{"type":"rich","version":"1.0","author_name":"npub1e46n428mcyfwznl7nlsf6d3s7rhlwm9x3cmkuqzt3emmdpadmkaqqjxmcu","author_url":"https://nostr.ae/npub1e46n428mcyfwznl7nlsf6d3s7rhlwm9x3cmkuqzt3emmdpadmkaqqjxmcu","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2016-01-08\n📝 Original message:Indeed, anything which uses P2SH is obviously vulnerable if there is an attack on RIPEMD160 which reduces it's security only marginally. While no one thought hard about these attacks when P2SH was designed, we realized later this was not such a good idea to reuse the structure from P2PKH. Hence why this discussion came up.\n\nOn January 7, 2016 7:30:11 PM PST, Rusty Russell via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003ePieter Wuille via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e\n\u003ewrites:\n\u003e\u003e Yes, this is what I worry about. We're constructing a 2-of-2 multisig\n\u003e\u003e escrow in a contract. I reveal my public key A, you do a 80-bit\n\u003esearch for\n\u003e\u003e B and C such that H(A and B) = H(B and C). You tell me your keys B,\n\u003eand I\n\u003e\u003e happily send to H(A and B), which you steal with H(B and C).\n\u003e\n\u003eFWIW, this attack would effect the current lightning-network\n\u003e\"deployable\n\u003elightning\" design at channel establishment; we reveal our pubkey in the\n\u003eopening packet (which is used to redeem a P2SH using normal 2of2).\n\u003e\n\u003eAt least you need to grind before replying (which will presumably time\n\u003eout), rather than being able to do it once the channel is open.\n\u003e\n\u003eWe could pre-commit by exchanging hashes of pubkeys first, but\n\u003econtracts\n\u003eon bitcoin are hard enough to get right that I'm reluctant to add more\n\u003ehoops.\n\u003e\n\u003eCheers,\n\u003eRusty.\n\u003e_______________________________________________\n\u003ebitcoin-dev mailing list\n\u003ebitcoin-dev at lists.linuxfoundation.org\n\u003ehttps://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev"}