Hacker News Reader

Comment by jl6 | Hacker News Reader

Could obsolete Bitcoin ASICs be used to mount any sort of attack on SHA-256? There’s a huge, huge amount of SHA-256 going on in Bitcoin at the moment - does the ASIC become useless once it is no longer used for Bitcoin, or could it be made to compute SHA-256 for some other nefarious purpose?

View on HN

Nope. No plausible amount of computational power that works in any way known to modern science will directly break SHA256.

Even a quantum computer?

I always assume security is worse than the most effective known attack, but IIRC it’s currently thought to be safe against quantum computers: https://eprint.iacr.org/2016/992

2^166 ~= give a separate quantum computer that does as many QOPS as the the most powerful supercomputer does FLOPS to each human who has ever lived and have each of them run for a thousand times the age of the universe.

It reduces the strength of SHA256 to that of SHA128, roughly speaking. 2^128 is still outside any practical reach whatsoever. (Google breaking SHA-1 after cryptanalysis still required some 2^60 operations iirc).

IIRC, a quantum computer reduces preimage attacks (first or second) to the difficulty of collision attacks, but doesn't improve collision beyond the best classical attacks, which can be run on faster and cheaper hardware. It also may or may not benefit from any cryptanalysis applicable to collision attacks. So if you're secure against (classical) collision attacks, you don't need to worry about quantum attacks (collision or preimage).

The main reason that asymmetric (RSA, eliptic curves) encryption are broken (on quantum computers) is simply due to relying on certain assumptions that haven't been fully proven (and instead has been disproven over time).

Symmetric and one-way functions are provably secure, within those characteristics that they define. Notably, they are not designed with "until the end of the universe" promise (and the only proven "until the end of the universe" encryption anyway is a proper one-time pad (or disk) encryption). The reason that certain hashing and encryption algorithms have been broken are due to both compromises inherent in design goals (notably, AES have been simplified from the reference encryption Rjindael to ease up hardware acceleration) and the march of technology simply rolling with faster chips. Quantum computing can speedup this process a bit (a quadratic speedup in most cases), but not enough to outbeat these types of encryption.

The march of technology has done essentially nothing to weaken AES against direct attacks. AES, of course, has not been broken the way SHA-1 and MD5 were.

even if that did happen in the far future, there are quantum proof encryption methods

My understanding is that one-way functions are not broken by quantum computers.

My understanding is that in the general case you can see a quadratic speedup, so a 256-bit search space would suddenly collapse to what is effectively a 128-bit search space.

Not a big deal by itself.

Bitcoin's hashcash PoW is not a 256-bit search problem though. At current difficulty levels, it's closer to an 86-bit problem, so Grover's algorithm reduces that to the equivalent of a 43 bit search space.

Depends on the function.

But not sha256, no. I think you'd almost have to design it to be vulnerable, if you want that.

Ask Grover, google it

No, it can't. World uses single round of SHA-256. Bitcoin uses two rounds of SHA-256 for PoW. Since Bitcoin ASICs hardware is optimized really really hard, they are simply incapable of doing a single round SHA-256.

IMHO this design decision was a great call.

EDIT: I'm amazed that for 12 hours nobody could point to that well-known fact. NH crowd really knows little about cryptocurrencies.

If it took 12 hours to get pointed out, it's probably not a well known fact.

The collisions that ASICS search for are a few leading zeros, even with the whole Bitcoin network at your disposal I don’t expect it’s practical to find an exact 256bit collision.

3Blue1Brown has a convincing visualization of the size of 2^256.

How secure is 256 bit security? https://www.youtube.com/watch?v=S9JGmA5_unY

From my understanding, the hardware tends to be burn out faster than it becomes obsolete. So those "obsolete" ASICs aren't reliable enough to do any work anymore.

If there becomes a surplus of power-inefficient hashing gear that is no longer profitable to operate, and the aggregate capability of that "dark" hashing power grows significant compared to the online hashrate, it could be used to carry out a 51% attack. But since ASIC efficiency gains are due to increasing hashrates (with roughly constant power density), this seems unlikely.

Reply on news.ycombinator.com