📅 Original date posted:2017-04-06
📝 Original message:Bryan,
Interesting argument, but I think it is not an accurate comparison. People
usually mean that, for example, say 2^80 of the original operations are
needed rather than the intended 2^128 to find a collision. This could be
the case in a broken algorithms such as a toy SHA variant with too small
states and too few rounds. These kind of attacks usually refer to that
something is learned from prior evaluations that be should't be possible to
be learned. For example, if someone could somehow construct a pre-image in
256 evaluations, getting one additional bit right at a time. Similar to a
cheap combination lock where you can figure out the correct 4 digits in a
worst case of 4*10 attempts by "feeling" it, rather than having to do the
intended 10,000 attempts. That's the kind of thing that would be called an
"attack".
Here, however, we are talking about making the individual operations
cheaper by a constant of ~20%, not changing the number of operations. That
doesn't qualify as an attack in the sense that you mean.
Best,
Timo
On Thu, Apr 6, 2017 at 5:11 AM, Bryan Bishop via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> On Thu, Apr 6, 2017 at 7:02 AM, Luv Khemani via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>> Could you elaborate on why you consider ASICBOOST to be an attack? Attack
>> here implies ill-intent by the practitioner towards the network as a
>> primary motivating factor.
>>
>>
> See https://www.reddit.com/r/Bitcoin/comments/63otrp/
> gregory_maxwell_major_asic_manufacturer_is/dfwcki3/
>
> """
> I think that it is an attack is a completely unambiguous technical
> description of what it is. If a signature is supposed to resist forgery
> against 2^128 operations, but you find a way to do it with 2^80 instead,
> this is an attack. It is, perhaps, not a very concerning attack and you may
> or may not change your signature scheme to avoid it or may just instead say
> the scheme has 2^80 security. But there is no doubt that it would be called
> an attack, especially if it was not described in the original proposal.
>
> In Bitcoin's Proof of Work, you are attempting to prove a certain amount
> of work has been done. This shortcut significantly reduces the amount of
> work. It's an attack. Normally it wouldn't be a serious attack-- it would
> just get appended to the defacto definition of what the Bitcoin Proof of
> work is-- similar to the signature system just getting restarted as having
> 2^80 security-- but in it's covert form it cannot just be adopted because
> it blocks many further improvements (not just segwit, but the vast majority
> of other proposals), and additional the licensing restrictions inhibit
> adoption.
>
> The proposal I posted does not prevent the technique, only the covert
> form: That is, it doesn't even attempt to solve the patented tech
> eventually will centralize the system problem. It is narrowly targeted at
> the interference with upgrades.
>
> Taking a step back-- even ignoring my geeking out about the technical
> definition of 'attack' in crypographic contexts, we have a set of issues
> here that left addressed will seriously harm the system going forward for
> the the significant monetary benefit of an exploiting party. I think that
> also satisfies a lay definition of the term: Something someone does, that
> none one expected, that makes them money at everyone elses expense.
