Private Key Brute-Force Time Estimate

Because brute force is not the best attack against elliptic-curve cryptography. A Bitcoin private key is a 256-bit scalar, but recovering it from the corresponding public key — the discrete logarithm problem on the secp256k1 curve — can be solved by Pollard's rho algorithm in roughly 2¹²⁸ operations rather than 2²⁵⁶. That square-root speedup is a generic property of the discrete-log and factoring problems, and it means the effective security of every ECC and RSA key is about half its nominal size. A 256-bit ECC key gives 128 bits; a 384-bit key gives 192 bits; a 521-bit key gives about 260 bits. Symmetric ciphers are the exception: AES-256 really does have 256 bits of security against brute force, because there is no known attack that beats exhaustive search by a meaningful margin.

It depends on what is being attacked and by whom. For a leaked password hash, a single modern GPU does 10⁹–10¹⁰ guesses per second against fast hashes like MD5 or SHA-1, and 10⁴–10⁶ per second against a deliberately slow hash like bcrypt or Argon2. A professional GPU farm reaches 10¹², and a well-funded adversary with FPGAs or custom ASICs can plausibly reach 10¹⁵–10¹⁸. A nation-state with a dedicated fab and cheap power might hit 10²¹. For asymmetric keys the rates are far lower — each test requires an elliptic-curve or modular-exponentiation operation, which is thousands of times slower than a hash — so the effective rate against a 128-bit ECC key is more like 10⁹–10¹² operations per second at best. The practical rule is to assume the highest rate your adversary could plausibly reach, because the cost of overestimating their capability is trivial compared to underestimating it.

Yes, and it is surprisingly restrictive. The Landauer limit says that erasing a single bit of information at room temperature costs at least k_BT ln 2 ≈ 2.8 × 10⁻²¹ joules, where k_B is Boltzmann's constant and T is the temperature. Any irreversible computation — which includes any key test that discards intermediate state — must dissipate at least this much energy per bit operation. A 1 GW power plant running at the Landauer limit could therefore perform at most about 3.6 × 10²⁹ bit operations per second, and a practical machine is perhaps 10⁸ times less efficient, giving 10²¹–10²² guesses per second as the realistic ceiling for a planetary-scale effort. Beyond that you would need to convert the entire energy output of a star, and even then 128-bit keys remain safe by enormous margins.

Differently for symmetric and asymmetric keys. Grover's algorithm gives a quadratic speedup against symmetric ciphers: it can search an N-element space in √N operations instead of N. Applied to AES-128, that means an effective security of about 64 bits, which is why post-quantum guidance recommends AES-256 for anything long-lived — Grover reduces it to 128 bits, which is still comfortable. For asymmetric cryptography the picture is worse: Shor's algorithm solves both integer factorisation and discrete logarithms in polynomial time, which means RSA, Diffie-Hellman, and elliptic-curve cryptography all fall completely once a sufficiently large quantum computer exists. There is no partial credit — a cryptographically relevant quantum computer breaks ECC and RSA outright. This is why the transition to post-quantum algorithms like ML-KEM and ML-DSA is underway. Current estimates for the hardware needed vary widely, from ten to thirty years out, but the migration timelines are already shorter than the risk window.

For anything you expect to remain secure for the next twenty years, 128 bits is the modern floor and 256 bits is the comfortable ceiling. Below 112 bits you are in territory that serious standards bodies have already deprecated — NIST moved away from 3DES and RSA-1024 for exactly this reason. Between 112 and 128 bits is the transitional zone: RSA-2048 and similar are still acceptable for legacy systems but should not be chosen for new designs. At 128 bits and above, the exponential makes further increases almost pointless for classical attackers: going from 128 to 256 bits multiplies the crack time by 2¹²⁸, which is astronomically larger than any hardware improvement could compensate for. The reason to go higher anyway is quantum resistance — 256-bit symmetric keys survive Grover with 128 bits of margin — and defence against the possibility that a subtle implementation weakness shaves off some of the theoretical entropy.

No — it means brute force is infeasible, which is only one of many ways a key can be compromised. A 256-bit key generated by a random number generator that only had 32 bits of internal state is a 32-bit key wearing a 256-bit costume, and no amount of arithmetic changes that. Real-world key compromises overwhelmingly come from other directions: the key was logged by malware, extracted through a side channel such as timing or power analysis, guessed because it was derived from a weak passphrase, intercepted during generation, or recovered from an improperly wiped device. The brute-force calculation tells you the key is safe against exhaustive search, and that is genuinely valuable — it eliminates the simplest attack. It says nothing about whether the key was generated properly, stored properly, or used in an implementation free of flaws.

A password's effective bits are log₂ of the size of the space an attacker would realistically search, which is almost never the full character-alphabet space. An eight-character random alphanumeric password has about 47 bits if the attacker searches the full 62-character alphabet, but a human-chosen eight-character password has perhaps 20–30 bits because attacker dictionaries exploit the way people pick passwords. A four-word Diceware passphrase drawn from a 7,776-word list has 4 × 12.9 ≈ 52 bits. A six-word Diceware phrase has about 77 bits. To reach 128 bits you need either 10 Diceware words, or a 20-character truly random string from a 94-character alphabet. The practical translation is that a well-generated six-word passphrase is roughly equivalent to a 77-bit key, which is comfortably above what a GPU farm can reach but below the modern 128-bit recommendation.