📅 Original date posted:2016-01-08
📝 Original message:On Fri, Jan 8, 2016 at 4:38 AM, Gavin Andresen via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
> On Fri, Jan 8, 2016 at 7:02 AM, Rusty Russell <rusty at rustcorp.com.au> wrote:
>>
>> Matt Corallo <lf-lists at mattcorallo.com> writes:
>> > Indeed, anything which uses P2SH is obviously vulnerable if there is
>> > an attack on RIPEMD160 which reduces it's security only marginally.
>>
>> I don't think this is true? Even if you can generate a collision in
>> RIPEMD160, that doesn't help you since you need to create a specific
>> SHA256 hash for the RIPEMD160 preimage.
>>
>> Even a preimage attack only helps if it leads to more than one preimage
>> fairly cheaply; that would make grinding out the SHA256 preimage easier.
>> AFAICT even MD4 isn't this broken.
>
>
> It feels like we've gone over that before, but I can never remember where or
> when. I believe consensus was that if we were using the broken MD5 in all
> the places we use RIPEMD160 we'd still be secure today because of Satoshi's
> use of nested hash functions everywhere.
>
>>
>> But just with Moore's law (doubling every 18 months), we'll worry about
>> economically viable attacks in 20 years.[1]
>>
>>
>> That's far enough away that I would choose simplicity, and have all SW
>> scriptPubKeys simply be "<0> RIPEMD(SHA256(WP))" for now, but it's
>> not a no-brainer.
>
>
> Lets see if I've followed the specifics of the collision attack correctly,
> Ethan (or somebody) please let me know if I'm missing something:
>
> So attacker is in the middle of establishing a payment channel with
> somebody. Victim gives their public key, attacker creates the innocent
> fund-locking script '2 V A 2 CHECKMULTISIG' (V is victim's public key, A is
> attacker's) but doesn't give it to the victim yet.
>
> Instead they then generate about 2^81scripts that are some form of
> pay-to-attacker ....
> ... wait, no that doesn't work, because SHA256 is used as the inner hash
> function. They'd have to generate 2^129 to find a cycle in SHA256.
For 2^80 they simply generate 2^80 scripts that look innocent, and
2^80 that are not. With high probability there is a collision. I agree
that most cryptanalysis won't work because of the nesting, but 2^80 is
not good.
>
> Instead, they .. what? I don't see a viable attack unless RIPEMD160 and
> SHA256 (or the combination) suffers a cryptographic break.
>
>
> --
> --
> Gavin Andresen
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
--
"Man is born free, but everywhere he is in chains".
--Rousseau.
Watson Ladd [ARCHIVE] /
npub108…sr4hp
2023-06-07 17:47:44
in reply to nevent1q…4ggq
Author Public Key
npub108dfgewsuqzm6cvllzmxsv0xnn69rrjnyg5pa32a727k89ndh3xqmsr4hpSeen on
wss://relay.nostr.bandPublished at
2023-06-07 17:47:44Event JSON
{
"id": "fd8da4e3e82cf944375264c5c0eb0b2f193ca901efe03f2c70f1e80a7e8ca4df",
"pubkey": "79da9465d0e005bd619ff8b66831e69cf4518e5322281ec55df2bd63966dbc4c",
"created_at": 1686160064,
"kind": 1,
"tags": [
[
"e",
"e1f46f49861d474f81d81bf43d690af02c9b35e1c9c4fe5cc415112a34c1c041",
"",
"root"
],
[
"e",
"d7e714709ef307e3c76228d29aad6f477f78f7e48fc24500e3cd763382cd22da",
"",
"reply"
],
[
"p",
"857f2f78dc1639e711f5ea703a9fc978e22ebd279abdea1861b7daa833512ee4"
]
],
"content": "📅 Original date posted:2016-01-08\n📝 Original message:On Fri, Jan 8, 2016 at 4:38 AM, Gavin Andresen via bitcoin-dev\n\u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e On Fri, Jan 8, 2016 at 7:02 AM, Rusty Russell \u003crusty at rustcorp.com.au\u003e wrote:\n\u003e\u003e\n\u003e\u003e Matt Corallo \u003clf-lists at mattcorallo.com\u003e writes:\n\u003e\u003e \u003e Indeed, anything which uses P2SH is obviously vulnerable if there is\n\u003e\u003e \u003e an attack on RIPEMD160 which reduces it's security only marginally.\n\u003e\u003e\n\u003e\u003e I don't think this is true? Even if you can generate a collision in\n\u003e\u003e RIPEMD160, that doesn't help you since you need to create a specific\n\u003e\u003e SHA256 hash for the RIPEMD160 preimage.\n\u003e\u003e\n\u003e\u003e Even a preimage attack only helps if it leads to more than one preimage\n\u003e\u003e fairly cheaply; that would make grinding out the SHA256 preimage easier.\n\u003e\u003e AFAICT even MD4 isn't this broken.\n\u003e\n\u003e\n\u003e It feels like we've gone over that before, but I can never remember where or\n\u003e when. I believe consensus was that if we were using the broken MD5 in all\n\u003e the places we use RIPEMD160 we'd still be secure today because of Satoshi's\n\u003e use of nested hash functions everywhere.\n\u003e\n\u003e\u003e\n\u003e\u003e But just with Moore's law (doubling every 18 months), we'll worry about\n\u003e\u003e economically viable attacks in 20 years.[1]\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e That's far enough away that I would choose simplicity, and have all SW\n\u003e\u003e scriptPubKeys simply be \"\u003c0\u003e RIPEMD(SHA256(WP))\" for now, but it's\n\u003e\u003e not a no-brainer.\n\u003e\n\u003e\n\u003e Lets see if I've followed the specifics of the collision attack correctly,\n\u003e Ethan (or somebody) please let me know if I'm missing something:\n\u003e\n\u003e So attacker is in the middle of establishing a payment channel with\n\u003e somebody. Victim gives their public key, attacker creates the innocent\n\u003e fund-locking script '2 V A 2 CHECKMULTISIG' (V is victim's public key, A is\n\u003e attacker's) but doesn't give it to the victim yet.\n\u003e\n\u003e Instead they then generate about 2^81scripts that are some form of\n\u003e pay-to-attacker ....\n\u003e ... wait, no that doesn't work, because SHA256 is used as the inner hash\n\u003e function. They'd have to generate 2^129 to find a cycle in SHA256.\n\nFor 2^80 they simply generate 2^80 scripts that look innocent, and\n2^80 that are not. With high probability there is a collision. I agree\nthat most cryptanalysis won't work because of the nesting, but 2^80 is\nnot good.\n\u003e\n\u003e Instead, they .. what? I don't see a viable attack unless RIPEMD160 and\n\u003e SHA256 (or the combination) suffers a cryptographic break.\n\u003e\n\u003e\n\u003e --\n\u003e --\n\u003e Gavin Andresen\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\n\n\n-- \n\"Man is born free, but everywhere he is in chains\".\n--Rousseau.",
"sig": "7ebc3b4f4f43f4a436bbb6bdf20bb20e597ed1cfe1d77166533126a23780205513b400fba4f350cc46d5bde0ebad9caa8130ed611ce294512e0dc90618c3906a"
}