Private keys as easy as 1,2,3

The basic idea of elliptic-curve cryptography is that it's easy to go forward along a mathematically defined curve and effectively impossible to go back. 

What you move forward toward is a public key: a two-dimensional point (x,y) located somewhere along a “curve” defined by a mathematical equation.

(I used scare quotes there because the equation produces a scatterplot of coordinates that only a mathematician could identify as a curve.) 

What gets you there is a private key: Starting from a fixed base point on the curve (G), you add G to itself some number of times (d) to arrive at the public key (x,y).

D is the private key: an integer you plug into the curve’s equation to get to the public key.

The practical result is that deriving a public key from a private key (going forward) takes milliseconds, but deriving a private key from a public key (going backward) would take billions of years. 

I can’t explain exactly why going backward takes as long as that, but I know it has something to do with elliptic curve math.

The important thing is what this makes possible: e-commerce, private messaging, biometric authentication, cryptocurrency.

Elliptic-key cryptography allows two complete strangers to communicate securely over a public network without having agreed on a secret code in advance.

To participate, all you need is a private key that’s long enough that no one will guess it.

Because someone might try.

In crypto, for example, private keys typically look something like: 4f9a2c88e5d1b703e498c116a82705f32b859e4d07c31fae81b6dc24089e9247. 

Despite the letters involved, this is just a number. Each hexadecimal digit in the string (number or letter) represents four bits of binary data (f = 1111, 8 = 1000, etc.), which allows a giant, 256-bit number to be written in just 64 characters.

This makes it effectively impossible to guess. With 2²⁵⁶ possibilities to choose from, nearly every atom in the observable universe could be assigned its own private key.

But if they were, some of the atoms would get stuck with a private key that’s easy to guess.

Like the number 4, for example.

This happened just recently. One of the private keys used by the Certificate Authority eMudhra to secure the world wide web was simply the number 4 (with a lot of zeros in front of it).

Conveniently easy to remember!

But also easy to guess.

To guess the private key paired with one of the eMudhra’s public keys, you only need to make four guesses. Start with the number one, put that through the elliptic curve equation discussed above — Q = G x D — and keep going until one of the outputs matches one of eMudhra’s public keys.

You’d have it on the fourth try.

This works with crypto addresses, too.

On Solana, for example, you can start with the number 1, ask a computer to calculate forward to the public-key address it’s paired with (just one step away!), and then check if there’s any crypto to steal.

There is!

The Solana address that’s unlocked with the private key of just 1 currently holds 0.00148844 SOL. 

That’s only worth about $0.14 of real money, unfortunately, which is not worth the gas fees required to steal it.

I kept going and found that the next few private keys — 2, 3, 4 — unlock addresses holding similarly trivial amounts of SOL.

But number 5! The private key of 5 unlocks an address with a king’s ransom of 1.4 SOL on it.

That’s $130.24 in real money, which I think we can all agree is well worth stealing.

I intended to, too. But when I imported the private key into Phantom, it warned me the account might be malicious: 

I can’t really think of what could go wrong by just sending crypto out of an address. But it does seem like a trap. Why would 1.4 SOL be just sitting there for the taking? Aren’t there bots that look for these things?

To test this, I looked for the lowest-numbered private key that no one had used yet, which turned out to be the number 257. I ran the equation to find the address this unlocks. I pasted the address into my Phantom wallet and sent it 1 SOL.

A bot took my SOL less than a minute later.

(Part Two of this experiment will be if I can expense the $93 of SOL this cost me. I'll let you know.)

This is unsurprising. Sweeper bots are constantly looking for private keys that are easy to guess (presumably because someone wanted them to be easy to remember) and then sweeping the crypto out of the corresponding addresses.

But why’d they take my 1 SOL, secured by the private key 257, and not the 1.4 SOL secured by the private key 5?

I don’t know. Maybe the bots start scanning at 200 because what kind of dummy would leave money secured by the number 5? Or maybe they know a trap when they see one.

Either way, it’s a reminder to make your private keys hard to guess.

(And hard to find, too.)

— Byron Gilliam

_{Brought to you by:}

My OnChain Net Yield Fund (MONY) is J.P. Morgan Asset Management's first tokenized money market fund, built for a new era of liquidity.

MONY, our tokenized money market fund on a public blockchain, pairs MMF relative stability and yield with onchain speed and transparency for liquidity management.