This question on crypto.SE describes how preimage attacks are avoided in the Bitcoin network.
For a second preimage attack:
hash(x) = hash(y)
implieshash(hash(x)) = hash(hash(y))
So it wouldn't protect against a direct preimage attack. Bitcoin builds a Merkle tree for
a b c
like this:hash(hash(hash(a)+hash(b))+hash(hash(c)+hash(c)))
.You can see again that if someone found a
c'
that has the same SHA-256 hash asc
, they could substitute it and the final result would still be the same.While it's true that this might improve resistance to first preimage attacks, there aren't any obvious cases where those would matter -- an attacker typically would have the plaintext that generated the hash. (And preimage attacks on addresses seem far fetched, given that the ECDSA operation is in there.)
Suppose two offline transactions are generated with the same c'
hash. Assume it takes several months/years to create each Tx. Then:
- The attacker creates a Tx to a merchant
- The attacker creates a second Tx with the same inputs as #1. Then a private key is regenerated until the Tx hash equals the hash of c'.
Question
How does the Bitcoin network respond to these competing transactions with the same hash?
How would the outcome be different if the transaction was non-standard, and therefore not replicated across miners?