[BitTorrent] SHA-1 broken

Nick Johnson arachnid at notdot.net
Wed Feb 16 15:22:42 EST 2005

On 17/02/2005, at 1:07 AM, Marcel Popescu wrote:

> http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
> As the guy on cypherpunks said, "damn chinese" <g>
> Marcel
There's a few things worth noting here:
1) The 'break' is a collision attack. This means it's easier than 
brute-force (which would be 2^80) to find two blocks that collide. It's 
not a preimage attack, though, so you can't take an existing block and 
make another one with the same hash. In the case of BT, this would mean 
someone could publish a torrent with a chunk (containing garbage 
somewhere unimportant) and be able to send another chunk in its place 
if they wanted. Not really very useful, that I can see.
2) It's _still_ 2^69 operations. This is a lot of work.
3) It's not published yet. Until qualified cryptographers review the 
work, we can't be sure if it's authentic or a mistake.

All that said, it's still the first major crack in SHA-1's security, 
and an indication it's time to start considering other hashes. What it 
isn't is a disaster.

-Nick Johnson

Yahoo! Groups Links

<*> To visit your group on the web, go to:

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:

More information about the BitTorrent mailing list