Re: Hashcash and the cracking of SHA1

On Sun, 28 Jan 2007, David Fuelling wrote:

> In a nutshell: "Collisions in the the full SHA-1 in 2**69 hash 
> operations, much less than the brute-force attack of 2**80 operations 
> based on the hash length."
========================

2^69 is a significant reduction in work from 2^80, but still non-trivial. 
to put it in perspective, MD5 was designed to require 2^64 operations to 
find a collision (accounting for the birthday paradox). so even partly 
broken, SHA-1 is still stronger than MD5 was ever meant to be.

regarding the evolution of hashcash, if i understand it correctly (it's 
been a while since i've read the full documentation), the first part of a 
stamp (currently a 0 or 1 before the first colon) is used for version 
number. versions zero and one only use SHA-1, and as things change a 
future version of hashcash can use a different hash.

for now, though, SHA-1 is more than adequate for this use. when SHA-1 is 
*really* broken, the bigger impact will be on the pgp infrastructure that 
relies exclusively on SHA-1 for key fingerprints.


-- 
         ...atom

  ________________________
  http://atom.smasher.org/
  762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
  -------------------------------------------------

 	"A people that values its privileges above its principles
 	 soon loses both."
 		-- Dwight D. Eisenhower