4 ms·
Could obsolete Bitcoin ASICs be used to mount any sort of attack on SHA-256? There’s a huge, huge amount of SHA-256 going on in Bitcoin at the moment - does the
by jl6 5y ago
Could obsolete Bitcoin ASICs be used to mount any sort of attack on SHA-256? There’s a huge, huge amount of SHA-256 going on in Bitcoin at the moment - does the ASIC become useless once it is no longer used for Bitcoin, or could it be made to compute SHA-256 for some other nefarious purpose?
- jazzyjackson 5y agoThe collisions that ASICS search for are a few leading zeros, even with the whole Bitcoin network at your disposal I don’t expect it’s practical to find an exact 256bit collision.
- AareyBaba 5y ago3Blue1Brown has a convincing visualization of the size of 2^256. How secure is 256 bit security? https://www.youtube.com/watch?v=S9JGmA5_unY https://www.youtube.com/watch?v=S9JGmA5_unY
- tptacek 5y agoNope. No plausible amount of computational power that works in any way known to modern science will directly break SHA256.
- rospaya 5y agoEven a quantum computer?
- seibelj 5y agoMy understanding is that one-way functions are not broken by quantum computers.
- thaumasiotes 5y agoMy understanding is that in the general case you can see a quadratic speedup, so a 256-bit search space would suddenly collapse to what is effectively a 128-bit search space. Not a big deal by itself.
- tromp 5y agoBitcoin's hashcash PoW is not a 256-bit search problem though. At current difficulty levels, it's closer to an 86-bit problem, so Grover's algorithm reduces that to the equivalent of a 43 bit search space.
- Filligree 5y agoDepends on the function. But not sha256, no. I think you'd almost have to design it to be vulnerable, if you want that.
- MauranKilom 5y agoIt reduces the strength of SHA256 to that of SHA128, roughly speaking. 2^128 is still outside any practical reach whatsoever. (Google breaking SHA-1 after cryptanalysis still required some 2^60 operations iirc).
- ben_w 5y agoI always assume security is worse than the most effective known attack, but IIRC it’s currently thought to be safe against quantum computers: https://eprint.iacr.org/2016/992 https://eprint.iacr.org/2016/992 2^166 ~= give a separate quantum computer that does as many QOPS as the the most powerful supercomputer does FLOPS to each human who has ever lived and have each of them run for a thousand times the age of the universe.
- unixhero 5y agoAsk Grover, google it
- deleted 5y ago[deleted]
- ohhhhhh 5y agoeven if that did happen in the far future, there are quantum proof encryption methods
- a1369209993 5y agoIIRC, a quantum computer reduces preimage attacks (first or second) to the difficulty of collision attacks, but doesn't improve collision beyond the best classical attacks, which can be run on faster and cheaper hardware. It also may or may not benefit from any cryptanalysis applicable to collision attacks. So if you're secure against (classical) collision attacks, you don't need to worry about quantum attacks (collision or preimage).
- zinekeller 5y agoThe main reason that asymmetric (RSA, eliptic curves) encryption are broken (on quantum computers) is simply due to relying on certain assumptions that haven't been fully proven (and instead has been disproven over time). Symmetric and one-way functions are provably secure, within those characteristics that they define. Notably, they are not designed with "until the end of the universe" promise (and the only proven "until the end of the universe" encryption anyway is a proper one-time pad (or disk) encryption). The reason that certain hashing and encryption algorithms have been broken are due to both compromises inherent in design goals (notably, AES have been simplified from the reference encryption Rjindael to ease up hardware acceleration) and the march of technology simply rolling with faster chips. Quantum computing can speedup this process a bit (a quadratic speedup in most cases), but not enough to outbeat these types of encryption.
- tptacek 5y agoThe march of technology has done essentially nothing to weaken AES against direct attacks. AES, of course, has not been broken the way SHA-1 and MD5 were.
- mindslight 5y agoIf there becomes a surplus of power-inefficient hashing gear that is no longer profitable to operate, and the aggregate capability of that "dark" hashing power grows significant compared to the online hashrate, it could be used to carry out a 51% attack. But since ASIC efficiency gains are due to increasing hashrates (with roughly constant power density), this seems unlikely.
- HWR_14 5y agoFrom my understanding, the hardware tends to be burn out faster than it becomes obsolete. So those "obsolete" ASICs aren't reliable enough to do any work anymore.
- exo762 5y agoNo, it can't. World uses single round of SHA-256. Bitcoin uses two rounds of SHA-256 for PoW. Since Bitcoin ASICs hardware is optimized really really hard, they are simply incapable of doing a single round SHA-256. IMHO this design decision was a great call. EDIT: I'm amazed that for 12 hours nobody could point to that well-known fact. NH crowd really knows little about cryptocurrencies.
- ambentzen 5y agoIf it took 12 hours to get pointed out, it's probably not a well known fact.