8

If not, what else would be needed to steal all funds from all people and completely break bitcoin?

I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ECSDA is dependent on a hash function such as SHA256. So I will ask this as well: What kind of ECSDA does bitcoin use and would it still be protected if SHA256 were broken?

Yes, I know I am illustrating an unlikely scenario but I still believe we should know what will happen.

If you want to mention other hash functions in relation to SHA256, you can. Feel free to explain how RIPEMD-160 would keep bitcoin safe in case of a SHA256 exploit.

John Smith
  • 93
  • 1
  • 4

2 Answers2

7

Bitcoin uses SHA256 followed by RIPEMD-160, which I'll collectively call HASH160.

Good hashes have 4 properties:

  1. it is easy to compute the hash value for any given message
  2. it is infeasible to generate a message that has a given hash
  3. it is infeasible to modify a message without changing the hash
  4. it is infeasible to find two different messages with the same hash

Source: Wikipedia

We care about properties 1, 2, and 3. We know for a fact that property 1 is true about HASH160 - we can benchmark it. If properties 2 or 3 were false, then you could steal bitcoins. Not good.

It's a good thing that the scripting language is so flexible, and would allow people to switch to a different address type without forcing everyone to upgrade.

This is a current bitcoin transaction script: 

 OP_DUP OP_HASH160 09432ab39083b5098b6f09432ab39083b5098b6f OP_EQUALVERIFY OP_CHECKSIG

Here's how that might change if HASH160 were broken:

OP_DUP OP_HASH256 09432ab39083b5098b6f09432ab39083b5098b6f09432ab39083b5098b6f826496 OP_EQUALVERIFY OP_CHECKSIG

Note that we've swapped HASH160 for HASH256. Or, assuming both were broken:

<pubKey> OP_CHECKSIG

Now we're forgoing hash functions entirely and putting in the ECDSA key explicitly. However, this would make bitcoin addresses about a hundred characters long.

Nick ODell
  • 29,184
  • 11
  • 69
  • 129
  • Could you elaborate on what would be necessary to "switch to a different address type" insofar as what users with bitcoins on the old address type would have to do to move over. Would everyone just have to create new addresses and move all their bitcoins? – B T Nov 15 '14 at 20:55
  • @BT Yes. The addresses would be much longer, though. – Nick ODell Nov 15 '14 at 20:56
  • Got it, cool. That doesn't sound so bad actually then. At least, not catastrophic. – B T Nov 18 '14 at 00:30
  • To spend bitcoins, you need to have the corresponding private key. The bitcoin address is derived from the public key. If the hash function could be compromised regarding 2. one could reveal the public key. This would still require elliptic curve cryptography to fall apart before an attacker could steal your money. An attack to 3. does not help for a bitcoin address at all. Finally if 4. would be weakened it would still not really help as you would have to randomly generate key-pairs to find a collision. You can already do that now but chances are bigger to find alien life in universe. – Jörg May 26 '19 at 21:19
0

Nick's answer is very helpful, but might not be sufficient to get us (and BitCoin) in the clear. There may be a valid and grave concern based on the fact that crypto hashing functions aren't proven to satisfy constraints 2 and 3, so they potentially can be weak.

Even though people could switch away from a crypto hashing function to a better one, what would allow us to know for sure that someone isn't silently using the weakness of the hashing function to steal? Going undetected would allow you to leech from the bitcoin system, perhaps by getting a enormous share of mining rewards without expending nearly as much computing power. This kind of arbitrage could allow you to get rich off of every nerd who uses BitCoin (admittedly myself included) and some venture capitalists (I'm getting there ;) ). And since we're speculating, wouldn't it be convenient to tie develop a currency based on crypto if you want to get really rich. Obviously, exploiting it without removing its potential for growth and adoption...

If you know the exploit to SHA-256 and know how to leech off BTC and other crypto currencies, the altruistic and honorable thing to do is publish the exploit. The egocentric thing to do would be to abuse it.

I hope that someone will prove me wrong about this potential for abuse.

If not, it basically comes down to this: with great power comes great responsibility! Everybody says trust isn't needed with BitCoin. It STILL comes down to trust, but now trust that no one came up with this loophole or that the one who did isn't breaking the system more than it's contributing societal value.

I'd really have big respect for the person for choosing honor above personal gain. Unless you siphon the gains to a good cause, but even then I'm sure that a single person isn't best capable of handling those amounts of value. A crowd or even a market knows better how to allocate funds somewhat optimally.

D.H.
  • 5,297
  • 3
  • 32
  • 45
ErikDB
  • 11
  • If you knew an exploit to a major crypo algorithms like SHA256, you could sniff people's passwords through SSL, crack their back accounts and drain them of fiat in a swift weekend. I think bitcoin would be the least of the worlds concerns. – Erik Aronesty Dec 23 '13 at 17:45