4 ms·

Signing the hashes instead of the executable leaves you open to collision attacks.

gojomo 5y ago
Are you aware of any practical SHA-256 collision attacks? What do you expect the results would be, if within the next few days it were discovered that there were two different files, with the same SHA-256, each claiming to be the Bitcoin-0.21.1 release?
- nullc 5y ago
  If you know a sha256 collision the bitcoin network will currently pay you about 0.476 BTC (~about $26k USD right now) to publish it. https://blockstream.info/address/35Snmmy3uhaer2gTboc81ayCip4m9DT4ko https://blockstream.info/address/35Snmmy3uhaer2gTboc81ayCip4... https://blockstream.info/address/39VXyuoc6SXYKp9TcAhoiN1mb4ns6z3Yu6 https://blockstream.info/address/39VXyuoc6SXYKp9TcAhoiN1mb4n... https://blockstream.info/address/3DUQQvz4t57Jy7jxE86kyFcNpKtURNf1VW https://blockstream.info/address/3DUQQvz4t57Jy7jxE86kyFcNpKt...
  - drexlspivey 5y ago
    In practice, if you try to claim those coins by broadcasting a transaction with the collision the most likely outcome is someone will snatch the coins by changing the output address with his own address (since the scripts contains no signature checking). You would have to give your tx straight to a miner (and hope for the best)
    - gojomo 5y ago
      But also, in practice, the fame of announcing such a discovery (with or without an explanation of the method for creating it) could be worth more than $26k. And if you wanted to profit from it, via submitting the transaction or not, you could likely make far more by speculating on the effects of that announced collision on the Bitcoin price – likely sharply negative.
nullc 5y ago
The signature algorithm uses the same hash, so there isn't any meaningful opening there. :)
- h_anna_h 5y ago
  There is a reason ed25519 is used instead of ed25519ph :) PureEdDSA does not break when a hash function without collision resistance is used.
  - nullc 5y ago
    Doesn't apply to PGP. :) And the kind of theoretical attack that non-prehashing protects you from requires that you sign an attacker chosen message -- relevant in some applications but kind of contrived.
gliptic 5y ago
There's no such thing as "signing the executable". It's always signing a hash.
- h_anna_h 5y ago
  Certain signing algorithms such as ed25519 do not depend on the collision resistance of the hash function when signing the message. They do however when signing the hash. "It's always signing a hash.", sure, but S(m) and S(h(m)) is a different operation with very different properties.
littlestymaar 5y ago
You realize that if SHA-256 collision where something even remotely practical, then the entire bitcoin protocol is instantly dead?
- h_anna_h 5y ago
  No, I do not realize that. Is the security of the bitcoin protocol based on the collision resistance of SHA-256? If so they should try to find a solution around it.
  - littlestymaar 5y ago
    Blocks are identified by their hash, so if you can create a collision between two blocks, there's no way for anyone to know which one is the legit one. Also, inside a block itself, transactions are part of a Merkle Tree[1], so if you can find a SHA-256 collision, you can also create confusion on what transaction where actually included in a given block. You cannot really “find a solution around it” for two reasons: 1- the bitcoin blockchain is immutable, so the old blocks can't really be rewritten to work with another hashing mechanism. What you could do is reboot the bitcoin blockchain with another hash algorithm, with a Genesis block summarizing the last know state of the bitcoin blockchain. But that would need consensus among the entire bitcoin community, which will never happen because of reason #2 2- Bitcoin miners own millions of dollars of custom hardware designed for SHA-256 generation (mining), there's no way they'll just be like “OK, let's change hash function, I'll throw this useless stuff away and buy new ones”. [1]: https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree

Are you aware of any practical SHA-256 collision attacks? What do you expect the results would be, if within the next few days it were discovered that there were two different files, with the same SHA-256, each claiming to be the Bitcoin-0.21.1 release?

nullc 5y ago
If you know a sha256 collision the bitcoin network will currently pay you about 0.476 BTC (~about $26k USD right now) to publish it. https://blockstream.info/address/35Snmmy3uhaer2gTboc81ayCip4m9DT4ko https://blockstream.info/address/35Snmmy3uhaer2gTboc81ayCip4... https://blockstream.info/address/39VXyuoc6SXYKp9TcAhoiN1mb4ns6z3Yu6 https://blockstream.info/address/39VXyuoc6SXYKp9TcAhoiN1mb4n... https://blockstream.info/address/3DUQQvz4t57Jy7jxE86kyFcNpKtURNf1VW https://blockstream.info/address/3DUQQvz4t57Jy7jxE86kyFcNpKt...
- drexlspivey 5y ago
  In practice, if you try to claim those coins by broadcasting a transaction with the collision the most likely outcome is someone will snatch the coins by changing the output address with his own address (since the scripts contains no signature checking). You would have to give your tx straight to a miner (and hope for the best)
  - gojomo 5y ago
    But also, in practice, the fame of announcing such a discovery (with or without an explanation of the method for creating it) could be worth more than $26k. And if you wanted to profit from it, via submitting the transaction or not, you could likely make far more by speculating on the effects of that announced collision on the Bitcoin price – likely sharply negative.

nullc 5y ago

The signature algorithm uses the same hash, so there isn't any meaningful opening there. :)

h_anna_h 5y ago
There is a reason ed25519 is used instead of ed25519ph :) PureEdDSA does not break when a hash function without collision resistance is used.
- nullc 5y ago
  Doesn't apply to PGP. :) And the kind of theoretical attack that non-prehashing protects you from requires that you sign an attacker chosen message -- relevant in some applications but kind of contrived.

gliptic 5y ago

There's no such thing as "signing the executable". It's always signing a hash.

h_anna_h 5y ago
Certain signing algorithms such as ed25519 do not depend on the collision resistance of the hash function when signing the message. They do however when signing the hash. "It's always signing a hash.", sure, but S(m) and S(h(m)) is a different operation with very different properties.

littlestymaar 5y ago

You realize that if SHA-256 collision where something even remotely practical, then the entire bitcoin protocol is instantly dead?

h_anna_h 5y ago
No, I do not realize that. Is the security of the bitcoin protocol based on the collision resistance of SHA-256? If so they should try to find a solution around it.
- littlestymaar 5y ago
  Blocks are identified by their hash, so if you can create a collision between two blocks, there's no way for anyone to know which one is the legit one. Also, inside a block itself, transactions are part of a Merkle Tree[1], so if you can find a SHA-256 collision, you can also create confusion on what transaction where actually included in a given block. You cannot really “find a solution around it” for two reasons: 1- the bitcoin blockchain is immutable, so the old blocks can't really be rewritten to work with another hashing mechanism. What you could do is reboot the bitcoin blockchain with another hash algorithm, with a Genesis block summarizing the last know state of the bitcoin blockchain. But that would need consensus among the entire bitcoin community, which will never happen because of reason #2 2- Bitcoin miners own millions of dollars of custom hardware designed for SHA-256 generation (mining), there's no way they'll just be like “OK, let's change hash function, I'll throw this useless stuff away and buy new ones”. [1]: https://en.wikipedia.org/wiki/Merkle_tree https://en.wikipedia.org/wiki/Merkle_tree