> """
>
> - Bryan
> http://heybryan.org/
> 1 512 203 0507 <(512)%20203-0507>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170406/fe03bb52/attachment.html>;
Timo Hanke [ARCHIVE] /
npub1dd…pgp9a
2023-06-07 17:59:24
in reply to nevent1q…qx95
Author Public Key
npub1ddqaln8xsfmy6sxqplt9sz5ev99kh052sveqsh02q7hmc3a6n68shpgp9aPublished at
2023-06-07 17:59:24Event JSON
{
"id": "c1410daa62aeab36bd9c74bd1e9ff334e5afbab13c4f9934f0375ffb07da07d4",
"pubkey": "6b41dfcce682764d40c00fd6580a99614b6bbe8a8332085dea07afbc47ba9e8f",
"created_at": 1686160764,
"kind": 1,
"tags": [
[
"e",
"ad36e2a7543163ffef3218fa3d55149ec67fbe14dd109a89d2940c12712bdc10",
"",
"root"
],
[
"e",
"cd645c901b16ee25d82a847f666bca181fe93b1f96f145d7313d52869d2e525a",
"",
"reply"
],
[
"p",
"62ddcb547224b421822b62845fb1bbd77c838b924bd022814cfcbe25b7a07475"
]
],
"content": "📅 Original date posted:2017-04-06\n📝 Original message:Bryan,\n\nInteresting argument, but I think it is not an accurate comparison. People\nusually mean that, for example, say 2^80 of the original operations are\nneeded rather than the intended 2^128 to find a collision. This could be\nthe case in a broken algorithms such as a toy SHA variant with too small\nstates and too few rounds. These kind of attacks usually refer to that\nsomething is learned from prior evaluations that be should't be possible to\nbe learned. For example, if someone could somehow construct a pre-image in\n256 evaluations, getting one additional bit right at a time. Similar to a\ncheap combination lock where you can figure out the correct 4 digits in a\nworst case of 4*10 attempts by \"feeling\" it, rather than having to do the\nintended 10,000 attempts. That's the kind of thing that would be called an\n\"attack\".\n\nHere, however, we are talking about making the individual operations\ncheaper by a constant of ~20%, not changing the number of operations. That\ndoesn't qualify as an attack in the sense that you mean.\n\nBest,\nTimo\n\n\n\n\nOn Thu, Apr 6, 2017 at 5:11 AM, Bryan Bishop via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e On Thu, Apr 6, 2017 at 7:02 AM, Luv Khemani via bitcoin-dev \u003c\n\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\n\u003e\u003e Could you elaborate on why you consider ASICBOOST to be an attack? Attack\n\u003e\u003e here implies ill-intent by the practitioner towards the network as a\n\u003e\u003e primary motivating factor.\n\u003e\u003e\n\u003e\u003e\n\u003e See https://www.reddit.com/r/Bitcoin/comments/63otrp/\n\u003e gregory_maxwell_major_asic_manufacturer_is/dfwcki3/\n\u003e\n\u003e \"\"\"\n\u003e I think that it is an attack is a completely unambiguous technical\n\u003e description of what it is. If a signature is supposed to resist forgery\n\u003e against 2^128 operations, but you find a way to do it with 2^80 instead,\n\u003e this is an attack. It is, perhaps, not a very concerning attack and you may\n\u003e or may not change your signature scheme to avoid it or may just instead say\n\u003e the scheme has 2^80 security. But there is no doubt that it would be called\n\u003e an attack, especially if it was not described in the original proposal.\n\u003e\n\u003e In Bitcoin's Proof of Work, you are attempting to prove a certain amount\n\u003e of work has been done. This shortcut significantly reduces the amount of\n\u003e work. It's an attack. Normally it wouldn't be a serious attack-- it would\n\u003e just get appended to the defacto definition of what the Bitcoin Proof of\n\u003e work is-- similar to the signature system just getting restarted as having\n\u003e 2^80 security-- but in it's covert form it cannot just be adopted because\n\u003e it blocks many further improvements (not just segwit, but the vast majority\n\u003e of other proposals), and additional the licensing restrictions inhibit\n\u003e adoption.\n\u003e\n\u003e The proposal I posted does not prevent the technique, only the covert\n\u003e form: That is, it doesn't even attempt to solve the patented tech\n\u003e eventually will centralize the system problem. It is narrowly targeted at\n\u003e the interference with upgrades.\n\u003e\n\u003e Taking a step back-- even ignoring my geeking out about the technical\n\u003e definition of 'attack' in crypographic contexts, we have a set of issues\n\u003e here that left addressed will seriously harm the system going forward for\n\u003e the the significant monetary benefit of an exploiting party. I think that\n\u003e also satisfies a lay definition of the term: Something someone does, that\n\u003e none one expected, that makes them money at everyone elses expense.\n\u003e \"\"\"\n\u003e\n\u003e - Bryan\n\u003e http://heybryan.org/\n\u003e 1 512 203 0507 \u003c(512)%20203-0507\u003e\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170406/fe03bb52/attachment.html\u003e",
"sig": "46106098091dfcdc1b445ea10a48d94bd1329cd1e8b6d1af2d17daea648b334b41464dfa1aff3f070c183decdb9171335489c0cfd6261bfd5275949ecd1dfede"
}