Suppose you owned every computer on Earth. All of them — every laptop, every server farm, every phone in every pocket — pointed at one job: guessing a single fairly chosen 256-bit key. How long would you need?
This chapter prices that question honestly, with nothing but Part I's arithmetic and a few numbers from physics. The answer comes in three currencies: time, machines, and energy. And then it answers the attacker's last resort — "what if I don't care which key, any funded key will do" — and shows that even that discount changes nothing. This is the chapter where "cannot be guessed" stops being a slogan and becomes an invoice.
Assemble the tools. Chapter 3: a systematic search through \(N\) possibilities expects to finish halfway through — an average of \(N/2\) tries — and succeeds after \(k\) distinct tries with chance exactly \(k/N\). Chapter 7: \(N = 2^{256}\). Chapter 6's computer science: tries cost time and energy. Pricing the search is now substitution:
The entire question is what a realistic try rate and cost are. So measure with the fastest relevant machine humanity operates.
The mightiest guessing engine ever built is the Bitcoin network itself: in the mid-2020s it grinds through about \(10^{21}\) hashes per second — a 1 with 21 zeros, every second, worldwide. (Chapter 1's power notation, scaled up: \(10^{21}\) is a 1 followed by 21 zeros.) Lend the attacker the whole thing — every miner on Earth repurposed from mining to key-searching, at \(10^{21}\) tries per second:
\[ \text{expected time} = \frac{2^{255}}{10^{21}} \text{ seconds} \approx 1.8 \times 10^{48} \text{ years}. \]The universe is \(1.38 \times 10^{10}\) years old. The expected search runs about \(10^{38}\) universe-lifetimes long. Even the lucky cases don't save him: to get even a 1-in-a-million shot at the key (\(k/N = 10^{-6}\) — a minus sign in the exponent just means "one over," so \(10^{-6}\) is \(1/10^{6}\), one in a million) he needs \(k = 2^{256}/10^{6}\) tries, which at the same rate is still \(10^{50}\) seconds of trying. There is no schedule here to be lucky against.
Maybe the attacker waits for better computers? Physics answers with a floor that no computer can ever go under. Flipping a bit — the smallest possible step of any computation — costs energy, and the thermodynamic minimum (the Landauer limit) at room temperature is about \(2.9 \times 10^{-21}\) joules per flip: \(0.000\,000\,000\,000\,000\,000\,002\,9\) joules. That is the floor; every real machine sits orders of magnitude above it.
Now merely count to \(2^{256}\) — not test keys, not hash anything, just count — and each step flips bits at that floor:
\[ 2^{256} \times 2.9 \times 10^{-21} \text{ joules} \approx 3.4 \times 10^{56} \text{ joules}. \]The Sun's entire output for a year is about \(1.2 \times 10^{34}\) joules. So counting to \(2^{256}\) at the coldest cost physics permits would burn the Sun's whole annual output about \(2.8 \times 10^{22}\) times — twenty-eight thousand billion billion sun-years, to count. Real key-testing machinery, per try, sits far above the floor; and the floor itself only drops a little with colder computers. There is no engineering path from here to there. The number is not hard to search; it is thermodynamically unsearchable.
One loophole is worth taking seriously, because it is the attacker's best card. All the pricing so far targeted one specific key. What if the thief is indiscriminate — any funded key will do? If a million keys each guard coins, then every guess has a million chances to hit something: the per-try chance rises from \(1\) in \(2^{256}\) to \(10^{6}\) in \(2^{256}\). That is the batch advantage, and it is real.
Now price it. The per-try chance becomes about \(8.6 \times 10^{-72}\). The expected tries to some hit: about \(5.8 \times 10^{70}\) (Chapter 3's halfway rule applied to the reduced space; the exact first-hit mean is twice this — the difference never matters here). At the whole-network rate of \(10^{21}\) tries per second, that is about \(1.8 \times 10^{42}\) years for one hit against any of a million targets. A million targets, and the invoice still reads in universe-lifetimes beyond counting. The batch advantage multiplies the attacker's power by the number of targets — and even a billion targets multiply a number beyond imagining by a factor that remains imaginable. The space absorbs it.
So brute force against fairly chosen keys is over: not hard, not impractical — over. Which concentrates the whole security question onto the one assumption doing the work: fairly chosen. What if the key was chosen from a smaller or skewed space? Then the attacker searches that space, and the arithmetic turns savage. That is Part IV, and it is where every real theft in Bitcoin's history lives.
Part II measured choice; Part III priced the search. The invoice says: a fairly chosen 256-bit key is beyond guessing — by time, by machines, by thermodynamics, even in batches. So the attacker's profession reduces to a hunt for keys that were never fairly chosen: the human-picked phrase, the wounded random number generator, the nonce that rolled the same value twice. Part IV opens the case files — the real thefts, the on-chain evidence, and the mempool sharks that still circle low-entropy keys today.
Exercise 8.1 ★ The invoice line. An attacker makes \(10^{15}\) distinct tries at a fairly chosen 256-bit key (a quadrillion — far beyond any real budget). What is his exact chance of success? You should get \(10^{15}/2^{256} \approx 8.6 \times 10^{-63}\).
Exercise 8.2 ★ Network muscle. At \(10^{21}\) tries per second, how many years does the average search of a 256-bit space take? Confirm the chapter's figure: about \(1.8 \times 10^{48}\) years.
Exercise 8.3 ★★ The sun-years check. Using the chapter's constants — \(2.9 \times 10^{-21}\) joules per bit flip, \(1.2 \times 10^{34}\) joules per Sun-year — verify that counting to \(2^{256}\) costs about \(2.8 \times 10^{22}\) Sun-years. What assumption makes this a floor rather than an estimate?
Exercise 8.4 ★★ The batch discount. There are roughly fifty million funded Bitcoin addresses. Recompute the attacker's per-try chance and expected tries-to-first-hit against the whole batch. You should get about \(4.3 \times 10^{-70}\) per try and about \(1.2 \times 10^{69}\) expected tries. Does the discount change the verdict?
Exercise 8.5 ★★★ "Security through a big keyspace is security by obscurity." Take a position, in two paragraphs, using this chapter's invoice and Chapter 5's metric. Distinguish: a secret that is one of astronomically many, fairly chosen versus a secret that is hidden — and name the exact property (from Chapter 5) that separates the two.
Sketches, not model answers — enough to check your reasoning against. The computational exercises embed their expected outputs in the exercise text.
Exercise 8.3. The floor comes from the Landauer principle: flipping a bit dissipates at least about \(2.9 \times 10^{-21}\) joules at room temperature, so \(2^{256}\) flips cost at least \(3.4 \times 10^{56}\) joules no matter what the computer is made of — silicon, light, or physics not yet invented. "Floor" means exactly that: the argument assumes the cheapest physics allows, so no future machine can beat the number. Real machines sit orders of magnitude above it.
Exercise 8.5. Security by obscurity fails because the hiding place is one of few, and leakers exist: the safe under the bed is among the first places a thief looks — low min-entropy in this book's terms. A fairly chosen 256-bit key is the opposite situation: it is not hidden in a small space someone can ransack, it is one point in a space no search can traverse, with every point equally likely — maximal min-entropy. The obscurity critique is really the Chapter-5 critique: it bites exactly when the choice process is small or skewed. The remedy is not a cleverer hiding place; it is a fairer die.