📅 Original date posted:2017-02-25
📝 Original message:On Sat, Feb 25, 2017 at 11:12 AM, Peter Todd via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
> On Sat, Feb 25, 2017 at 11:10:02AM -0500, Ethan Heilman via bitcoin-dev wrote:
>> >SHA1 is insecure because the SHA1 algorithm is insecure, not because
>> 160bits isn't enough.
>>
>> I would argue that 160-bits isn't enough for collision resistance. Assuming
>> RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random oracle), collisions
>
> That's something that we're well aware of; there have been a few discussions on
> this list about how P2SH's 160-bits is insufficient in certain use-cases such
> as multisig.
>
> However, remember that a 160-bit *security level* is sufficient, and RIPEMD160
> has 160-bit security against preimage attacks. Thus things like
> pay-to-pubkey-hash are perfectly secure: sure you could generate two pubkeys
> that have the same RIPEMD160(SHA256()) digest, but if someone does that it
> doesn't cause the Bitcoin network itself any harm, and doing so is something
> you choose to do to yourself.
P2SH is not secure against collision. I could write two scripts with
the same hash, one of which is an escrow script and the other which
pays it to me, have someone pay to the escrow script, and then get the
payment. Some formal analysis tools would ignore the unused
instructions even if human analysis would not.
>
> In any case, segwit will provide a 256-bit pay-to-witness-script-hash(1), which
> provides a 128-bit security level against collision attacks.
>
> 1) https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#Native_P2WSH
>
> --
> https://petertodd.org 'peter'[:-1]@petertodd.org
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
--
"Man is born free, but everywhere he is in chains".
--Rousseau.
Watson Ladd [ARCHIVE] /
npub108…sr4hp
2023-06-07 17:56:43
in reply to nevent1q…jqjf
Author Public Key
npub108dfgewsuqzm6cvllzmxsv0xnn69rrjnyg5pa32a727k89ndh3xqmsr4hpSeen on
wss://relay.nostr.bandPublished at
2023-06-07 17:56:43Event JSON
{
"id": "b53d8c1a6b1667f15ce008628db305f0e8ec4010197ea62ab07f01a39fea4c48",
"pubkey": "79da9465d0e005bd619ff8b66831e69cf4518e5322281ec55df2bd63966dbc4c",
"created_at": 1686160603,
"kind": 1,
"tags": [
[
"e",
"37053a195373ca87d2cc167b4470872a0425d55bfe62c38a20deac2033060b94",
"",
"root"
],
[
"e",
"34b739f566510425d7f6fa5e727cccf37768e8ef321d31f1e3d349f9a5bd9f54",
"",
"reply"
],
[
"p",
"daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa"
]
],
"content": "📅 Original date posted:2017-02-25\n📝 Original message:On Sat, Feb 25, 2017 at 11:12 AM, Peter Todd via bitcoin-dev\n\u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e On Sat, Feb 25, 2017 at 11:10:02AM -0500, Ethan Heilman via bitcoin-dev wrote:\n\u003e\u003e \u003eSHA1 is insecure because the SHA1 algorithm is insecure, not because\n\u003e\u003e 160bits isn't enough.\n\u003e\u003e\n\u003e\u003e I would argue that 160-bits isn't enough for collision resistance. Assuming\n\u003e\u003e RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random oracle), collisions\n\u003e\n\u003e That's something that we're well aware of; there have been a few discussions on\n\u003e this list about how P2SH's 160-bits is insufficient in certain use-cases such\n\u003e as multisig.\n\u003e\n\u003e However, remember that a 160-bit *security level* is sufficient, and RIPEMD160\n\u003e has 160-bit security against preimage attacks. Thus things like\n\u003e pay-to-pubkey-hash are perfectly secure: sure you could generate two pubkeys\n\u003e that have the same RIPEMD160(SHA256()) digest, but if someone does that it\n\u003e doesn't cause the Bitcoin network itself any harm, and doing so is something\n\u003e you choose to do to yourself.\n\nP2SH is not secure against collision. I could write two scripts with\nthe same hash, one of which is an escrow script and the other which\npays it to me, have someone pay to the escrow script, and then get the\npayment. Some formal analysis tools would ignore the unused\ninstructions even if human analysis would not.\n\n\u003e\n\u003e In any case, segwit will provide a 256-bit pay-to-witness-script-hash(1), which\n\u003e provides a 128-bit security level against collision attacks.\n\u003e\n\u003e 1) https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#Native_P2WSH\n\u003e\n\u003e --\n\u003e https://petertodd.org 'peter'[:-1]@petertodd.org\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\n\n\n-- \n\"Man is born free, but everywhere he is in chains\".\n--Rousseau.",
"sig": "0740ddaacb5da2cd61cc16fa3ace389b2e4e98c285a2742c2e07cb2353fcb285a55d374323a4ba33a6c1090e4032716ce4491c94803f1100dcd29b2f5dc5052c"
}