MIME-Version: 1.0
In-Reply-To: <CAPg+sBhH0MODjjp8Avx+Fy_UGqzMjUq_jn3vT3oH=u3711tsSA@mail.gmail.com>
References: <CABsx9T3aTme2EQATamGGzeqNqJkUcPGa=0LVidJSRYNznM-myQ@mail.gmail.com>
	<CAPg+sBhH0MODjjp8Avx+Fy_UGqzMjUq_jn3vT3oH=u3711tsSA@mail.gmail.com>
Date: Thu, 7 Jan 2016 20:00:42 -0500
Message-ID: <CABsx9T1cPYorAo=u5YjA1tOoN5GNQpb_hT-ZTG9G9Hp88GgAMA@mail.gmail.com>
From: Gavin Andresen <gavinandresen@gmail.com>
To: Pieter Wuille <pieter.wuille@gmail.com>
Content-Type: multipart/alternative; boundary=001a113fb2e8daec5c0528c81d45
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Time to worry about 80-bit collision attacks or
	not?
Precedence: list

--001a113fb2e8daec5c0528c81d45
Content-Type: text/plain; charset=UTF-8

On Thu, Jan 7, 2016 at 6:52 PM, Pieter Wuille <pieter.wuille@gmail.com>
wrote:

> Bitcoin does have parts that rely on economic arguments for security or
> privacy, but can we please stick to using cryptography that is up to par
> for parts where we can? It's a small constant factor of data, and it
> categorically removes the worry about security levels.
>
Our message may have crossed in the mod queue:

"So can we quantify the incremental increase in security of SHA256(SHA256)
over RIPEMD160(SHA256) versus the incremental increase in security of
having a simpler implementation of segwitness?"

I believe the history of computer security is that implementation errors
and sidechannel attacks are much, much more common than brute-force breaks.
KEEP IT SIMPLE.

(and a quibble:  "do a 80-bit search for B and C such that H(A and B) = H(B
and C)"  isn't enough, you have to end up with a C public key for which you
know the corresponding private key or the attacker just succeeds in burning
the funds)


-- 
--
Gavin Andresen

--001a113fb2e8daec5c0528c81d45
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On T=
hu, Jan 7, 2016 at 6:52 PM, Pieter Wuille <span dir=3D"ltr">&lt;<a href=3D"=
mailto:pieter.wuille@gmail.com" target=3D"_blank">pieter.wuille@gmail.com</=
a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0=
px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);b=
order-left-style:solid;padding-left:1ex"><p dir=3D"ltr">Bitcoin does have p=
arts that rely on economic arguments for security or privacy, but can we pl=
ease stick to using cryptography that is up to par for parts where we can? =
It&#39;s a small constant factor of data, and it categorically removes the =
worry about security levels.</p></blockquote></div>Our message may have cro=
ssed in the mod queue:</div><div class=3D"gmail_extra"><br></div><div class=
=3D"gmail_extra">&quot;<span style=3D"font-size:12.8px">So can we quantify =
the incremental increase in security of SHA256(SHA256) over RIPEMD160(SHA25=
6) versus the incremental increase in security of having a simpler implemen=
tation of segwitness?&quot;</span></div><div class=3D"gmail_extra"><br>I be=
lieve the history of computer security is that implementation errors and si=
dechannel attacks are much, much more common than brute-force breaks. KEEP =
IT SIMPLE.</div><div class=3D"gmail_extra"><br></div><div class=3D"gmail_ex=
tra">(and a quibble: =C2=A0&quot;<span style=3D"font-size:12.8px">do a 80-b=
it search for B and C such that H(A and B) =3D H(B and C)&quot; =C2=A0isn&#=
39;t enough, you have to end up with a C public key for which you know the =
corresponding private key or the attacker just succeeds in burning the fund=
s)</span></div><div class=3D"gmail_extra"><br clear=3D"all"><div><br></div>=
-- <br><div class=3D"gmail_signature">--<br>Gavin Andresen<br></div>
</div></div>

--001a113fb2e8daec5c0528c81d45--