MIME-Version: 1.0
References: <aa916637-befa-795a-caa1-e5ad50ce63c8@electrum.org>
 <CAB3F3DuGi_Uc0cf5eGvE9ej2d1RS8CVkf7xGBjR4uRf8jAmQhA@mail.gmail.com>
 <CAB3F3DtCgdWOPpTdr-cMcnRO1RE2isEAavGZSOTvtSi-0_x64w@mail.gmail.com>
 <Ptq11JJF3B5h2X94dQdis8lFf7PSm_Hg9F2uITk4MhGcXULr3eiuF3GF71fEVZpcsNZ_s_nrRCXcUmxthQQq4vPQERQpUbCNYErVA9yuNNc=@protonmail.com>
In-Reply-To: <Ptq11JJF3B5h2X94dQdis8lFf7PSm_Hg9F2uITk4MhGcXULr3eiuF3GF71fEVZpcsNZ_s_nrRCXcUmxthQQq4vPQERQpUbCNYErVA9yuNNc=@protonmail.com>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Wed, 27 May 2020 11:15:47 -0400
Message-ID: <CAMZUoKkA+=-r-OkDWP_GpN2xCsPpTfJnetzSmXtEzD8ZjH8OxA@mail.gmail.com>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000070093105a6a2b0fa"
Cc: Greg Sanders <gsanders87@gmail.com>
Subject: Re: [bitcoin-dev] MIN_STANDARD_TX_NONWITNESS_SIZE and OP_RETURN
Precedence: list

--00000000000070093105a6a2b0fa
Content-Type: text/plain; charset="UTF-8"

I don't believe that 60 bytes is a problem here.  SHA256 padding includes a
length value of the original message data. Thus a padded non-64 byte
transaction can never be the same as any padded 64-byte value, and
therefore after applying the SHA256 compression function the resulting
hashes cannot be identical (unless SHA256 itself is broken).

P.S. SHA256 also includes 10* padding, which also suffices to ensure
messages of different lengths have different padding.

On Sat, May 23, 2020 at 8:52 PM ZmnSCPxj via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Good morning Thomas,
>
> > So I think the question to ask would be "why can't we just make sure
> it's not 64?"
>
> If we accept a 60-byte tx, then SHA-256 will pad it to 64 bytes, and it
> may still be possible to mount CVE-2017-12842 attack with 32-bits of work.
> Of course some other details will be changed from the standard SHA-256 in
> mounting this attack, but from my poor understanding it seems safer to just
> avoid the area around length 64.
>
> It *might* be safe to accept 65-byte or larger (but do not believe me, I
> only play a cryptographer on the Internet), but that does not help your
> specific application, which uses 60 byte tx.
>
> Regards,
> ZmnSCPxj
>
> >
> > On Sat, May 23, 2020 at 11:24 AM Greg Sanders <gsanders87@gmail.com>
> wrote:
> >
> > > AFAIU the number was picked to protect against CVE-2017-12842
> covertly. See: https://github.com/bitcoin/bitcoin/pull/16885 which
> updated the text to explicitly mention this fact.
> > >
> > > On Sat, May 23, 2020 at 11:20 AM Thomas Voegtlin via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
> > >
> > > > Hello list,
> > > >
> > > > I have been trying to CPFP a transaction using OP_RETURN, because the
> > > > remaining output value would have been lower than the dust threshold.
> > > >
> > > > The scriptPubkey of the output was OP_RETURN + OP_0, and there was a
> > > > single p2wsh input.
> > > >
> > > > The result is a 60 bytes transaction (without witness), that gets
> > > > rejected because it is lower than MIN_STANDARD_TX_NONWITNESS_SIZE,
> which
> > > > is equal to 82 bytes.
> > > >
> > > > Why is that value so high? Would it make sense to lower it to 60?
> > > >
> > > > Thomas
> > > > _______________________________________________
> > > > bitcoin-dev mailing list
> > > > bitcoin-dev@lists.linuxfoundation.org
> > > > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--00000000000070093105a6a2b0fa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div>I don&#39;t believe t=
hat 60 bytes is a problem here.=C2=A0=20
SHA256 padding includes a length value of the original message data. Thus a=
 padded non-64 byte transaction can never be the same as any padded 64-byte=
 value, and therefore after applying the SHA256 compression function the re=
sulting hashes cannot be identical (unless SHA256 itself is broken).</div><=
div><br></div><div>P.S. SHA256 also includes 10* padding, which also suffic=
es to ensure messages of different lengths have different padding.<br></div=
></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"=
>On Sat, May 23, 2020 at 8:52 PM ZmnSCPxj via bitcoin-dev &lt;<a href=3D"ma=
ilto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundati=
on.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex">Good morning Thomas,<br>
<br>
&gt; So I think the question to ask would be &quot;why can&#39;t we just ma=
ke sure it&#39;s not 64?&quot;<br>
<br>
If we accept a 60-byte tx, then SHA-256 will pad it to 64 bytes, and it may=
 still be possible to mount CVE-2017-12842 attack with 32-bits of work.<br>
Of course some other details will be changed from the standard SHA-256 in m=
ounting this attack, but from my poor understanding it seems safer to just =
avoid the area around length 64.<br>
<br>
It *might* be safe to accept 65-byte or larger (but do not believe me, I on=
ly play a cryptographer on the Internet), but that does not help your speci=
fic application, which uses 60 byte tx.<br>
<br>
Regards,<br>
ZmnSCPxj<br>
<br>
&gt;<br>
&gt; On Sat, May 23, 2020 at 11:24 AM Greg Sanders &lt;<a href=3D"mailto:gs=
anders87@gmail.com" target=3D"_blank">gsanders87@gmail.com</a>&gt; wrote:<b=
r>
&gt;<br>
&gt; &gt; AFAIU the number was picked to protect against=C2=A0CVE-2017-1284=
2 covertly. See:=C2=A0<a href=3D"https://github.com/bitcoin/bitcoin/pull/16=
885" rel=3D"noreferrer" target=3D"_blank">https://github.com/bitcoin/bitcoi=
n/pull/16885</a>=C2=A0which updated the text to explicitly mention this fac=
t.<br>
&gt; &gt;<br>
&gt; &gt; On Sat, May 23, 2020 at 11:20 AM Thomas Voegtlin via bitcoin-dev =
&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_bla=
nk">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br>
&gt; &gt;<br>
&gt; &gt; &gt; Hello list,<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; I have been trying to CPFP a transaction using OP_RETURN, be=
cause the<br>
&gt; &gt; &gt; remaining output value would have been lower than the dust t=
hreshold.<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; The scriptPubkey of the output was OP_RETURN + OP_0, and the=
re was a<br>
&gt; &gt; &gt; single p2wsh input.<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; The result is a 60 bytes transaction (without witness), that=
 gets<br>
&gt; &gt; &gt; rejected because it is lower than MIN_STANDARD_TX_NONWITNESS=
_SIZE, which<br>
&gt; &gt; &gt; is equal to 82 bytes.<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; Why is that value so high? Would it make sense to lower it t=
o 60?<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; Thomas<br>
&gt; &gt; &gt; _______________________________________________<br>
&gt; &gt; &gt; bitcoin-dev mailing list<br>
&gt; &gt; &gt; <a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" tar=
get=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a><br>
&gt; &gt; &gt; <a href=3D"https://lists.linuxfoundation.org/mailman/listinf=
o/bitcoin-dev" rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoun=
dation.org/mailman/listinfo/bitcoin-dev</a><br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div></div>

--00000000000070093105a6a2b0fa--