Topic: SHA-256 broken, collisions found... Bitcoin then? - page 3. (Read 17151 times)

I did not necessarily mean SHA256 would have to be broken, a flaw somewhere else in bitcoin or problems with scalability (or anywhere else) might one day make it more convenient or safe to adopt some changes to the protocol.

In general, everyone can mine the chain he wants to mine. If sha256 is "broken" ("easily collidable"), there is no sense to use ASIC. They are instantly worthless scrap because the sha256-fork can be "fake-mined" with no effort.

So that "pressure" you're talking about is like demanding noone was to mine any other chain. That's absurd.

There are two parties, those heavily invested in gpu mining and those who preordered and heavily invested in asic mining.
EDIT: Guess the asic manufacturers are sitting on a unpredictable risk when a algo change is seriously considered at anytime.

EDIT: Guess the asic manufacturers are sitting on a unpredictable risk when a algo change is seriously considered at anytime.

Ugh, no they can't. Since ASIC devices will be obsolete then. And if they are as expensive as today, well you can guess what happens then.

I think there will be pressure not to change the protocol even if such a need arises because so many people have invested in ASICs (and AFAIK in most cases those ASICs cannot be repurposed to do anything other than mine Bitcoins). I hope this does not kill Bitcoin one day.

Every world cryptographer has no reservations about SHA-224, SHA-256, SHA-384 or SHA-512, which is why a few of them including Bruce Schneier (who submitted Skein) thought the new SHA-3 standard wasn't necessary just yet, but NIST chose one anyways a month ago. http://csrc.nist.gov/groups/ST/hash/sha-3/winner_sha-3.html

I would assume bitcoin is fine, and they can probably go to SHA-3 whenever it needs to be done

SHA-1 is the problem http://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
"A collision attack is therefore well within the range of what an organized crime syndicate can practically budget by 2018, and a university research project by 2021"

SHA-256 does have a flaw:  I don't understand it.  If you cant explain it to me then it is too complicated.

nick@zero ~ $ echo "123" | sha256sum
181210f8f9c779c26da1d9b2075bde0127302ee0e3fca38c9a83f5b1dd8e5d3b  -
nick@zero ~ $ echo "124" | sha256sum
ca2ebdf97d7469496b1f4b78958f9dc8447efdcb623953fee7b6996b762f6fff  -
nick@zero ~ $ echo "125" | sha256sum
a5e45837a2959db847f7e67a915d0ecaddd47f943af2af5fa6453be497faabca  -
nick@zero ~ $ echo "verylongdatalongerthaneventhechecksumitselfjustaddingrandombitsnow9823480293849 20834092834029834029834028934092834" | sha256sum
3dff4001b5954d595b6d6b3a4ec3971c2eef82da397e6a81a514090052918ed7  -

nick@zero ~ $ for nonce in {0..999}; do echo $nonce x`echo $nonce | sha256sum`; done | grep x00
691 x0024839ec9632d382486ba7aac7e0bda3b4bda1d4bd79be9ae78e7e1e813ddd8 -
964 x00ae0900e3ba03583e3561d76de50754935c10913065d737f9cf4c8e86e54bda -
996 x009cbb4830299d01fc84a6a56d4f07707d7d073673f6cde576027bafbac75168 -

.. while persisting the blockchain db backups prior to the crash as hardcoded into the new fork.

The effect would be minor I think.

There are plans: The "important people" meet online and make overnight hard fork to some other hashing scheme.

2nd Question: how is Bitcoin network going to react? Are there already plans for this?

Catastrophic failure is far more likely to be caused by unnoticed bugs in the implementation. Bitcoin is phenomenally complicated and there are many subtle ways to break it.

Catastrophic breaks in hashes are pretty much unheard of these days.  What happens is that they get weaker gradually, with plenty of warning.  For example, MD5 is considered to be totally broken now, and should never be used.  On the other hand, if it was used in bitcoin transactions, those transactions would still be totally safe, for at least a few more years, because all of the attacks require conditions that can't be met in the bitcoin system.  As in, if we changed one of the NOPx opcodes to OP_LOL_CHECKMD5SIG which used MD5(MD5(key)) instead of RIPE-MD160(SHA256(key)), it would still take decades to crack, probably centuries.

And your estimate of how long a brute force attack on SHA-256 would take is wrong, it isn't centuries, it is billions and billions of years, minimum.  If you converted the entire mass of the sun into energy, and used all of that energy to increment a counter using the absolute limit of physics for minimum energy used to flip a bit, you'd get to around 2²²⁵.  You'd need 2³¹ suns of similar mass to finish just iterating through all of the possible inputs.  So, billions of stars, or trillions or quadrillions if you want to actually perform the hashes too.

There are no "plans" exactly, on what to do next, but it is widely understood that we can swap out the primitive operations when needed.  We might not be alive then, why should we presume that the people that will actually be doing the work want to follow our plans instead of making their own?