MIME-Version: 1.0
In-Reply-To: <208F93FE-B7C8-46BE-8E00-52DBD0F43415@gmail.com>
References: <mailman.22137.1487974823.31141.bitcoin-dev@lists.linuxfoundation.org>
	<8F096BE1-D305-43D4-AF10-2CC48837B14F@gmail.com>
	<20170225010122.GA10233@savin.petertodd.org>
	<208F93FE-B7C8-46BE-8E00-52DBD0F43415@gmail.com>
From: Leandro Coutinho <lescoutinhovr@gmail.com>
Date: Sat, 25 Feb 2017 11:50:30 -0300
Message-ID: <CAN6UTayzQRowtWhLKr8LyFuXjw3m+GjQGtHfkDj-Xu41Hym32w@mail.gmail.com>
To: Steve Davis <steven.charles.davis@gmail.com>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=001a11443f82c385e105495bf732
Subject: Re: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by
 third-parties, not just repo maintainers
Precedence: list

--001a11443f82c385e105495bf732
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Google recommeds "migrate to safer cryptographic hashes such as SHA-256 and
SHA-3"
It does not mention RIPEMD-160

https://security.googleblog.com/2017/02/announcing-first-sha1-collision.htm=
l?m=3D1


Em 25/02/2017 10:47, "Steve Davis via bitcoin-dev" <
bitcoin-dev@lists.linuxfoundation.org> escreveu:


> On Feb 24, 2017, at 7:01 PM, Peter Todd <pete@petertodd.org> wrote:
>
> On Fri, Feb 24, 2017 at 05:49:36PM -0600, Steve Davis via bitcoin-dev
wrote:
>> If the 20 byte SHA1 is now considered insecure (with good reason), what
about RIPEMD-160 which is the foundation of Bitcoin addresses?
>
> SHA1 is insecure because the SHA1 algorithm is insecure, not because
160bits isn't enough.
>
> AFAIK there aren't any known weaknesses in RIPEMD160,

=E2=80=A6so far. I wonder how long that vacation will last?

> but it also hasn't been
> as closely studied as more common hash algorithms.

...but we can be sure that it will be, since the dollar value held in
existing utxos continues to increase...

> That said, Bitcoin uses
> RIPEMD160(SHA256(msg)), which may make creating collisions harder if an
attack
> is found than if it used RIPEMD160 alone.

Does that offer any greater protection? That=E2=80=99s not so clear to me a=
s the
outputs (at least for p2pkh) only verify the public key against the final
20 byte hash. Specifically, in the first (notional) case the challenge
would be to find a private key that has a public key that hashes to the
final hash. In the second (realistic) case, you merely need to add the
sha256 hash into the problem, which doesn=E2=80=99t seem to me to increase =
the
difficulty by any significant amount?


/s
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

--001a11443f82c385e105495bf732
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div>Google recommeds &quot;migrate to safer cryptographi=
c hashes such as SHA-256 and SHA-3&quot;<div dir=3D"auto">It does not menti=
on=C2=A0<span style=3D"font-family:sans-serif">RIPEMD-160</span></div><div =
dir=3D"auto"><span style=3D"font-family:sans-serif"><br></span></div><div d=
ir=3D"auto"><font face=3D"sans-serif"><a href=3D"https://security.googleblo=
g.com/2017/02/announcing-first-sha1-collision.html?m=3D1">https://security.=
googleblog.com/2017/02/announcing-first-sha1-collision.html?m=3D1</a></font=
></div><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">Em 25/=
02/2017 10:47, &quot;Steve Davis via bitcoin-dev&quot; &lt;<a href=3D"mailt=
o:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.=
org</a>&gt; escreveu:<br type=3D"attribution"><blockquote class=3D"quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div=
 class=3D"quoted-text"><br>
&gt; On Feb 24, 2017, at 7:01 PM, Peter Todd &lt;<a href=3D"mailto:pete@pet=
ertodd.org">pete@petertodd.org</a>&gt; wrote:<br>
&gt;<br>
&gt; On Fri, Feb 24, 2017 at 05:49:36PM -0600, Steve Davis via bitcoin-dev =
wrote:<br>
&gt;&gt; If the 20 byte SHA1 is now considered insecure (with good reason),=
 what about RIPEMD-160 which is the foundation of Bitcoin addresses?<br>
&gt;<br>
&gt; SHA1 is insecure because the SHA1 algorithm is insecure, not because 1=
60bits isn&#39;t enough.<br>
&gt;<br>
&gt; AFAIK there aren&#39;t any known weaknesses in RIPEMD160,<br>
<br>
</div>=E2=80=A6so far. I wonder how long that vacation will last?<br>
<div class=3D"quoted-text"><br>
&gt; but it also hasn&#39;t been<br>
&gt; as closely studied as more common hash algorithms.<br>
<br>
</div>...but we can be sure that it will be, since the dollar value held in=
 existing utxos continues to increase...<br>
<div class=3D"quoted-text"><br>
&gt; That said, Bitcoin uses<br>
&gt; RIPEMD160(SHA256(msg)), which may make creating collisions harder if a=
n attack<br>
&gt; is found than if it used RIPEMD160 alone.<br>
<br>
</div>Does that offer any greater protection? That=E2=80=99s not so clear t=
o me as the outputs (at least for p2pkh) only verify the public key against=
 the final 20 byte hash. Specifically, in the first (notional) case the cha=
llenge would be to find a private key that has a public key that hashes to =
the final hash. In the second (realistic) case, you merely need to add the =
sha256 hash into the problem, which doesn=E2=80=99t seem to me to increase =
the difficulty by any significant amount?<br>
<br>
<br>
/s<br>
<div class=3D"elided-text">______________________________<wbr>_____________=
____<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.=
<wbr>linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.<wbr>org=
/mailman/listinfo/bitcoin-<wbr>dev</a><br>
</div></blockquote></div><br></div></div></div>

--001a11443f82c385e105495bf732--