MIME-Version: 1.0
In-Reply-To: <20160108153329.GA15731@sapphire.erisian.com.au>
References: <CABsx9T3aTme2EQATamGGzeqNqJkUcPGa=0LVidJSRYNznM-myQ@mail.gmail.com>
	<CAPg+sBhH0MODjjp8Avx+Fy_UGqzMjUq_jn3vT3oH=u3711tsSA@mail.gmail.com>
	<8760z4rbng.fsf@rustcorp.com.au>
	<C4B5B9F1-9C53-45BC-9B30-F572C78096E3@mattcorallo.com>
	<8737u8qnye.fsf@rustcorp.com.au>
	<CABsx9T1gmz=sr_sEEuy8BQU6SXdmi58O30rzRWNW=0Ej98fi4A@mail.gmail.com>
	<20160108153329.GA15731@sapphire.erisian.com.au>
Date: Fri, 8 Jan 2016 10:46:53 -0500
Message-ID: <CABsx9T3MfndREm9icE-TUF58zsRZ5YsBMvUAMy4E-MmYWxWV=A@mail.gmail.com>
From: Gavin Andresen <gavinandresen@gmail.com>
To: Anthony Towns <aj@erisian.com.au>
Content-Type: multipart/alternative; boundary=001a11c2abd60d671b0528d47fe5
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Time to worry about 80-bit collision attacks or
	not?
Precedence: list

--001a11c2abd60d671b0528d47fe5
Content-Type: text/plain; charset=UTF-8

Thanks, Anthony, that works!

So...

How many years until we think a 2^84 attack where the work is an ECDSA
private->public key derivation will take a reasonable amount of time?

And Ethan or Anthony:  can you think of a similar attack scheme if you
assume we had switched to Schnorr 2-of-2 signatures by then?


And to everybody who might not be reading this closely:  All of the above
is discussing collision attacks; none of it is relevant in the normal case
where your wallet generates the scriptPubKey.


-- 
--
Gavin Andresen

--001a11c2abd60d671b0528d47fe5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks, Anthony, that works!<div><br></div><div>So...</div=
><div><br></div><div>How many years until we think a 2^84 attack where the =
work is an ECDSA private-&gt;public key derivation will take a reasonable a=
mount of time?<br><div class=3D"gmail_extra"><br></div><div class=3D"gmail_=
extra">And Ethan or Anthony: =C2=A0can you think of a similar attack scheme=
 if you assume we had switched to Schnorr 2-of-2 signatures by then?</div><=
div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra"><br></div><d=
iv class=3D"gmail_extra">And to everybody who might not be reading this clo=
sely: =C2=A0All of the above is discussing collision attacks; none of it is=
 relevant in the normal case where your wallet generates the scriptPubKey.<=
/div><div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra"><br cl=
ear=3D"all"><div><br></div>-- <br><div class=3D"gmail_signature">--<br>Gavi=
n Andresen<br></div>
</div></div></div>

--001a11c2abd60d671b0528d47fe5--