[BitTorrent] Merkle, URLs, etc
Joseph Ashwood
ashwood at msn.com
Sun Mar 6 22:05:44 EST 2005
----- Original Message -----
From: "John Hoffman" <theshadow at shambala.net>
Subject: Re: [BitTorrent] Merkle, URLs, etc
>>It is unlikely that there will be any good new 160 bit hashes. The 2^80
>>security offered by them has been considered just barely good enough for a
>>decade, and an increasing number of cryptanalysts (including myself) are
>>pushing that with the breaks seemingly coming faster and faster now we
>>might
>>as well just jump to the stronger hashes now, and prepare for a quick jump
>>in the future.
>>
>
> Well, please remember that, when it comes to BitTorrent not only is it
> not 2^80 but 2^160 security, but BitTorrent has a fixed block size where
> many of these attacks require variable block sizes, and I don't think
> the new attack is even relevant to SHA-1's strong anti-collision
> capability. It might cause havoc with other systems needing signatures,
> but I don't think it affects BT any.
That's all well and good, but cryptanalysts still are unlikely to work on
something that will be percieved as a waste of time, something, to be rather
pointed, like a 160-bit hash function.
Any attack always affects every system, although I freely admit that the
hash is not the weakest link in BitTorrent security. That the current SHA-1
attack only finds free collisions is fairly irrelevant, attacks never get
worse. SHA-1 is probably good enough for now, but plans need to be put in
place to retire it and move to something better. It is always good to
prepare to simply roll over to a new primitive at a moments notice. The
method of doing this that I am in favor of is to prepend a primitive
identifier to all hashes, in the case of BitTorrent use descendency to save
time and simply put the hash identifier in the torrent, and implement
identifiers and code for SHA-245, SHA-512 and Whirlpool. This means that any
users who want higher security can already roll over to the stronger
functions right now, and at a later date when it becomes important to do so,
the entire system can roll over to a new hash quickly, even silently. This
is just good design, and will cost all of 15 bytes (maximum assuming I'm
counting correctly) once bencoded.
Joe
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/BitTorrent/
<*> To unsubscribe from this group, send an email to:
BitTorrent-unsubscribe at yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
More information about the BitTorrent
mailing list