📅 Original date posted:2016-01-12
📝 Original message:Folks:
I don't fully understand this thread, but it sounds like to me it
might be omitting consideration of multi-target attacks. For example,
Tier Nolan's attack
(http://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012230.html),
which seems to be the best attack on this thread, seems to start with
one specific public key of an intended victim, but if the attacker is
happy to find a collision with *any* one out of a large number of
potential victims, he gets an advantage proportional to the number of
potential victims.
So it would be wise, in addition to the kind of analysis already done
on this thread (which appears to have already settled at "Yes, we need
> 80-bit security."), to make a nice optimistic estimate of how many
public keys we could eventually have in use. 2⁴⁰? 2⁵⁰? Or maybe be
*very* optimistic, with some added IoT [*] goodness, and budget for
2⁶⁰?
Then we need to budget that many more bits of security to keep the
future attacker's chances of success low enough that the attacker will
never succeed. (Assuming that's our requirement.)
You might enjoy this recent blog post by DJB, legendary cryptographer
who works in this niche of cryptography as well as several other
niches:
http://blog.cr.yp.to/20151120-batchattacks.html
It has some interesting philosophical musings about the "Attacker
Economist" approach. (N.B. My respect for DJB's accomplishments is
tremendous, but that doesn't mean I automatically agree with
everything he says. I haven't made up my mind what I think about this
particular philosophical argument.)
Sincerely,
Zooko
[*] The Internet of Targets
Zooko Wilcox-O'Hearn [ARCHIVE] /
npub198…949yg
2023-06-07 17:47:48
in reply to nevent1q…nstx
Author Public Key
npub198hn0klxaeu622g84p832yd4hglek0h3p9cy8aklkcxv56cr5kwql949ygPublished at
2023-06-07 17:47:48Event JSON
{
"id": "002639ca68a28f780872beedb033fcdfe4b642722b4116435cc01fef8853b44e",
"pubkey": "29ef37dbe6ee79a52907a84f1511b5ba3f9b3ef1097043f6dfb60cca6b03a59c",
"created_at": 1686160068,
"kind": 1,
"tags": [
[
"e",
"e1f46f49861d474f81d81bf43d690af02c9b35e1c9c4fe5cc415112a34c1c041",
"",
"root"
],
[
"e",
"86bf81b0df9a39e8fd4db1a3380be8be6b4c90ee7be8d45f25a87d44831b2e42",
"",
"reply"
],
[
"p",
"857f2f78dc1639e711f5ea703a9fc978e22ebd279abdea1861b7daa833512ee4"
]
],
"content": "📅 Original date posted:2016-01-12\n📝 Original message:Folks:\n\nI don't fully understand this thread, but it sounds like to me it\nmight be omitting consideration of multi-target attacks. For example,\nTier Nolan's attack\n(http://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012230.html),\nwhich seems to be the best attack on this thread, seems to start with\none specific public key of an intended victim, but if the attacker is\nhappy to find a collision with *any* one out of a large number of\npotential victims, he gets an advantage proportional to the number of\npotential victims.\n\nSo it would be wise, in addition to the kind of analysis already done\non this thread (which appears to have already settled at \"Yes, we need\n\u003e 80-bit security.\"), to make a nice optimistic estimate of how many\npublic keys we could eventually have in use. 2⁴⁰? 2⁵⁰? Or maybe be\n*very* optimistic, with some added IoT [*] goodness, and budget for\n2⁶⁰?\n\nThen we need to budget that many more bits of security to keep the\nfuture attacker's chances of success low enough that the attacker will\nnever succeed. (Assuming that's our requirement.)\n\nYou might enjoy this recent blog post by DJB, legendary cryptographer\nwho works in this niche of cryptography as well as several other\nniches:\n\nhttp://blog.cr.yp.to/20151120-batchattacks.html\n\nIt has some interesting philosophical musings about the \"Attacker\nEconomist\" approach. (N.B. My respect for DJB's accomplishments is\ntremendous, but that doesn't mean I automatically agree with\neverything he says. I haven't made up my mind what I think about this\nparticular philosophical argument.)\n\nSincerely,\n\nZooko\n\n[*] The Internet of Targets",
"sig": "ed883ed212b0579820cd982d8c3719bd42d74b65cd9066145c58ea5e2e21a2a4324961e8786ecb45270eabd9dc75881dc531c34dff25e3d996a86446b7bb4164"
}