[bspammer]

I’m not a crypto expert at all, but surely it takes away no entropy because the fixed prefix is on the public key not the private key?

My reasoning is that the full public key could be seen as a 256 bit fixed prefix, but knowing the public key is meant to give no information about the private key by design.

[colanderman]

That may be true, but I don't think that it is obviously so.

If it were, then public keys could be shorter by the same amount and still provide the same level of protection.

But by design they are not.

[bspammer]

I still think my reasoning holds.

Let's say that I magically manage to find a private key whose public key has a chosen prefix that is the entire length of the key - i.e. the entire key is vanity. Something like myveryveryveryverylongvanitypublickey. Is that equivalent to a 0 length public key in terms of security? I'd say obviously not - there is still no way to get started when it comes to finding the private key.

[colanderman]

If you've found the private key for myveryveryveryverylongvanitypublickey, then so can an adversary.

Perhaps they already have reversed it because they guessed it might be desirable. Or maybe it has numeric properties which make it specifically easy to reverse (perhaps why you were able to discover it yourself).

(Also note that selecting the entire key to be vanity doesn't reduce the entropy to 0, just to the entropy of the vanity phrase. So a full vanity key may be equivalent to something like a 32-bit random public key.)