š
Original date posted:2016-01-12
š Original message:I'm convinced-- it is a good idea to worry about 80-bit collision attacks
now.
Thanks to all the people smarter than me who contributed to this
discussion, I learned a lot about collision attacks that I didn't know
before.
Would this be a reasonable "executive summary" :
If you are agreeing to lock up funds with somebody else, and they control
what public key to use, you are susceptible to collision attacks.
It is very likely an 80-bit-collision-in-ten-minutes attack will cost less
than $1million in 10 to twenty years (possibly sooner if there are crypto
breaks in that time).
If you don't trust the person with whom you're locking up funds and you're
locking up a significant amount of money (tens of millions of dollars
today, tens of thousands of dollars in a few years):
Then you should avoid using pay-to-script-hash addresses and instead use
the payment protocol and "raw" multisig outputs.
AND/OR
Have them give you a hierarchical deterministic (BIP32) seed, and derive a
public key for them to use.
----------
Following the security in depth and validate all input secure coding
principles would mean doing both-- avoid p2sh AND have all parties to a
transaction exchange HD seeds, add randomness, and use the resulting public
keys in the transaction.
--
--
Gavin Andresen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160112/866bc47e/attachment.html>;
Gavin Andresen [ARCHIVE] /
npub1s4ā¦d44kw
2023-06-07 17:47:47
in reply to nevent1qā¦g04e
Author Public Key
npub1s4lj77xuzcu7wy04afcr487f0r3za0f8n2775xrpkld2sv639mjqsd44kwPublished at
2023-06-07 17:47:47Event JSON
{
"id": "86bf81b0df9a39e8fd4db1a3380be8be6b4c90ee7be8d45f25a87d44831b2e42",
"pubkey": "857f2f78dc1639e711f5ea703a9fc978e22ebd279abdea1861b7daa833512ee4",
"created_at": 1686160067,
"kind": 1,
"tags": [
[
"e",
"e1f46f49861d474f81d81bf43d690af02c9b35e1c9c4fe5cc415112a34c1c041",
"",
"root"
],
[
"e",
"0669125e13b402b8f8f9e6940a973c08352db3f80928b6a9d3002b05eb90d6fc",
"",
"reply"
],
[
"p",
"46986f86b97cc97829a031b03209644d134b939d0163375467f0b1363e0d875e"
]
],
"content": "š
Original date posted:2016-01-12\nš Original message:I'm convinced-- it is a good idea to worry about 80-bit collision attacks\nnow.\n\nThanks to all the people smarter than me who contributed to this\ndiscussion, I learned a lot about collision attacks that I didn't know\nbefore.\n\nWould this be a reasonable \"executive summary\" :\n\nIf you are agreeing to lock up funds with somebody else, and they control\nwhat public key to use, you are susceptible to collision attacks.\n\nIt is very likely an 80-bit-collision-in-ten-minutes attack will cost less\nthan $1million in 10 to twenty years (possibly sooner if there are crypto\nbreaks in that time).\n\nIf you don't trust the person with whom you're locking up funds and you're\nlocking up a significant amount of money (tens of millions of dollars\ntoday, tens of thousands of dollars in a few years):\n\nThen you should avoid using pay-to-script-hash addresses and instead use\nthe payment protocol and \"raw\" multisig outputs.\n\nAND/OR\n\nHave them give you a hierarchical deterministic (BIP32) seed, and derive a\npublic key for them to use.\n\n\n----------\n\nFollowing the security in depth and validate all input secure coding\nprinciples would mean doing both-- avoid p2sh AND have all parties to a\ntransaction exchange HD seeds, add randomness, and use the resulting public\nkeys in the transaction.\n\n\n-- \n--\nGavin Andresen\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160112/866bc47e/attachment.html\u003e",
"sig": "4969c903fe80a18b9ce6e87a185999bdd6214cc69ed37dbaaaa3faf34150e72c7a5686c0eced89d045702bb8849f399abbfb0f275ef8ecbe258bba233ac76061"
}