[BitTorrent] SHA-1 broken

Bill Cox bill at viasic.com
Wed Feb 16 08:18:50 EST 2005


On Wed, 2005-02-16 at 14:07 +0200, Marcel Popescu wrote:
> http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
> 
> As the guy on cypherpunks said, "damn chinese" <g>
> 
> Marcel
> 

Ouch.  2^69 seems like a lot of searching to find a collision, but it's
a whole lot smaller than our hash key length of 20 bytes, and not all
that much larger than the 56 bits of DES, which has been hacked to
death.  69 bits is probably ok for credit card transactions, but I
wouldn't want to use it to sign Fedora Core releases.

What other choices are there out there that are still considered strong?

I know this is a field with well-paid professionals from several
countries, so my relative ignorance will show, but what the heck.
Digital signatures are fun, too!

How about using multiple signatures?  If I find a way to modify data so
that I can spoof the first Merkle hash root, it's unlikely that the same
modification would result in the correct signature of the other.  So for
example, I could do some simple transformation on the torrent data, like
xor-ing it with a pseudo random string, and then compute the SHA1 Merkle
hash tree again.

So, we could extend the Merkle hash tree concept to include multiple
root values, perhaps 3 if we're really paranoid?  Three times 69 (207)
seems like a reasonable space to have to search for collisions.  A
simple use of multiple root hashes would be a double-check after
download was complete.  A more complex scheme could require REQUEST and
PIECE messages to include the hash tree number.

Bill




 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 





More information about the BitTorrent mailing list