Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 72FF9360 for ; Sat, 25 Feb 2017 21:40:25 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from outmail149081.authsmtp.net (outmail149081.authsmtp.net [62.13.149.81]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id A415617F for ; Sat, 25 Feb 2017 21:40:24 +0000 (UTC) Received: from mail-c247.authsmtp.com (mail-c247.authsmtp.com [62.13.128.247]) by punt22.authsmtp.com (8.14.2/8.14.2/) with ESMTP id v1PLeLVo052720; Sat, 25 Feb 2017 21:40:21 GMT Received: from petertodd.org (ec2-52-5-185-120.compute-1.amazonaws.com [52.5.185.120]) (authenticated bits=0) by mail.authsmtp.com (8.14.2/8.14.2/) with ESMTP id v1PLeJen084754 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 25 Feb 2017 21:40:20 GMT Received: from [127.0.0.1] (localhost [127.0.0.1]) by petertodd.org (Postfix) with ESMTPSA id F421F40092; Sat, 25 Feb 2017 21:40:18 +0000 (UTC) Received: by localhost (Postfix, from userid 1000) id 4FFD9204AB; Sat, 25 Feb 2017 16:40:18 -0500 (EST) Date: Sat, 25 Feb 2017 16:40:18 -0500 From: Peter Todd To: Steve Davis Message-ID: <20170225214018.GA16524@savin.petertodd.org> References: <8F096BE1-D305-43D4-AF10-2CC48837B14F@gmail.com> <20170225010122.GA10233@savin.petertodd.org> <208F93FE-B7C8-46BE-8E00-52DBD0F43415@gmail.com> <20170225191201.GA15472@savin.petertodd.org> <20170225210406.GA16196@savin.petertodd.org> <4FE38F6A-0560-4989-9C53-7F8C94EA4C76@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="TB36FDmn/VVEgNH/" Content-Disposition: inline In-Reply-To: <4FE38F6A-0560-4989-9C53-7F8C94EA4C76@gmail.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-Server-Quench: 01b9b5c2-fba3-11e6-bcdf-0015176ca198 X-AuthReport-Spam: If SPAM / abuse - report it at: http://www.authsmtp.com/abuse X-AuthRoute: OCd2Yg0TA1ZNQRgX IjsJECJaVQIpKltL GxAVKBZePFsRUQkR bgdMdAcUHlAWAgsB AmEbWVVeVF17W2M7 bghPaBtcak9QXgdq T0pMXVMcUgQIfUl7 U0AeWh11cgEIeX14 Y04sXnEJVRZ/JkRg FBwFFnAHZDJmdTJM BBZFdwNVdQJNeEwU a1l3GhFYa3VsNCMk FAgyOXU9MCtqYB91 a1hFJlUWRUcQHzk6 XFgHFDYiVWIEW20t MhggJ0QVFkIcelk1 eVI9RVsbOARaABw8 V11NATVVYkEIXTYq ABgeFUgZDHVfXDxA SgclOhgABzVTXDZR BU1IUQpn X-Authentic-SMTP: 61633532353630.1038:706 X-AuthFastPath: 0 (Was 255) X-AuthSMTP-Origin: 52.5.185.120/25 X-AuthVirus-Status: No virus detected - but ensure you scan with your own anti-virus system. X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Cc: Bitcoin Protocol Discussion Subject: Re: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by third-parties, not just repo maintainers X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 21:40:25 -0000 --TB36FDmn/VVEgNH/ Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Feb 25, 2017 at 03:34:33PM -0600, Steve Davis wrote: > Yea, well. I don=E2=80=99t think it is ethical to post instructions witho= ut an associated remediation (BIP) if you don=E2=80=99t see the potential a= ttack. I can't agree with you at all there: we're still at the point where the computational costs of such attacks limit their real-world impact, which is exactly when you want the *maximum* exposure to what they are and what the risks are, so that people develop mitigations. Keeping details secret tends to keep the attacks out of public view, which might be a good trade-off in a situation where the attacks are immediately practical and the need to deploy a fix is well understood. But we're in the exact opposite situation. > I was rather hoping that we could have a fuller discussion of what the be= st practical response would be to such an issue? Deploying segwit's 256-bit digests is a response that's already fully coded= and ready to deploy, with the one exception of a new address format. That addre= ss format is being actively worked on, and could be deployed relatively quickl= y if needed. --=20 https://petertodd.org 'peter'[:-1]@petertodd.org --TB36FDmn/VVEgNH/ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYsfm/AAoJECSBQD2l8JH7WCQIAIepw6T0uvJtk3nCEHJQKznj uIGHOsG1owVTiet3UWACCSAoi+XLj1pr08nZqtXVz25e5dUR4QtaeyUvHqO7IGuT 4S+g/IuT4SlvFqiCLooPD2juZyhFhnTowxkg6/VcQEUxuCfg0KnA5sVwJlYayQWR JLZ8z6AYwBany+bWseCdLG+5ZMh/7RvuY3A6tqi/pECWCZostHq5RdmLs0Tsg+6+ VK+0+h/znpp36mBilgkXkGBVQSQQj9J6QE12lwNqhWIWDmZeqr161GjUzfooLUJP TQM07QNxhlr0pq9EuopbaUG+AfNlABydDpkuOM7vb7bmQigZxFuPCJBvLfw30Oc= =6idP -----END PGP SIGNATURE----- --TB36FDmn/VVEgNH/--