RE: Query Hit bitprint

No "MD5" sum, this is a "Tiger" digest instead (not to be confused with the
"Tiger tree root" which is another related but distinct value, computed
differently using sets of Tiger hashes computed on separated small blocks
and then organized in Merkle trees where branching nodes are given a
separate Tiger hash computed from a small block consisting of the Tiger
hashes of each sub-branch and a fixed prefix for each branch)...

The SHA1 and Tiger are combined into a single string named "bitprint". If
bitprints are not used, it's because Gnutella has preferred using Tiger tree
roots since long (because it 	allows verifiable swarmed downloads much
more easily, and the complete Tiger hash is almost useless for searches,
where SHA1 alone is already enough; bitprints were intended to avoid
possible but exceptional collisions between two files with the same SHA1,
but still now, such collisions are still not easy to produce
algorithmically, so this is still not a srecurity issue).

If security of SHA1 is a concern due to collisions, it would be easier for
us to combine SHA1 with the Tiger Tree root instead of the Tiger digest of
the complete file.

If we won't use the Tiger Tree root for swarmed downloads, then SHA512 or
SHA384 would be he alternative to SHA1 for stronger security, and faster to
compute than SHA1 plus Tiger Tree root. However, due to the benefit for
swarmed downloads, we would still need a TigerTree root, or some other hash
computed from a similar Merckle tree.

SHA1 (for searches) plus "Tiger Tree root" (used to check the Tiger tree
data during downloads from several distinct swarmed sources that have Tiger
Tree data computed for the files they share) is for now completely secure
(it has never been cracked, no collision was ever found, so SHA1 plus Tiger
Tree root is what we currently use and need, so bitprints are simply
unneeded.)

MY opinion is that bitprints are deprecated. It we wanted a more secure
replacement (to secure searches if SHA1 becomes easily collidable by
spammers) with the immediate benefits for swarmed downloads, it would be a
string combining the SHA1 digest and the Tiger Tree root.

> -----Message d'origine-----
> De : [email protected] [mailto:[email protected]] De la part
> de Arne Babenhauserheide
> Envoyé : mercredi 12 septembre 2007 13:21
> À : [email protected]
> Objet : Re: [the_gdf] Query Hit bitprint
> 
> Do we use bitprints at all?
> 
> As far as I know they consist of a sha1 and an md5 sum or so.
> 
> Best wishes,
> Arne