[BitTorrent] SHA-1 broken

Justin Cormack justin at street-vision.com
Wed Feb 16 09:00:23 EST 2005


> 
> 
> On Wed, 2005-02-16 at 14:07 +0200, Marcel Popescu wrote:
> > http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
> > 
> > As the guy on cypherpunks said, "damn chinese" <g>
> > 
> > Marcel
> > 
> 
> Ouch.  2^69 seems like a lot of searching to find a collision, but it's
> a whole lot smaller than our hash key length of 20 bytes, and not all
> that much larger than the 56 bits of DES, which has been hacked to
> death.  69 bits is probably ok for credit card transactions, but I
> wouldn't want to use it to sign Fedora Core releases.
> 
> What other choices are there out there that are still considered strong?

The SHA2 series (SHA256, 384 and 512) are probably not affected.

SHA256 is about half the speed to calculate as SHA1, and the hash is 32 bytes.
384 and 512 use 64 bit values not 32 in the calculation, and the figures
I have found suggest they are much slower but none of these use MMX or
64 bit machines, which probably make a huge difference. Hash lengths
are rather long. Whirlpool is also 64 bit based, but again has a 64 byte
hash length.

I see Bram submitted a Rijndael based hash to NIST
http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/ (at the bottom)
but they wont consider it as it uses Rijndael with block size 256 which
hasnt been vetted.

> I know this is a field with well-paid professionals from several
> countries, so my relative ignorance will show, but what the heck.
> Digital signatures are fun, too!
> 
> How about using multiple signatures?  If I find a way to modify data so
> that I can spoof the first Merkle hash root, it's unlikely that the same
> modification would result in the correct signature of the other.  So for
> example, I could do some simple transformation on the torrent data, like
> xor-ing it with a pseudo random string, and then compute the SHA1 Merkle
> hash tree again.
> 
> So, we could extend the Merkle hash tree concept to include multiple
> root values, perhaps 3 if we're really paranoid?  Three times 69 (207)
> seems like a reasonable space to have to search for collisions.  A
> simple use of multiple root hashes would be a double-check after
> download was complete.  A more complex scheme could require REQUEST and
> PIECE messages to include the hash tree number.

Cryptography. Dont try it at home. Lots of reasons why not.


> 
> Bill
> 
> 
> 
> 
>  
> Yahoo! Groups Links
> 
> 
> 
>  
> 
> 
> 



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 





More information about the BitTorrent mailing list