<div dir="ltr"><div>Maybe I'm asking this question on the wrong mailing list:</div><div><br></div><div>Matt/Adam: do you have some reason to think that RIPEMD160 will be broken before SHA256?</div><div>And do you have some reason to think that they will be so broken that the nested hash construction RIPEMD160(SHA256()) will be vulnerable?</div><div><br></div><div>Adam: re: "where to stop" : I'm suggesting we stop exactly at the current status quo, where we use RIPEMD160 for P2SH and P2PKH.</div><div><br></div><div>Ethan: your algorithm will find two arbitrary values that collide. That isn't useful as an attack in the context we're talking about here (both of those values will be useless as coin destinations with overwhelming probability).</div><div><br></div><div>Dave: you described a first preimage attack, which is 2**160 cpu time and no storage.</div><div class="gmail_extra"><div><br></div><div><br></div>-- <br><div class="gmail_signature">--<br>Gavin Andresen<br></div>
</div></div>