RE: SHA-1 broken

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

BitTorrent is a bit more secure about its overall use of SHA1 than
just a basic hash since the hashed data has a known size. With that
known size, the scope of data that can cause a colission is a LOT
smaller.

The hash blocks are always fixed within a torrent (except for the
final block) at a specified value within the .torrent metadata. When
a hash algorithm finds collisions on two different-sized pieces of
data, it is not as much of a concern for users using those algorithms
for file hashing since a same-sized collision is required.

Invalidating hash algorithms for file verification operations is a
lot harder than just invalidating them for general use because of the
fixed-size restriction placed.

The amount of CPU time required to break SHA1's use in BT is far more
than the amount of CPU time used to break SHA1's use in
variable-sized messages.

SHA1 is still more secure in BT's use than general use because of the
amount of information already known about the pieces.

The Edonkey implementation of MD4 is still more secure than the base
MD4 implementation for similar reasons.

We don't need to worry at all unless a same-sized collision has been
found.

- -----Original Message-----
From: Marcel Popescu [mailto:[email protected]] 
Sent: Wednesday, February 16, 2005 8:08 AM
To: [email protected]
Subject: [BitTorrent] SHA-1 broken


http://www.schneier.com/blog/archives/2005/02/sha1_broken.html

As the guy on cypherpunks said, "damn chinese" <g>

Marcel


- -- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 2/14/2005
 

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQEVAwUBQhNRRl8nceBm0DUaAQLR3ggAk2TNFIA28jrB9aZA3It4B2zUzrEj3xAB
7kQI2ignrQRT91gwxqpclvcA7gn03OSUBIRtPuKqHRAw5AUYkTRX65IDvgX3PBgn
julYJVjNPay6OTTIkl02jDjjk7Y2XF+4QcF8VZAp04xEU/Uw+PTDo+gi4/0s+Xfv
vUEcJqRfOBb5IVdpQoEey7sNpEMCd65Jfv2geHTG8VKn3kQiUCW0gAWAi/M+CCz3
iFv0ylky94xMW5XW38mlCSm89gV+TGGA/4kWrmQtm3QKw11wZMESICgEiPCbj1en
Piqj1Yvwzg5/lMXVctdcVIBtwXJdHilkEvauaAkyHPFgqWjlsaXgvQ==
=qIi4
-----END PGP SIGNATURE-----




 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/