Hacker News Reader

Comment by myhf | Hacker News Reader

This article talks about strength in terms of number of operations, but wouldn't it make more sense to think in terms of amount of energy? SHA-256 can be very cost-effective to mount a long-term collision attack against, given the existence of SHA-256 ASICs.

View on HN

Assuming that SHA-256 is sound, then the effort needed to find a collision is 2^128.

However efficient your hardware is, multiplying the energy-per-hash by 2^128 results in an impossible number.

Let's say that you have a magic device that computes the total, current Bitcoin hashing rate (75 million GH/s) with just a watt of power.

# Total hashes per second

>>> 75 * 1000000 * 1000000000

75000000000000000

# Energy/sec over hashes/sec gives energy/hash in joules.

>>> float(1) / _

1.3333333333333333e-17

# Energy to find a collision.

>>> _*(1<<128)

4.537098225612513e+21

That's roughly "estimated energy contained in the world's natural gas reserves as of 2010": http://en.wikipedia.org/wiki/Orders_of_magnitude_(energy) or ten years of "total world annual energy consumption in 2010".

Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number of bit operations on SHA-256, but it must be at least 256 times 64 rounds. A collision attack costs approximately 2^128 evaluations, which gives us 256x64x7.92x10^-28x2^128 ~ 2^52 kHw for a collision. This is an extremely optimistic lower bound: the real cost would be many orders of magnitude higher.

For comparison, the current global annual energy consumption is estimated to be ~2^47 kWh [2].

[1] https://en.wikipedia.org/wiki/Landauer's_principle

[2] https://en.wikipedia.org/wiki/World_energy_consumption

I've mounted a growing suspicion that Bitcoin was developed to create a need for SHA-256 ASICs. Well, here they are, and it's much easier to brute-force a SHA-256 hash collision than it was 5 years ago. In fact you can compute billions of hashes per second for less than the cost of a PC.

As an owner of a Bitcoin ASIC, I don't _think_ they're usable for general SHA-256. I think they're all specialized for SHA-256(SHA-256(X)), where X must be a packet in a bitcoin-specific format.

Correct, they cannot compute SHA256() or SHA256(SHA256()) of arbitrary data.

Well, I stand corrected. Especially in light of the analyses provided in sibling comments.

Reply on news.ycombinator.com