A common processor, running a well-written program, tests around a few million keys per second. A modern graphics card tests billions. The difference doesn't come from the card being faster — its core is slower than the processor's — but from having thousands of them.
It's the nature of the problem that allows this. Testing candidate number one billion doesn't depend at all on the result of candidate number nine hundred and ninety-nine million. Each attempt is independent of the others, and problems like this are ideal for a machine with sixteen thousand small cores instead of sixteen large ones.
It's worth being specific about what the card actually does quickly. The expensive part is the arithmetic in the finite field, especially the modular inversion, and the big gain came from an organizational trick: processing hundreds or thousands of points in batches, with a single inversion shared among all. The rest — the hashes, the comparisons — is cheap. Programs like keyhunt and VanitySearch, which the next module introduces, are largely careful implementations of this idea.
Now the question everyone asks: what about an ASIC? If there are dedicated chips for mining, why not for key searching?
The answer has two parts, and both are interesting. The first is that mining ASICs are not suitable: they calculate SHA-256 over an eighty-byte header, and nothing more. They don't know how to multiply points on a curve, they don't know how to perform modular inversion, and no software update can teach them — the logic is etched into the silicon.
The second is that an ASIC purposely made for the secp256k1 curve is technically possible and economically challenging. Designing and manufacturing a chip costs millions of dollars and takes more than a year, and the result serves only one task. A miner amortizes this investment with continuous revenue; someone searching for a specific key has a single, uncertain prize, which could be claimed by someone else the day before the chip is delivered. That's why, in practice, the world of challenges runs on rented or second-hand graphics cards.
With this on the table, the distance between 2^40 and 2^70 becomes clear. Forty bits are a trillion candidates: a graphics card solves it in minutes, and a notebook solves it in hours. Fifty bits are a thousand times more: hours on a card. Sixty bits are another thousand times: weeks. Seventy bits are another thousand times: the six thousand years of a single card, as calculated in Lesson 2.
Notice the shape of this staircase. It's not that seventy is almost double forty. It's that seventy is a billion times forty. Every ten bits multiply by a thousand, and three steps of ten bits separate an afternoon's work from an effort that requires an entire organization.
And that's why progress is slow and predictable. Hardware improves, but it improves by factors of two or three each generation, and each factor of two buys exactly one bit. A card ten times faster than today's advances just over three bits at the frontier. No generation of hardware will turn eighty bits into something easy, and nothing on the horizon threatens the 256 bits of a properly chosen key.
One last observation, which prepares for the next lesson. All the calculations in this module assume a single operation sweeping the range from start to finish. When many people search at the same time, without coordinating anything, almost all this work is repeated: two thousand computers testing the same candidates are worth one. Organizing the division is what turns summed effort into useful effort — and that's the subject of the next lesson.