MIME-Version: 1.0
In-Reply-To: <20170225191201.GA15472@savin.petertodd.org>
References: <mailman.22137.1487974823.31141.bitcoin-dev@lists.linuxfoundation.org>
	<8F096BE1-D305-43D4-AF10-2CC48837B14F@gmail.com>
	<20170225010122.GA10233@savin.petertodd.org>
	<208F93FE-B7C8-46BE-8E00-52DBD0F43415@gmail.com>
	<CAN6UTayzQRowtWhLKr8LyFuXjw3m+GjQGtHfkDj-Xu41Hym32w@mail.gmail.com>
	<CAEM=y+WkgSkc07ZsU6APAkcu37zVZ7dwSc=jAg1nho31S5ZyxQ@mail.gmail.com>
	<20170225191201.GA15472@savin.petertodd.org>
From: "Russell O'Connor" <roconnor@blockstream.io>
Date: Sat, 25 Feb 2017 15:53:12 -0500
Message-ID: <CAMZUoK=sq_sRoXuySca-VAGwA3AzeoZ5iNFSnKULbj+NtPjHFA@mail.gmail.com>
To: Peter Todd <pete@petertodd.org>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=94eb2c03d91a1603b70549610aaa
Cc: Steve Davis <steven.charles.davis@gmail.com>
Subject: Re: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by
 third-parties, not just repo maintainers
Precedence: list

--94eb2c03d91a1603b70549610aaa
Content-Type: text/plain; charset=UTF-8

On Sat, Feb 25, 2017 at 2:12 PM, Peter Todd via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Sat, Feb 25, 2017 at 11:10:02AM -0500, Ethan Heilman via bitcoin-dev
> wrote:
> > >SHA1 is insecure because the SHA1 algorithm is insecure, not because
> > 160bits isn't enough.
> >
> > I would argue that 160-bits isn't enough for collision resistance.
> Assuming
> > RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random oracle),
> collisions
>
> That's something that we're well aware of; there have been a few
> discussions on
> this list about how P2SH's 160-bits is insufficient in certain use-cases
> such
> as multisig.
>
> However, remember that a 160-bit *security level* is sufficient, and
> RIPEMD160
> has 160-bit security against preimage attacks. Thus things like
> pay-to-pubkey-hash are perfectly secure: sure you could generate two
> pubkeys
> that have the same RIPEMD160(SHA256()) digest, but if someone does that it
> doesn't cause the Bitcoin network itself any harm, and doing so is
> something
> you choose to do to yourself.
>

Be aware that the issue is more problematic for more complex contracts.
For example, you are building a P2SH 2-of-2 multisig together with someone
else if you are not careful, party A can hand their key over to party B,
who can may try to generate a collision between their second key and
another 2-of-2 multisig where they control both keys. See
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012205.html

--94eb2c03d91a1603b70549610aaa
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Sat, Feb 25, 2017 at 2:12 PM, Peter Todd via bitcoin-dev <span dir=
=3D"ltr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" targe=
t=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span> wrote:<br=
><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border=
-left:1px solid rgb(204,204,204);padding-left:1ex"><span class=3D"gmail-">O=
n Sat, Feb 25, 2017 at 11:10:02AM -0500, Ethan Heilman via bitcoin-dev wrot=
e:<br>
&gt; &gt;SHA1 is insecure because the SHA1 algorithm is insecure, not becau=
se<br>
&gt; 160bits isn&#39;t enough.<br>
&gt;<br>
&gt; I would argue that 160-bits isn&#39;t enough for collision resistance.=
 Assuming<br>
&gt; RIPEMD-160(SHA-256(msg)) has no flaws (i.e. is a random oracle), colli=
sions<br>
<br>
</span>That&#39;s something that we&#39;re well aware of; there have been a=
 few discussions on<br>
this list about how P2SH&#39;s 160-bits is insufficient in certain use-case=
s such<br>
as multisig.<br>
<br>
However, remember that a 160-bit *security level* is sufficient, and RIPEMD=
160<br>
has 160-bit security against preimage attacks. Thus things like<br>
pay-to-pubkey-hash are perfectly secure: sure you could generate two pubkey=
s<br>
that have the same RIPEMD160(SHA256()) digest, but if someone does that it<=
br>
doesn&#39;t cause the Bitcoin network itself any harm, and doing so is some=
thing<br>
you choose to do to yourself.<br></blockquote><div><br></div><div>Be aware =
that the issue is more problematic for more complex contracts.=C2=A0 For ex=
ample, you are building a P2SH 2-of-2 multisig together with someone else i=
f you are not careful, party A can hand their key over to party B, who can =
may try to generate a collision between their second key and another 2-of-2=
 multisig where they control both keys. See <a href=3D"https://lists.linuxf=
oundation.org/pipermail/bitcoin-dev/2016-January/012205.html">https://lists=
.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012205.html</a><br>=
</div></div></div></div>

--94eb2c03d91a1603b70549610aaa--