools"?

Who would have published such an example? When we deal with opsec, we have to consider what is possible, rather than what has been done in the past. We have to do better than merely "locking the house after the thief has gone".

> Who would have published such an example?

Typically that would be either the academic researcher attempting to prove that their investigation technique works, or the prosecutor looking to use the results of such an investigation as evidence in a trial.

> When we deal with opsec, we have to consider what is possible...

Anything is possible. Even ideal encryption algorithms—other than one-time pads—have some non-zero probability of being broken within a reasonable timeframe by a brute-force search, but that doesn't make them useless. As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#735
post #473

Earlier quoted context omitted.

You can be careful to not comingle funds or participate in KYC, but you have no forward security --- the person you paid (or their successor payees) can always comingle funds or participate in KYC. At which point, they may recall you paid them. Also, I can't imagine it's very convenient to manage a large number of separate keys.

> Also, I can't imagine it's very convenient to manage a large number of separate keys. A computer can do that for you.

I find the more things I do with a computer, the more there are to manage, not less.

...what is a "system administrator" anyway, and why is my computer telling me to ask them for help?

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#736

Earlier quoted context omitted.

That's what I figured. Weird to call it a coin. There are no coins in bitcoin.

Coins are just the metric used to quantify the amount on an address.

No. That's called the balance. "Coins" are not a thing. That term is not in any of the bitcoin glossaries or used on any exchange.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#738
post #614

Earlier quoted context omitted.

That's weird? Why is paying the ETF spread twice cheaper than paying the CAD/USD spread once?

For some reason, people think the cost of buying and selling a security is equal to the explicit commissions and fees, I guess.

Given some weird structure of fees and spread, paying the ETF spread twice might very well be cheaper. I have no clue.

I was just wondering, what weirdness must be going on to make that so.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#739
post #706

Earlier quoted context omitted.

Who would have published such an example? When we deal with opsec, we have to consider what is possible, rather than what has been done in the past. We have to do better than merely "locking the house after the thief has gone".

> Who would have published such an example? Typically that would be either the academic researcher attempting to prove that their investigation technique works, or the prosecutor looking to use the results of such an investigation as evidence in a trial. > When we deal with opsec, we have to consider what is possible... Anything is possible . Even ideal encryption algorithms—other than one-time pads—have some non-zer…

Maybe this is where we diverge.

> or the prosecutor looking to use the results of such an investigation as evidence in a trial

I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel.

> Anything is possible.[...] As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.

And here, I think it is probably cost-effective to come up with that technology, because it would allow tracing people and transactions that might otherwise be impenetrable. And, if that were the case, I don't have a hard time imagining that it would be of utmost importance to keep such technology under wraps.

But again, at this point it seems like we're comparing pessimism to optimism.

Re: 94k Bitcoin (1B USD) transferred from unknown wallet to unknown wallet

#740
post #739

Earlier quoted context omitted.

> Who would have published such an example? Typically that would be either the academic researcher attempting to prove that their investigation technique works, or the prosecutor looking to use the results of such an investigation as evidence in a trial. > When we deal with opsec, we have to consider what is possible... Anything is possible . Even ideal encryption algorithms—other than one-time pads—have some non-zer…

Maybe this is where we diverge. > or the prosecutor looking to use the results of such an investigation as evidence in a trial I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel. > Anything is possible.[...] As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible. And here, I think it is…

> I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel.

So am I, to a point, but even if they prefer not to disclose their actual methods (and are willing to commit perjury) they can't exactly hide the results. And others wouldn't have any incentive to keep their successes hidden.

> ...I think it is probably cost-effective to come up with that technology...

This isn't a matter of "technology" where some R&D spending up front is likely to lead to a method of cheaply tracing funds. If such a method existed then the system would indeed be broken; it would be akin to finding a critical weakness in an encryption scheme. Barring design flaws, however, the idea is to make all the transactions look the same so that even using your best graph theory tools you can't narrow down the possibilities enough to reasonably investigate all of them. That's what I meant by "not cost-effective": When there are 50 transfers that fit the parameters then you can investigate them all, but if there are 50,000 plausible trails to investigate then that effort would only be worthwhile in very high-profile cases.

Post reply on HN