Is bitcoin mining itself compromising the security of SHA256

Question

Following good scientific practice I propose a Theory/Hypothesis and now ask you to test it.

Initially this is a "thought" experiment but may progress to real testing depending on your thoughts. Back to the initial question first; My question: Is bitcoin mining itself compromising the security of SHA256?

Possible answers:

1. Yes (maybe qualified by "in some way" ,etc).
2. No (Not at all because...xxx ,Not unless...YYY).
3. Maybe (??).

The hypothesis is this:

SHA256 is extensively used in many applications (including Bitcoin). It would be of great advantage for many persons, organisations and (not least) governments/military/NSA (etc) to be able to "crack" it.

Cryptographic experts have so far failed to crack SHA256 and only a small number of defects (possible collision scenarios) have been declared which although reducing the theoretical security (of a brute force attack) do not compromise SHA256 in practical use.

SHA256 look up tables exist for e.g. dictionary attacks and are very fast to use particularly for shorter passwords (<8 character). To extend the possibility of using look up tables for longer inputs a huge amount of computing power is needed to run many Terra inputs through SHA256.

This power is impractical to set up and run (cost of hardware, manpower, etc) and if it were set up e.g. by NSA using a super-computer it existence would be apparent and therefore usage of SHA256 would decline as it would be assumed that they wouldn't do that unless they thought they would get a result so users of SHA256 would migrate to a more secure system (e.g. SHA3 series). Therefore what NSA (or whoever) need is a "covert" way of "testing/running" SHA256 and gathering the results.

Is bitcoin mining with its daily 4000+ TH/s power, funded and manned entirely by users of the hardware hoping to gain Bitcoins (and hoping they are worth some real $$) really performing a service for the NSA (or someone) and effectively "hiding in plain sight"?

Methods of testing this hypothesis are invited.

Answer 1

With a look up table you can avoid calculating the hash of a given input twice. Indeed, the block chain can be considered as a giant look up table, but one with very special forms of inputs: It links blocks and transactions to their hashes.

Though, why should someone choose a transaction or block as her password? Further, why would an attacker even try to look up a hash of a password in the block chain? He would have to assume in advance that the password is a transaction or a block (don't forget that even looking something up consumes some resources).

Answer 2

Hardly. Whilst you are correct that what people are doing is a massively parallel search for double-SHA256 hash collisions to hash outputs near zero, you can only take advantage of the result if you actually find a collision.

So how often can we get a collision? If it were not for Bitcoin, with 2^256 possible inputs and the hash believed to not have any weaknesses, you'd statistically expect you have to try 2^128 or about 10^38 hashes to find a single collision in what is called a birthday attack. Hopeless today and tomorrow.

With Bitcoin, you might hope to take advantage of hashes that miners found and published in the blockchain. There are two problems: First of all, you only see these published blocks, so the advantage goes into having helpers to reduce the 2^256 possibilities, not the square root of the resulting number (the expected number of known hashes you need for a birthday attack). But for the sake of the argument, let us say you are the miners and record every hash you try. Then all that Bitcoin gives you is some reward for running your machine, currently with about 6000 Tera hashes per second. With such computing, you will still, statistically, need >10^15 years to get a single hash collision. I'd say there is zero danger to double-SHA256 from this (and, by the same argument, SHA256 which you could attack by recording the intermediate single-SHA256 results).

Answer 3

Theoretical answer: yes and no.

Practical answer: not at all.

---

SHA-2, or specifically SHA-256, is a good hashing algorithm as far as we know. It has all the properties desired and there are no real attacks on it. It has already been battle-tested a lot in the past years. That Bitcoin uses SHA-256 makes it an even more interesting algorithm to try to crack (there is 'money' behind it now), and with all the ASIC producers popping up it becomes less work to also create ASICs that try to crack passwords hashed with this.

So with all the extra attention SHA-256 gets, it is now more likely that flaws are found rather sooner than later. However, SHA-2 is a very widely used algorithm as it is, regardless of its use in Bitcoin. If there were any great and obvious flaws, they would have been found already.

It can be compared with RSA, which now powers many of today's financial transactions and encrypted connections. That too draws a lot of attention to it, but good algorithms don't become bad just because they are in the picture.

So while all the extra ASIC production for Bitcoin mining may also provide for better password cracking tools and brings more people to look at the algorithm, this is no practical problem. Also, you should not use SHA-2 directly as a password hashing mechanism anyway. For that, see this question: https://security.stackexchange.com/q/211/10863

Edit: Read your question more thoroughly now instead of responding to the title.

Is bitcoin mining with its daily 4000+ TH/s power, funded and manned entirely by users of the hardware hoping to gain Bitcoins (and hoping they are worth some real $$) really performing a service for the NSA (or someone) and effectively "hiding in plain sight"?

No. That's just tinfoil hattery and not even worth the "thought experiment" (nice try, conspiracy theorist) since it can readily be disproved. See other answers about what we're hashing (hint: we're not finding hashes for actual passwords or other purposes).

Answer 4

Regardless of any conspiracy theory. The fact that ASIC machines are now commercially available (both hardware and completed systems) makes it easier for any agency to buy them and use them. In my opinion, this does compromise SHA-256.