Re: Merkle, URLs, etc

----- Original Message ----- 
From: "John Hoffman" <[email protected]>
Subject: Re: [BitTorrent] Merkle, URLs, etc


>>It is unlikely that there will be any good new 160 bit hashes. The 2^80
>>security offered by them has been considered just barely good enough for a
>>decade, and an increasing number of cryptanalysts (including myself) are
>>pushing that with the breaks seemingly coming faster and faster now we 
>>might
>>as well just jump to the stronger hashes now, and prepare for a quick jump
>>in the future.
>>
>
> Well, please remember that, when it comes to BitTorrent not only is it
> not 2^80 but 2^160 security, but BitTorrent has a fixed block size where
> many of these attacks require variable block sizes, and I don't think
> the new attack is even relevant to SHA-1's strong anti-collision
> capability.  It might cause havoc with other systems needing signatures,
> but I don't think it affects BT any.

That's all well and good, but cryptanalysts still are unlikely to work on 
something that will be percieved as a waste of time, something, to be rather 
pointed, like a 160-bit hash function.

Any attack always affects every system, although I freely admit that the 
hash is not the weakest link in BitTorrent security. That the current SHA-1 
attack only finds free collisions is fairly irrelevant, attacks never get 
worse. SHA-1 is probably good enough for now, but plans need to be put in 
place to retire it and move to something better. It is always good to 
prepare to simply roll over to a new primitive at a moments notice. The 
method of doing this that I am in favor of is to prepend a primitive 
identifier to all hashes, in the case of BitTorrent use descendency to save 
time and simply put the hash identifier in the torrent, and implement 
identifiers and code for SHA-245, SHA-512 and Whirlpool. This means that any 
users who want higher security can already roll over to the stronger 
functions right now, and at a later date when it becomes important to do so, 
the entire system can roll over to a new hash quickly, even silently. This 
is just good design, and will cost all of 15 bytes (maximum assuming I'm 
counting correctly) once bencoded.
                Joe 



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/