4 ms·

This article talks about strength in terms of number of operations, but wouldn't it make more sense to think in terms of amount of energy? SHA-256 can be very c

by myhf 12y ago

This article talks about strength in terms of number of operations, but wouldn't it make more sense to think in terms of amount of energy? SHA-256 can be very cost-effective to mount a long-term collision attack against, given the existence of SHA-256 ASICs.

pushedx 12y ago
I've mounted a growing suspicion that Bitcoin was developed to create a need for SHA-256 ASICs. Well, here they are, and it's much easier to brute-force a SHA-256 hash collision than it was 5 years ago. In fact you can compute billions of hashes per second for less than the cost of a PC.
- deleted 12y ago
  [deleted]
- gwillen 12y ago
  As an owner of a Bitcoin ASIC, I don't _think_ they're usable for general SHA-256. I think they're all specialized for SHA-256(SHA-256(X)), where X must be a packet in a bitcoin-specific format.
  - cantfindmypass 12y ago
    Correct, they cannot compute SHA256() or SHA256(SHA256()) of arbitrary data.
    - pushedx 12y ago
      Well, I stand corrected. Especially in light of the analyses provided in sibling comments.
pbsd 12y ago
Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number of bit operations on SHA-256, but it must be at least 256 times 64 rounds. A collision attack costs approximately 2^128 evaluations, which gives us 256x64x7.92x10^-28x2^128 ~ 2^52 kHw for a collision. This is an extremely optimistic lower bound: the real cost would be many orders of magnitude higher. For comparison, the current global annual energy consumption is estimated to be ~2^47 kWh [2]. [1] https://en.wikipedia.org/wiki/Landauer's_principle https://en.wikipedia.org/wiki/Landauer's_principle [2] https://en.wikipedia.org/wiki/World_energy_consumption https://en.wikipedia.org/wiki/World_energy_consumption
agl 12y ago
Assuming that SHA-256 is sound, then the effort needed to find a collision is 2^128. However efficient your hardware is, multiplying the energy-per-hash by 2^128 results in an impossible number. Let's say that you have a magic device that computes the total, current Bitcoin hashing rate (75 million GH/s) with just a watt of power. # Total hashes per second >>> 75 * 1000000 * 1000000000 75000000000000000 # Energy/sec over hashes/sec gives energy/hash in joules. >>> float(1) / _ 1.3333333333333333e-17 # Energy to find a collision. >>> _*(1<<128) 4.537098225612513e+21 That's roughly "estimated energy contained in the world's natural gas reserves as of 2010": http://en.wikipedia.org/wiki/Orders_of_magnitude_(energy) http://en.wikipedia.org/wiki/Orders_of_magnitude_(energy) or ten years of "total world annual energy consumption in 2010".

by myhf 12y ago

pushedx 12y ago

I've mounted a growing suspicion that Bitcoin was developed to create a need for SHA-256 ASICs. Well, here they are, and it's much easier to brute-force a SHA-256 hash collision than it was 5 years ago. In fact you can compute billions of hashes per second for less than the cost of a PC.

deleted 12y ago
[deleted]
gwillen 12y ago
As an owner of a Bitcoin ASIC, I don't _think_ they're usable for general SHA-256. I think they're all specialized for SHA-256(SHA-256(X)), where X must be a packet in a bitcoin-specific format.
- cantfindmypass 12y ago
  Correct, they cannot compute SHA256() or SHA256(SHA256()) of arbitrary data.
  - pushedx 12y ago
    Well, I stand corrected. Especially in light of the analyses provided in sibling comments.

pbsd 12y ago

Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number of bit operations on SHA-256, but it must be at least 256 times 64 rounds. A collision attack costs approximately 2^128 evaluations, which gives us 256x64x7.92x10^-28x2^128 ~ 2^52 kHw for a collision. This is an extremely optimistic lower bound: the real cost would be many orders of magnitude higher. For comparison, the current global annual energy consumption is estimated to be ~2^47 kWh [2]. [1] https://en.wikipedia.org/wiki/Landauer's_principle https://en.wikipedia.org/wiki/Landauer's_principle [2] https://en.wikipedia.org/wiki/World_energy_consumption https://en.wikipedia.org/wiki/World_energy_consumption

agl 12y ago

Assuming that SHA-256 is sound, then the effort needed to find a collision is 2^128. However efficient your hardware is, multiplying the energy-per-hash by 2^128 results in an impossible number. Let's say that you have a magic device that computes the total, current Bitcoin hashing rate (75 million GH/s) with just a watt of power. # Total hashes per second >>> 75 * 1000000 * 1000000000 75000000000000000 # Energy/sec over hashes/sec gives energy/hash in joules. >>> float(1) / _ 1.3333333333333333e-17 # Energy to find a collision. >>> _*(1<<128) 4.537098225612513e+21 That's roughly "estimated energy contained in the world's natural gas reserves as of 2010": http://en.wikipedia.org/wiki/Orders_of_magnitude_(energy) http://en.wikipedia.org/wiki/Orders_of_magnitude_(energy) or ten years of "total world annual energy consumption in 2010".