What are those and how do they compare to what we have today?
The standard transaction is "This coin can be spent by someone who signs the transaction with the private key that matches a public key that hashes to <hash>".
To spend that, you need to provide the public key and then sign it. Even if the signature algorithm was broken, those coins couldn't be spent, since the attacker wouldn't know the public key. This is one of the reasons why re-using addresses is a bad idea. Once you spend money from the address, you give away the public key.
The original transactions were "This coin can be spent by someone who signs the transactions with the private key that matches <some public key>". If the signature algorithm is broken, then those coins can be spent by the attacker, since he would know the public key.
The updated system requires the hashing function and the signing algorithm to be broken at around the same time.
interesting. i never knew that the original Bitcoin didn't involve Hash160's.
but doesn't this get back to the point i was making to you that pubkeys are in fact more moderately protected by unspent addresses, ie Hash160's, of those pubkeys?
furthermore, my original point was i'd love to see Peter erect a scripting challenge to hack an ECDSA-related problem that Schnier so blatantly highlighted.