Imagine an attacker implementing something like the following pseudocode on the fastest ASIC farm money can buy:
attack(blockchain, my_address)
addresses = generate_tree_of_all_nonempty_addresses(blockchain)
while true:
private_key = generate_random_private_key()
public_key = generate_public_key(private_key)
address = ripemd160(sha256(public_key))
if is_matched(address, addresses):
steal_bitcoins(private_key, public_key, address, my_address)
Given that RIPEMD-160 reduces addresses to a size of 160 bits (in binary form), and that there are (IIRC) over a million non-empty addresses out there, does it really still take an impractically long time to find collisions? I should be able to do the math myself, but I know some of you are better at that kind of thing than I am...
Or to put that another way, is it possible that the decision to hash public keys the way bitcoin does, might in the future turn out to be unwise given the heightened risk of collisions compared to simply using the full ECDSA public key length?