📅 Original date posted:2017-02-25
📝 Original message:>You have to not only produce a ripemd160 collision, you have to produce a
collision that is also a valid sha-256 hash - and that's much much much
more difficult.
I agree that merely finding a collision in RIPEMD-160 will be hard to use
in Bitcoin.
However finding a collision in RIPEMD-160(SHA-256(msg)) via bruteforce
(2^80 queries) is not particular more difficult than finding a collision in
RIPEMD-160 via brute force. Furthermore if you find a collision in
RIPEMD-160(SHA-256(msg)) you also get a valid SHA-256 hash for which you
know the preimage.
On Sat, Feb 25, 2017 at 1:19 PM, Alice Wonder via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> On 02/25/2017 08:10 AM, Ethan Heilman via bitcoin-dev wrote:
>
>> SHA1 is insecure because the SHA1 algorithm is insecure, not because
>>>
>> 160bits isn't enough.
>>
>> I would argue that 160-bits isn't enough for collision resistance.
>> Assuming RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random
>> oracle), collisions can be generated in 2^80 queries (actually detecting
>> these collisions requires some time-memory additional trade-offs). The
>> Bitcoin network at the current hash rate performs roughly SHA-256 ~2^78
>> queries a day or 2^80 queries every four days.
>>
>
> You have to not only produce a ripemd160 collision, you have to produce a
> collision that is also a valid sha-256 hash - and that's much much much
> more difficult.
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170225/11c54e30/attachment.html>;
Ethan Heilman [ARCHIVE] /
npub1ga…gac47
2023-06-07 17:56:43
in reply to nevent1q…5jmc
Author Public Key
npub1gaszwl7qd0tjmnwcaamgzzgsmzzjlvle6kz0td66pwa8z69vsxsqxgac47Published at
2023-06-07 17:56:43Event JSON
{
"id": "678a4371406d722bc08352825304bff2abcfec6b0e19425b632201c1448442b4",
"pubkey": "4760277fc06bd72dcdd8ef76810910d8852fb3f9d584f5b75a0bba7168ac81a0",
"created_at": 1686160603,
"kind": 1,
"tags": [
[
"e",
"37053a195373ca87d2cc167b4470872a0425d55bfe62c38a20deac2033060b94",
"",
"root"
],
[
"e",
"f25762d0b2bbd973d3dadd79454026ec6e558c99a885f59870576c2622c744af",
"",
"reply"
],
[
"p",
"d5fbfd09850cad30b99b533bce83c2e5ec1976ed8891dbbf947bb037367a1799"
]
],
"content": "📅 Original date posted:2017-02-25\n📝 Original message:\u003eYou have to not only produce a ripemd160 collision, you have to produce a\ncollision that is also a valid sha-256 hash - and that's much much much\nmore difficult.\n\nI agree that merely finding a collision in RIPEMD-160 will be hard to use\nin Bitcoin.\n\nHowever finding a collision in RIPEMD-160(SHA-256(msg)) via bruteforce\n(2^80 queries) is not particular more difficult than finding a collision in\nRIPEMD-160 via brute force. Furthermore if you find a collision in\nRIPEMD-160(SHA-256(msg)) you also get a valid SHA-256 hash for which you\nknow the preimage.\n\n\nOn Sat, Feb 25, 2017 at 1:19 PM, Alice Wonder via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e On 02/25/2017 08:10 AM, Ethan Heilman via bitcoin-dev wrote:\n\u003e\n\u003e\u003e SHA1 is insecure because the SHA1 algorithm is insecure, not because\n\u003e\u003e\u003e\n\u003e\u003e 160bits isn't enough.\n\u003e\u003e\n\u003e\u003e I would argue that 160-bits isn't enough for collision resistance.\n\u003e\u003e Assuming RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random\n\u003e\u003e oracle), collisions can be generated in 2^80 queries (actually detecting\n\u003e\u003e these collisions requires some time-memory additional trade-offs). The\n\u003e\u003e Bitcoin network at the current hash rate performs roughly SHA-256 ~2^78\n\u003e\u003e queries a day or 2^80 queries every four days.\n\u003e\u003e\n\u003e\n\u003e You have to not only produce a ripemd160 collision, you have to produce a\n\u003e collision that is also a valid sha-256 hash - and that's much much much\n\u003e more difficult.\n\u003e\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20170225/11c54e30/attachment.html\u003e",
"sig": "8fe7b5d022e61ca9cf77c25076afd024b6ed4b38e940e3f5fa43dd9d4883c76e35292e31616c2f1e926e444af9126a81f5f45ec380b363bfee7a1bff2896e523"
}