Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.56 as permitted sender)
	client-ip=62.13.149.56; envelope-from=pete@petertodd.org;
	helo=outmail149056.authsmtp.com; 
Date: Tue, 4 Feb 2014 11:04:14 -0500
From: Peter Todd <pete@petertodd.org>
To: Natanael <natanael.l@gmail.com>
Message-ID: <20140204160414.GA23803@savin>
References: <1D8E0828-D07F-46EF-9F9F-5CA83AA9DB59@plan99.net>
	<20140204130312.GA23538@savin>
	<CANEZrP2NyvRKwSEZORjAOq6G7UqLv=F3FjxmGNTPMT10yWGxzw@mail.gmail.com>
	<20140204131723.GA10309@savin>
	<CAAt2M1-LZ1APX9F93WE7Z877-WxqvJFbGaUmu5eriRGwvAOESw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="BXVAT5kNtrzKuDFl"
Content-Disposition: inline
In-Reply-To: <CAAt2M1-LZ1APX9F93WE7Z877-WxqvJFbGaUmu5eriRGwvAOESw@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] bitcoinj 0.11 released, with p2sh,
 bip39 and payment protocol support
Precedence: list


--BXVAT5kNtrzKuDFl
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 04, 2014 at 04:17:47PM +0100, Natanael wrote:
> Because it's trivial to create collisions! You can choose exactly what
> output you want. That's why XOR is a very bad digest scheme.

You're close, but not quite.

So, imagine you have a merkle tree, and you're trying to timestamp some
data at the bottom of the tree. Now you can successfully timestamp the
top digest in the Bitcoin blockchain right, and be sure that digest
existed before some time. But what about the digests at the bottom of
the tree? What can an attacker do exactly to make a fake timestamp if
the tree is using XOR rather than a proper hash function?

--=20
'peter'[:-1]@petertodd.org
000000000000000075829f6169c79d7d5aaa20bfa8da6e9edb2393c4f8662ba0

--BXVAT5kNtrzKuDFl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQGrBAEBCACVBQJS8Q99XhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDA3NTgyOWY2MTY5Yzc5ZDdkNWFhYTIwYmZhOGRhNmU5ZWRi
MjM5M2M0Zjg2NjJiYTAvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkft3SQf9Gd1WpzYVwjFAP/W846WvvsE2
U11R67s2oRjAQYwJ9pV8bsSsVmME0Ckg6GNSmlMjpPmTR3rynL+CBo0Ov0HRsuoY
UuqQsU82V0JrrLcSTckvd5pxA0RhAJa+cBkLMnGXwyWoJUX12IfSX/Wa/3sb1k1h
fo5SgQHv/Vf2ICRAaOMAgU8a84YVk/qnR3/OYM1Lh5PAdfVIjGL97g7g5h8wT+mp
dqMxVuDVuDiD53bTrqFHdZ6y+euorD/ojdOsmZQSypCWTjK8f9v/BH8IRDttOA7X
N8CweRJmDAmEkG2xv8KxW0UBzdCscWWaSdxFX4CX8hALq3bJgLqxixyeAwzLpg==
=uQBg
-----END PGP SIGNATURE-----

--BXVAT5kNtrzKuDFl--