Take the 2-minute tour ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

If not, what else would be needed to steal all funds from all people and completely break bitcoin?

I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ECSDA is dependent on a hash function such as SHA256. So I will ask this as well: What kind of ECSDA does bitcoin use and would it still be protected if SHA256 were broken?

Yes, I know I am illustrating an unlikely scenario but I still believe we should know what will happen.

If you want to mention other hash functions in relation to SHA256, you can. Feel free to explain how RIPEMD-160 would keep bitcoin safe in case of a SHA256 exploit.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Bitcoin uses SHA256 followed by RIPEMD-160, which I'll collectively call HASH160.

Good hashes have 4 properties:

  1. it is easy to compute the hash value for any given message
  2. it is infeasible to generate a message that has a given hash
  3. it is infeasible to modify a message without changing the hash
  4. it is infeasible to find two different messages with the same hash

Source: Wikipedia

We care about properties 1, 2, and 3. We know for a fact that property 1 is true about HASH160 - we can benchmark it. If properties 2 or 3 were false, then you could steal bitcoins. Not good.

It's a good thing that the scripting language is so flexible, and would allow people to switch to a different address type without forcing everyone to upgrade.

This is a current bitcoin transaction script:

 OP_DUP OP_HASH160 09432ab39083b5098b6f09432ab39083b5098b6f OP_EQUALVERIFY OP_CHECKSIG

Here's how that might change if HASH160 were broken:

OP_DUP OP_HASH256 09432ab39083b5098b6f09432ab39083b5098b6f09432ab39083b5098b6f826496 OP_EQUALVERIFY OP_CHECKSIG

Note that we've swapped HASH160 for HASH256. Or, assuming both were broken:

<pubKey> OP_CHECKSIG

Now we're forgoing hash functions entirely and putting in the ECDSA key explicitly. However, this would make bitcoin addresses about a hundred characters long.

share|improve this answer
    
Could you elaborate on what would be necessary to "switch to a different address type" insofar as what users with bitcoins on the old address type would have to do to move over. Would everyone just have to create new addresses and move all their bitcoins? –  B T Nov 15 at 20:55
    
@BT Yes. The addresses would be much longer, though. –  Nick ODell Nov 15 at 20:56
    
Got it, cool. That doesn't sound so bad actually then. At least, not catastrophic. –  B T Nov 18 at 0:30

Nick's answer is very helpful, but might not be sufficient to get us (and BitCoin) in the clear. There may be a valid and grave concern based on the fact that crypto hashing functions aren't proven to satisfy constraints 2 and 3, so they potentially can be weak.

Even though people could switch away from a crypto hashing function to a better one, what would allow us to know for sure that someone isn't silently using the weakness of the hashing function to steal? Going undetected would allow you to leech from the bitcoin system, perhaps by getting a enormous share of mining rewards without expending nearly as much computing power. This kind of arbitrage could allow you to get rich off of every nerd who uses BitCoin (admittedly myself included) and some venture capitalists (I'm getting there ;) ). And since we're speculating, wouldn't it be convenient to tie develop a currency based on crypto if you want to get really rich. Obviously, exploiting it without removing its potential for growth and adoption...

If you know the exploit to SHA-256 and know how to leech off BTC and other crypto currencies, the altruistic and honorable thing to do is publish the exploit. The egocentric thing to do would be to abuse it.

I hope that someone will prove me wrong about this potential for abuse.

If not, it basically comes down to this: with great power comes great responsibility! Everybody says trust isn't needed with BitCoin. It STILL comes down to trust, but now trust that no one came up with this loophole or that the one who did isn't breaking the system more than it's contributing societal value.

I'd really have big respect for the person for choosing honor above personal gain. Unless you siphon the gains to a good cause, but even then I'm sure that a single person isn't best capable of handling those amounts of value. A crowd or even a market knows better how to allocate funds somewhat optimally.

share|improve this answer
    
If you knew an exploit to a major crypo algorithms like SHA256, you could sniff people's passwords through SSL, crack their back accounts and drain them of fiat in a swift weekend. I think bitcoin would be the least of the worlds concerns. –  Erik Aronesty Dec 23 '13 at 17:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.