Date: Sat, 25 Feb 2017 14:12:01 -0500
From: Peter Todd <pete@petertodd.org>
To: Ethan Heilman <eth3rs@gmail.com>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <20170225191201.GA15472@savin.petertodd.org>
References: <mailman.22137.1487974823.31141.bitcoin-dev@lists.linuxfoundation.org>
	<8F096BE1-D305-43D4-AF10-2CC48837B14F@gmail.com>
	<20170225010122.GA10233@savin.petertodd.org>
	<208F93FE-B7C8-46BE-8E00-52DBD0F43415@gmail.com>
	<CAN6UTayzQRowtWhLKr8LyFuXjw3m+GjQGtHfkDj-Xu41Hym32w@mail.gmail.com>
	<CAEM=y+WkgSkc07ZsU6APAkcu37zVZ7dwSc=jAg1nho31S5ZyxQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="huq684BweRXVnRxX"
Content-Disposition: inline
In-Reply-To: <CAEM=y+WkgSkc07ZsU6APAkcu37zVZ7dwSc=jAg1nho31S5ZyxQ@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: Steve Davis <steven.charles.davis@gmail.com>
Subject: Re: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by
 third-parties, not just repo maintainers
Precedence: list


--huq684BweRXVnRxX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Feb 25, 2017 at 11:10:02AM -0500, Ethan Heilman via bitcoin-dev wro=
te:
> >SHA1 is insecure because the SHA1 algorithm is insecure, not because
> 160bits isn't enough.
>=20
> I would argue that 160-bits isn't enough for collision resistance. Assumi=
ng
> RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random oracle), collisio=
ns

That's something that we're well aware of; there have been a few discussion=
s on
this list about how P2SH's 160-bits is insufficient in certain use-cases su=
ch
as multisig.

However, remember that a 160-bit *security level* is sufficient, and RIPEMD=
160
has 160-bit security against preimage attacks. Thus things like
pay-to-pubkey-hash are perfectly secure: sure you could generate two pubkeys
that have the same RIPEMD160(SHA256()) digest, but if someone does that it
doesn't cause the Bitcoin network itself any harm, and doing so is something
you choose to do to yourself.

In any case, segwit will provide a 256-bit pay-to-witness-script-hash(1), w=
hich
provides a 128-bit security level against collision attacks.

1) https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#Native_P2=
WSH

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--huq684BweRXVnRxX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJYsdb9AAoJECSBQD2l8JH7718H/js71HapsFmrnOQ1dJuulnds
AckgBgUr1tH3duZgOYCbEJ77rcngo1GjsEPaE6xMSQOGqrO0mDqbK7URWA6BzWVr
bD1KdxZaw7fM0rO5Gx8qXhjvDRIm1Xn2eJAvPoiYDUluuQ+TdICI8eOfiGhS/Je+
m1EMp0Tfjpvu9x7J8mM3U4vr48IVdalIbiI9Gi3JWzkS2u98wz/FpYyTI53lFLe/
krw6TJ7WvFqbmRhiBDvaxFOEmCc8F+/9nqaiHDCTGrUDignzi1N6JEIpI2qPm6cu
okmauAOsCAjkqpboz7Rse04mOFgc80BVHiiStS7bNviaWPAsp4ZEPIiSNZHTE2Q=
=ATaN
-----END PGP SIGNATURE-----

--huq684BweRXVnRxX--