[BitTorrent] SHA-1 broken
Harold Feit - Depthstrike.com Administrator
dwknight at depthstrike.com
Wed Feb 16 08:57:28 EST 2005
-----BEGIN PGP SIGNED MESSAGE-----
BitTorrent is a bit more secure about its overall use of SHA1 than
just a basic hash since the hashed data has a known size. With that
known size, the scope of data that can cause a colission is a LOT
The hash blocks are always fixed within a torrent (except for the
final block) at a specified value within the .torrent metadata. When
a hash algorithm finds collisions on two different-sized pieces of
data, it is not as much of a concern for users using those algorithms
for file hashing since a same-sized collision is required.
Invalidating hash algorithms for file verification operations is a
lot harder than just invalidating them for general use because of the
fixed-size restriction placed.
The amount of CPU time required to break SHA1's use in BT is far more
than the amount of CPU time used to break SHA1's use in
SHA1 is still more secure in BT's use than general use because of the
amount of information already known about the pieces.
The Edonkey implementation of MD4 is still more secure than the base
MD4 implementation for similar reasons.
We don't need to worry at all unless a same-sized collision has been
- -----Original Message-----
From: Marcel Popescu [mailto:mdpopescu at yahoo.com]
Sent: Wednesday, February 16, 2005 8:08 AM
To: BitTorrent at yahoogroups.com
Subject: [BitTorrent] SHA-1 broken
As the guy on cypherpunks said, "damn chinese" <g>
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 2/14/2005
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3
-----END PGP SIGNATURE-----
Yahoo! Groups Links
<*> To visit your group on the web, go to:
<*> To unsubscribe from this group, send an email to:
BitTorrent-unsubscribe at yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
More information about the BitTorrent