回复：盗取比特币
原始发布页
打开来源页面查看 1 个交叉存档
引用
这里有一篇论文，声称能用 2^52 次密码学运算找到 SHA-1 碰撞。而一个具有最优安全性的哈希需要 2^80 次运算。2^52 所需的时间仍然很长，但已经进入集群和僵尸网络的能力范围。
如果你能使用生日攻击，才是 2^80。这里无法使用生日攻击，所以难度是完整的 2^160 位。不过，如果你试图破解 100 万（2^20）笔交易中的任意一笔，就可以进行部分生日攻击：2^160/2^20 = 2^140。
比特币地址是唯一使用 160 位哈希的地方。其他一切都使用 SHA-256。它们的计算方式是：
bitcoinaddress = RIPEMD-160(SHA-256(publickey))
如果我错了，请纠正我（真的，我会很乐意认错），但我认为在这种情况下很难对 RIPEMD-160 使用分析攻击。分析攻击会指定一段特定范围或模式的输入来尝试，从而大幅提高找到碰撞的概率。而在这里，你无法对 RIPEMD-160 的输入进行那样的控制，因为它的输入是 SHA-256 的输出。如果分析攻击帮助你找到一个能让 RIPEMD-160 产生碰撞的输入，你又能拿它怎么办？你仍然必须让 SHA-256 输出那个值，所以你还是也得攻破 SHA-256。
对于暴力破解，RIPEMD-160(SHA-256(x)) 并不比单独的 RIPEMD-160 更强。但对于分析攻击，似乎必须同时对 RIPEMD-160 和 SHA-256 进行分析攻击。如果我错了，那么其强度就与 RIPEMD-160 相同，而 SHA-256 只是起到一轮密钥强化的作用。
英文原文
展开英文原文
Quote
Here is a paper that claims to find SHA-1 collisions in 2^52 crypto operations. And optimally secure hash would take 2^80 operations. 2^52 time is still large, but it is getting into cluster and botnet range.
2^80 is if you can use a birthday attack. You can't use a birthday attack for this, so the difficulty is the full 2^160 bits. Although, if you were trying to crack any one of 1 million (2^20) transactions, you could do a partial birthday attack 2^160/2^20 = 2^140.
Bitcoin Addresses are the only place where 160-bit hash is used. Everything else is SHA-256. They're calculated as:
bitcoinaddress = RIPEMD-160(SHA-256(publickey))
Correct me if I'm wrong (please, and I'll gladly eat crow) but I think it would be hard to use an analytical attack on RIPEMD-160 in this case. An analytical attack prescribes a certain range or pattern of inputs to try that will greatly increase your chance of finding a collision. Here, you don't have that kind of control over RIPEMD-160's input, because the input is the output of SHA-256. If an analytical attack helps you find an input to RIPEMD-160 that produces a collision, what are you going to do with it? You still have to get SHA-256 to output that value, so you would still have to break SHA-256 too.
For brute force, RIPEMD-160(SHA-256(x)) is no stronger than RIPEMD-160 alone. But for analytical attack, it seems like you must analytical attack both RIPEMD-160 and SHA-256. If I'm wrong, then the strength is the same as RIPEMD-160 and the SHA-256 only serves as one round of key strengthening.