3 ms·

Supposedly they can easily change algorithms if SHA-256 is broken in the future. Here is a list of client security issues: https://en.bitcoin.it/wiki/Common_Vu

by dm2 14y ago

Supposedly they can easily change algorithms if SHA-256 is broken in the future. Here is a list of client security issues: https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposu... It seems like the biggest risk would be with the wallet websites, which is an issue that is present in other payment methods. The biggest problem IMO is that there is no way to refund or right the wrongs done by an attack. If someone in russia or china steals half of the bitcoins, there is nothing anyone can do to get them back. I suppose they would all be logged and everyone could band together to block those BitCoins as payments, but that's probably not going to happen. That would be interest to watch play out.

wmf 14y ago
I think betterunix is not talking about a crypto flaw but a 51% attack; for ~$20M you can buy enough ASICs to basically take control of Bitcoin. (I'm not convinced that mathematical concepts like "polynomial time" should be applied without consideration for economics, but that's a whole different topic.)
- cjg 14y ago
  Which provides an interesting way to value BTC. If the total value goes much over the cost of a 51% attack then it is overvalued.
- narcissus 14y ago
  I'll just hope that if someone decides to go down that route, then at least one other person does too :)
betterunix 14y ago
"Supposedly they can easily change algorithms if SHA-256 is broken in the future." You are not understanding the problem. Bitcoin is not a hash function, nor is Bitcoin a digital signature system. Bitcoin is a digital cash system, and so any discussion of Bitcoin's security must be based on the notion of security in a digital cash system. There are two minimum security properties a digital cash system should have (informally): first, that the units of value cannot be counterfeited; second, that each unit of value can be spend by exactly one party at any given time. In both cases, it is commonly assumed that the attacker's work is bounded by some polynomial in the parameters of the system itself, so the system is secure if no polynomial time algorithm can break either property (but an exponential time algorithm might e.g. a brute-force approach). It is possible (and usually desirable) to prove that a system is secure using mathematical arguments, for example these systems: http://link.springer.com/chapter/10.1007%2F11889663_20 http://link.springer.com/chapter/10.1007%2F11889663_20 https://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=5689448 https://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=568944... http://ieeexplore.ieee.org/iel5/5326/5550332/05443458.pdf http://ieeexplore.ieee.org/iel5/5326/5550332/05443458.pdf (Sorry that these are paywalled, you can probably find them elsewhere) Unfortunately for Bitcoin, while it seems to satisfy the first property (but no security proof is out there as far as I know), it fails the second property. Double spending in Bitcoin requires work that scales linearly with the parameters of the system (the "51% attack"), which is basically worthless as far as cryptography is concerned. The fact that Bitcoin uses a secure hash function and a secure signature system is irrelevant because the problem is with the protocol itself. An easy way to illustrate the difference between using a secure cryptosystem and being a secure cryptosystem is the "surreptitious forwarding" problem. Suppose you receive a message from your boss that was signed with his secret key then encrypted with your public key which said, "You're fired!" Now what you might do is to re-encrypt the signed message with another person's key and send that to them; they would now believe that they were being fired. It is not the encryption system or the signature system that you attacked, it was the fact that composing signing with encryption in that manner does not prevent such forwarding (but there are ways to do that). Bitcoin has a similar problem.

by dm2 14y ago

wmf 14y ago

I think betterunix is not talking about a crypto flaw but a 51% attack; for ~$20M you can buy enough ASICs to basically take control of Bitcoin. (I'm not convinced that mathematical concepts like "polynomial time" should be applied without consideration for economics, but that's a whole different topic.)

cjg 14y ago
Which provides an interesting way to value BTC. If the total value goes much over the cost of a 51% attack then it is overvalued.
narcissus 14y ago
I'll just hope that if someone decides to go down that route, then at least one other person does too :)

betterunix 14y ago

"Supposedly they can easily change algorithms if SHA-256 is broken in the future." You are not understanding the problem. Bitcoin is not a hash function, nor is Bitcoin a digital signature system. Bitcoin is a digital cash system, and so any discussion of Bitcoin's security must be based on the notion of security in a digital cash system. There are two minimum security properties a digital cash system should have (informally): first, that the units of value cannot be counterfeited; second, that each unit of value can be spend by exactly one party at any given time. In both cases, it is commonly assumed that the attacker's work is bounded by some polynomial in the parameters of the system itself, so the system is secure if no polynomial time algorithm can break either property (but an exponential time algorithm might e.g. a brute-force approach). It is possible (and usually desirable) to prove that a system is secure using mathematical arguments, for example these systems: http://link.springer.com/chapter/10.1007%2F11889663_20 http://link.springer.com/chapter/10.1007%2F11889663_20 https://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=5689448 https://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=568944... http://ieeexplore.ieee.org/iel5/5326/5550332/05443458.pdf http://ieeexplore.ieee.org/iel5/5326/5550332/05443458.pdf (Sorry that these are paywalled, you can probably find them elsewhere) Unfortunately for Bitcoin, while it seems to satisfy the first property (but no security proof is out there as far as I know), it fails the second property. Double spending in Bitcoin requires work that scales linearly with the parameters of the system (the "51% attack"), which is basically worthless as far as cryptography is concerned. The fact that Bitcoin uses a secure hash function and a secure signature system is irrelevant because the problem is with the protocol itself. An easy way to illustrate the difference between using a secure cryptosystem and being a secure cryptosystem is the "surreptitious forwarding" problem. Suppose you receive a message from your boss that was signed with his secret key then encrypted with your public key which said, "You're fired!" Now what you might do is to re-encrypt the signed message with another person's key and send that to them; they would now believe that they were being fired. It is not the encryption system or the signature system that you attacked, it was the fact that composing signing with encryption in that manner does not prevent such forwarding (but there are ways to do that). Bitcoin has a similar problem.