~snip
By the position of the publickey in the list, I can determine according to the method of NotATether the privatekey (did not unterstand it actually... lol). Or I just bit shift the input and output 16 times by 2 getting actually generate a "decision tree". Then I only need to follow the decision tree and get the correct private key.
~
Isn't this just a more complicated meet in the middle attack? Another alternative method that also works:
Generate public keys p - 0 .... p - 65535
One of those public keys is guaranteed to have a private key with the lower 16 bits all zeroed out, thus divisible by 65536
Then just calculate private keys with stride 65536: 1 * 65536, 2 * 65536 ..... up until 2^24 * 65536 and match against your generated keys
The issue here is: 1. you need a known public key (not just an address) and 2. as you move up in key size, you need insane storage requirements, like for a 120 bit key the most optimal solution is to generate 2^60 public keys and match those against 2^60 private keys
....which is comparable to what kangaroo already does, but kangaroo doesn't have that large memory requirement.
Except you don't
need to calculate all keys with stride 65536 - we know that RNG software will (practically) never generate predictable keys that look like 11111100000 and like that so we measure how "random" a public key looks, by calculating the mean number of sequences (2 1-bits, 3 0-bits, and others) and store them in a vector, then for any PK we want to check we place it as another vector next to that one like this:
[mean sample]
And compute the avg. std. deviation of that by computing column-wise variance to get 1-column vector [ variance ], then take the mean of all values of that vector, then compute the square root.
The result is a coefficient that tells us how "random-looking" the PK is.
Now if we sort by coefficient, we can eliminate a bunch of stride amounts that give us absurd private keys like the one above. The question is now what is the function that will increment the stride to the next one based on random-looking coefficient?
I have a script for the coefficient calculation and it's working, but I'm on mobile right now so I have to wait to share it later.