SHA-1 collision

[amaclin]

Sha-1 collision script fired.

https://tradeblock.com/bitcoin/tx/8d31992805518fd62daa3bdd2a5c4fd2cd3054c9b3dca1d78055e9528cff6adc

https://twitter.com/petertoddbtc/status/652102579959267328


decodescript 6e879169a77ca787
{
  "asm": "OP_2DUP OP_EQUAL OP_NOT OP_VERIFY OP_SHA1 OP_SWAP OP_SHA1 OP_EQUAL",
  "type": "nonstandard",
  "p2sh": "37k7toV1Nv4DfmQbmZ8KuZDQCYK9x5KpzP"
}

Code:

 {
    const QByteArray x1 ( QByteArray::fromHex ( "255044462d312e330a25e2e3cfd30a0a0a312030206f626a0a3c3c2f57696474682032203020522f4865696768742033203020522f547970652034203020522f537562747970652035203020522f46696c7465722036203020522f436f6c6f7253706163652037203020522f4c656e6774682038203020522f42697473506572436f6d706f6e656e7420383e3e0a73747265616d0affd8fffe00245348412d3120697320646561642121212121852fec092339759c39b1a1c63c4c97e1fffe017346dc9166b67e118f029ab621b2560ff9ca67cca8c7f85ba84c79030c2b3de218f86db3a90901d5df45c14f26fedfb3dc38e96ac22fe7bd728f0e45bce046d23c570feb141398bb552ef5a0a82be331fea48037b8b5d71f0e332edf93ac3500eb4ddc0decc1a864790c782c76215660dd309791d06bd0af3f98cda4bc4629b1" ) );
    const QByteArray x2 ( QByteArray::fromHex ( "255044462d312e330a25e2e3cfd30a0a0a312030206f626a0a3c3c2f57696474682032203020522f4865696768742033203020522f547970652034203020522f537562747970652035203020522f46696c7465722036203020522f436f6c6f7253706163652037203020522f4c656e6774682038203020522f42697473506572436f6d706f6e656e7420383e3e0a73747265616d0affd8fffe00245348412d3120697320646561642121212121852fec092339759c39b1a1c63c4c97e1fffe017f46dc93a6b67e013b029aaa1db2560b45ca67d688c7f84b8c4c791fe02b3df614f86db1690901c56b45c1530afedfb76038e972722fe7ad728f0e4904e046c230570fe9d41398abe12ef5bc942be33542a4802d98b5d70f2a332ec37fac3514e74ddc0f2cc1a874cd0c78305a21566461309789606bd0bf3f98cda8044629a1" ) );

    const MyKey32 hash1 ( MyKey32::sha1 ( x1 ) );
    const MyKey32 hash2 ( MyKey32::sha1 ( x2 ) );

    _trace ( hash1.toStringRev ( ) );
    _trace ( hash2.toStringRev ( ) );
    qDebug ( ) << "equals? " << ( hash1.toStringRev ( ) == hash2.toStringRev ( ) );
  }

output:

"f92d74e3874587aaf443d1db961d4e26dde13e9cffffffffa4d928013cda2800"
"f92d74e3874587aaf443d1db961d4e26dde13e9cffffffffa4d9280140da2800"
equals?  false

Update: of course, I was wrong.
SHA-1 is 160-bit function, not 256-bit

[jackjack]

You should ask 1EohDhHJT9byKsYhxp5zX6PNkuGhxoEu9r, looks like the guy managed to make it right

[amaclin]

My fault.
SHA-1 is not 256 bit function, but 160 bit
My code added some garbage to the end of digest