5 ms·

> It seems then that a good solution would be to force many different types of proof of work. This would create many more opportunities for finding shortcuts l

• MichaelGG 10y ago
  Really? Suppose both a SHA256 and a SHA1 hash were needed. How could it be possible that it's easier to find a simultaneous weakness in both? I get that randomly throwing stuff together isn't favoured (like TLS's PRF SHA1+MD5 construction). But is there any actual work where requiring 2 separate full checks to be worse than just one? That is, needing to verify MD5 plus SHA1 independently.
  • jcoffland 10y ago
    First of all we aren't talking about weaknesses in hash functions. We are talking about ways to compute hashes faster. > But is there any actual work where requiring 2 separate full checks to be worse than just one? That is, needing to verify MD5 plus SHA1 independently. One could then use both SHA1 and MD5 shortcuts.
    • MichaelGG 10y ago
      OK, but having to use both a SHA1 and MD5 shortcut is still going to be more work than using just one of them.
      • yorwba 10y ago
        But it's less work than having to compute both SHA1 and MD5 without shortcut, which is the comparison that matters.
  • lmm 10y ago
    > I get that randomly throwing stuff together isn't favoured (like TLS's PRF SHA1+MD5 construction). But is there any actual work where requiring 2 separate full checks to be worse than just one? That is, needing to verify MD5 plus SHA1 independently. Even a crappy 256-bit hash (by using two 128-bit hashes) will probably be more secure than a (single) 128-bit hash, sure. But it won't be anywhere near as secure as a proper 256-bit hash. If you can afford 256 bits of hash, the best way to spend them is on a dedicated 256-bit hash.