Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-06-04 Thread Melvin Carvalho
On 3 June 2013 19:20, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 06/03/2013 08:04 AM, Melvin Carvalho wrote: Bitcoin is essentially a ledger where you have an array of fingerprints (160 bit hashes of a public key) and a value (number of coins in wallet). i thought that bitcoin

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-06-03 Thread Melvin Carvalho
On 1 April 2013 19:46, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 04/01/2013 12:24 PM, adrelanos wrote: gpg uses only(?) 40 chars for the fingerprint. (I mean the output of: gpg --fingerprint --keyid-format long.) this is a 160-bit SHA-1 digest of the public key material and the

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-06-03 Thread Daniel Kahn Gillmor
On 06/03/2013 08:04 AM, Melvin Carvalho wrote: Bitcoin is essentially a ledger where you have an array of fingerprints (160 bit hashes of a public key) and a value (number of coins in wallet). i thought that bitcoin didn't hash the public keys at all, but rather used the full elliptic curve

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-02 Thread Robert J. Hansen
On 04/02/2013 03:08 AM, Niels Laukens wrote: If you're running a computer at 3.2K (ambient universe temperature, anything below that would require additional energy to cool it), a bit-flip requires 4.41E-23 Joules of energy. Off by a factor of ln 2 there, chief. :) Required energy to destroy

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread Daniel Kahn Gillmor
On 04/01/2013 12:24 PM, adrelanos wrote: gpg uses only(?) 40 chars for the fingerprint. (I mean the output of: gpg --fingerprint --keyid-format long.) this is a 160-bit SHA-1 digest of the public key material and the creation date, with a bit of boilerplate for formatting. This is not

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread Robert J. Hansen
On 04/01/2013 12:24 PM, adrelanos wrote: How difficult, i.e. how much computing power and time is required to create a key, which matches the very same fingerprint? Isn't 40 chars a bit weak? (Nothing I am writing here is sarcastic or non-factual.) At present, the only way to do a preimage

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread Robert J. Hansen
On 04/01/2013 01:46 PM, Daniel Kahn Gillmor wrote: Predicting computing power or the state of mathematics itself 100 or 1000 years into the future seems like a dubious proposition. Yes and no. We're not going to get around the Margolus-Levitin limit (you can't flip a bitstate in faster than

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread David Tomaschik
On Mon, Apr 1, 2013 at 10:46 AM, Daniel Kahn Gillmor d...@fifthhorseman.netwrote: On 04/01/2013 12:24 PM, adrelanos wrote: gpg uses only(?) 40 chars for the fingerprint. (I mean the output of: gpg --fingerprint --keyid-format long.) this is a 160-bit SHA-1 digest of the public key

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread David Tomaschik
On Mon, Apr 1, 2013 at 3:38 PM, Melvin Carvalho melvincarva...@gmail.comwrote: On 1 April 2013 22:50, David Tomaschik da...@systemoverlord.com wrote: On Mon, Apr 1, 2013 at 10:46 AM, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 04/01/2013 12:24 PM, adrelanos wrote: gpg uses

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

2013-04-01 Thread Robert J. Hansen
On 4/1/2013 6:38 PM, Melvin Carvalho wrote: differential path attack. On 8 November 2010, he claimed he had a fully working near-collision attack against full SHA-1 working with an estimated complexity equivalent to 257.5 SHA-1 compressions. He estimates this attack can be extended to a full