5 ms·

So it was claimed by reusing the collision data from shattered.io: https://bitcointalk.org/index.php?topic=293382.msg17950195#msg17950195 https://bitcointalk.or

by mrb 10y ago

So it was claimed by reusing the collision data from shattered.io: https://bitcointalk.org/index.php?topic=293382.msg17950195#msg17950195 https://bitcointalk.org/index.php?topic=293382.msg17950195#m... Pretty cool.

mikeash 10y ago
I'm really interested in the comment about someone else running a bot that tries a double-spend based on the answer in the original transaction. It sounds like it didn't work, but it could have. Is there a way to set up these sorts of automated challenges in a way that isn't vulnerable to that?
- jstanley 10y ago
  I can't see how you'd do it for a case like this. The script is just checking that the spender knows 2 pieces of data that are different but have the same SHA1 hash. I can't see a way to do that that can't be easily replayed by somebody else spending to a different address. As soon as the transaction is broadcast, you reveal your 2 pieces of data that are different but have the same SHA1 hash.
  - nullc 10y ago
    Either by using interaction (with a ZKCP) or by using a two phase redemption and a covenant (https://blockstream.com/2016/11/02/covenants-in-elements-alpha.html https://blockstream.com/2016/11/02/covenants-in-elements-alp... which requires OP_CAT and friends which are disabled but could easily be reenabled after the segwit improvement to Bitcoin).
    - jstanley 10y ago
      Fascinating stuff, thanks!
    - just_one_time_ 10y ago
      Please don't listen to/encourage this guy, he is a well known purveyor of false information, from Wikipedia vandalism to Reddit censorship. He is now trying to insinuate himself into Bitcoin as if he were some kind of expert not just a professional internet troll. 9:10 he is lying, confused or just being a jerk for no reason.
- kolinko 10y ago
  It's possible in Ethereum. You set a two-step process, in the first step you claim the solution - providing a hash of it, and your address. In the second step (in the next block), you provide the solution, and a smart contract can only send money to the address you provided in the first step.
  - nullc 10y ago
    It's possible in Bitcoin too and not just for the kind of trivial program you could plausible execute in a public blockchain. https://bitcoincore.org/en/2016/02/26/zero-knowledge-contingent-payments-announcement/ https://bitcoincore.org/en/2016/02/26/zero-knowledge-conting... (And to not put too fine a point on it: the existing track record of ethereum smart contracts suggests that if such a bounty had been created there it would have simply been stolen due to contract/vm flaws by now.)
  - SergeAx 10y ago
    > you claim the solution - providing a hash of it, and your address Unless it is SHA-1 hash :)
- ikeboy 10y ago
  Discussed in https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_bitcoin_bounty_for_sha1_sha256_etc/cc7fiqe/ https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_b... You'd need a system supporting zero knowledge proofs.
  - mikeash 10y ago
    Excellent post, thanks for linking to it.
- DINKDINK 10y ago
  In addition to the zero knowledge proof points discussed below, one could (if they had the mean) to not publish the tx but include it in a block that they work on privately. It's not fool proof (once you announce the block, you've only given yourself one block worth of proof of work lead and an attacker could copy your proof and include it in a competing chain) ZKCP is a much more robust solution.
illumin8 10y ago
How much BTC did he get?
- jstanley 10y ago
  https://blockchain.info/tx/8d31992805518fd62daa3bdd2a5c4fd2cd3054c9b3dca1d78055e9528cff6adc https://blockchain.info/tx/8d31992805518fd62daa3bdd2a5c4fd2c... 2.48 BTC
  - tyingq 10y ago
    ~$2860 USD. Fairly good payoff for probably setting up a Google Alert and a small amount of scripting.
- deleted 10y ago
  [deleted]
- mrb 10y ago
  2.48 BTC, valued at 2800 USD at the moment.

by mrb 10y ago

mikeash 10y ago

I'm really interested in the comment about someone else running a bot that tries a double-spend based on the answer in the original transaction. It sounds like it didn't work, but it could have. Is there a way to set up these sorts of automated challenges in a way that isn't vulnerable to that?

jstanley 10y ago
I can't see how you'd do it for a case like this. The script is just checking that the spender knows 2 pieces of data that are different but have the same SHA1 hash. I can't see a way to do that that can't be easily replayed by somebody else spending to a different address. As soon as the transaction is broadcast, you reveal your 2 pieces of data that are different but have the same SHA1 hash.
- nullc 10y ago
  Either by using interaction (with a ZKCP) or by using a two phase redemption and a covenant (https://blockstream.com/2016/11/02/covenants-in-elements-alpha.html https://blockstream.com/2016/11/02/covenants-in-elements-alp... which requires OP_CAT and friends which are disabled but could easily be reenabled after the segwit improvement to Bitcoin).
  - jstanley 10y ago
    Fascinating stuff, thanks!
  - just_one_time_ 10y ago
    Please don't listen to/encourage this guy, he is a well known purveyor of false information, from Wikipedia vandalism to Reddit censorship. He is now trying to insinuate himself into Bitcoin as if he were some kind of expert not just a professional internet troll. 9:10 he is lying, confused or just being a jerk for no reason.
kolinko 10y ago
It's possible in Ethereum. You set a two-step process, in the first step you claim the solution - providing a hash of it, and your address. In the second step (in the next block), you provide the solution, and a smart contract can only send money to the address you provided in the first step.
- nullc 10y ago
  It's possible in Bitcoin too and not just for the kind of trivial program you could plausible execute in a public blockchain. https://bitcoincore.org/en/2016/02/26/zero-knowledge-contingent-payments-announcement/ https://bitcoincore.org/en/2016/02/26/zero-knowledge-conting... (And to not put too fine a point on it: the existing track record of ethereum smart contracts suggests that if such a bounty had been created there it would have simply been stolen due to contract/vm flaws by now.)
- SergeAx 10y ago
  > you claim the solution - providing a hash of it, and your address Unless it is SHA-1 hash :)
ikeboy 10y ago
Discussed in https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_bitcoin_bounty_for_sha1_sha256_etc/cc7fiqe/ https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_b... You'd need a system supporting zero knowledge proofs.
- mikeash 10y ago
  Excellent post, thanks for linking to it.
DINKDINK 10y ago
In addition to the zero knowledge proof points discussed below, one could (if they had the mean) to not publish the tx but include it in a block that they work on privately. It's not fool proof (once you announce the block, you've only given yourself one block worth of proof of work lead and an attacker could copy your proof and include it in a competing chain) ZKCP is a much more robust solution.

illumin8 10y ago

How much BTC did he get?

jstanley 10y ago
https://blockchain.info/tx/8d31992805518fd62daa3bdd2a5c4fd2cd3054c9b3dca1d78055e9528cff6adc https://blockchain.info/tx/8d31992805518fd62daa3bdd2a5c4fd2c... 2.48 BTC
- tyingq 10y ago
  ~$2860 USD. Fairly good payoff for probably setting up a Google Alert and a small amount of scripting.
deleted 10y ago
[deleted]
mrb 10y ago
2.48 BTC, valued at 2800 USD at the moment.