MIME-Version: 1.0
In-Reply-To: <CAGLBAhczEceqDp6XPSVLJ0FuTcmZgYkVnUE4rspb3JdeHnZJUg@mail.gmail.com>
References: <CABsx9T3aTme2EQATamGGzeqNqJkUcPGa=0LVidJSRYNznM-myQ@mail.gmail.com>
	<CALqxMTHjvFT2aCBYDEiG-6F5qvsXK57_LR6ttpPb3xUG2i443w@mail.gmail.com>
	<CAGLBAhczEceqDp6XPSVLJ0FuTcmZgYkVnUE4rspb3JdeHnZJUg@mail.gmail.com>
Date: Thu, 7 Jan 2016 16:06:30 -0500
Message-ID: <CABsx9T0JX41bOQxjPg7QFUKGEwgFaCGFzR3ySbaqFwy4i28Hbg@mail.gmail.com>
From: Gavin Andresen <gavinandresen@gmail.com>
To: Dave Scotese <dscotese@litmocracy.com>
Content-Type: multipart/alternative; boundary=001a113fb2e847a86a0528c4d866
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Time to worry about 80-bit collision attacks or
	not?
Precedence: list

--001a113fb2e847a86a0528c4d866
Content-Type: text/plain; charset=UTF-8

Maybe I'm asking this question on the wrong mailing list:

Matt/Adam: do you have some reason to think that RIPEMD160 will be broken
before SHA256?
And do you have some reason to think that they will be so broken that the
nested hash construction RIPEMD160(SHA256()) will be vulnerable?

Adam: re: "where to stop"  :  I'm suggesting we stop exactly at the current
status quo, where we use RIPEMD160 for P2SH and P2PKH.

Ethan:  your algorithm will find two arbitrary values that collide. That
isn't useful as an attack in the context we're talking about here (both of
those values will be useless as coin destinations with overwhelming
probability).

Dave: you described a first preimage attack, which is 2**160 cpu time and
no storage.


-- 
--
Gavin Andresen

--001a113fb2e847a86a0528c4d866
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Maybe I&#39;m asking this question on the wrong maili=
ng list:</div><div><br></div><div>Matt/Adam: do you have some reason to thi=
nk that RIPEMD160 will be broken before SHA256?</div><div>And do you have s=
ome reason to think that they will be so broken that the nested hash constr=
uction RIPEMD160(SHA256()) will be vulnerable?</div><div><br></div><div>Ada=
m: re: &quot;where to stop&quot; =C2=A0: =C2=A0I&#39;m suggesting we stop e=
xactly at the current status quo, where we use RIPEMD160 for P2SH and P2PKH=
.</div><div><br></div><div>Ethan: =C2=A0your algorithm will find two arbitr=
ary values that collide. That isn&#39;t useful as an attack in the context =
we&#39;re talking about here (both of those values will be useless as coin =
destinations with overwhelming probability).</div><div><br></div><div>Dave:=
 you described a first preimage attack, which is 2**160 cpu time and no sto=
rage.</div><div class=3D"gmail_extra"><div><br></div><div><br></div>-- <br>=
<div class=3D"gmail_signature">--<br>Gavin Andresen<br></div>
</div></div>

--001a113fb2e847a86a0528c4d866--