Someone private messaged me to check out HeavyCoin.
Sorry I realize this post will make people angry at me. I am usually the messenger who brings technical reality which is usually bad news because most coin developers are not competent.
Thanks for your post. It's actually very good to discuss these details.
Innovations and contributions
- HEFTY1 - a cryptographic hash function for CPU-only proof-of-work with a small memory footprint
Insufficient technical details. From what I read about their claim of SIMD as an issue. I think they fail to understand the nature of the GPU advantage.
You've not given any details or reasons for coming to this conclusion.
- Ultra-secure hashing - a secure strategy for using multiple cryptographic hash functions
From the Github page:
Q: Doesn't Quarkcoin already implement multiple cryptographic hash functions?
A: Yes, but without increasing security against collisions. Quarkcoin (and its many clones) actually implement multiple hash functions as a simple chain of function compositions
Quark(x) = ... SKEIN512(KECCAK512( ... BMW512(BLAKE512(x))))
where ... contains additional hash function compositions using JH-512, Keccak-512, BMW-512, BLAKE-512, SKEIN-512 or Grøestl-512, which are randomly selected based on the 4th bit of previous hash outputs.
The problem is that, due to Quarkcoin's simple use of function compositions, if BLAKE512(x) has collisions, then so does BMW512(BLAKE512(x)) and SKEIN512(KECCAK512(... and so on, until we reach Quark(x), which also has collisions. Similarly, if SKEIN-512 or Grøestl-512 have collisions, then so does Quark(x). Simply put, if there's a collision attack or second-preimage attack for BLAKE-512(x), then Quark(x) is cracked.
Bullshit. Changing even one input bit to a hash should randomize all the output bits. Cracking any combinations of the hashes in the chain of hashes does not increase the risk of collisions for those in the chain that were not cracked.
This kind of silly mistake proves the developers are technically incompetent.
Of course changing one bit should randomize the output of a cryptographic hash function. That's a well known property of any secure cryptographic hash function, but your reference to this fact doesn't have anything to do with our statement.
Quark's multi-hashing strategy is to chain functions together. It is known that chaining functions together, eg. H1(H2(...(Hn(x)))), does not improve collision resistance. A collision in Hn(x) trivially leads to a collision in the entire chain. This is algebraically visible in the definition of the chained function.
If this is still unclear, then consider a simple example. Suppose we have a combined cryptographic hash function F composed of a chain of two cryptographic hash functions H1 and H2.
F(x) = H1(H2(x))
We will show that a collision in H2 leads to a collision in F.
First, assume we have a collision in H2. Thus, by definition, we have two blocks w and x such that H2(w) = H2(x) = y. Thus, we have
F(w) = H1(H2(w)) and F(x) = H1(H2(x)),
which is equal to
F(w) = H1(y) and F(x) = H1(y).
Uh-oh, H1(y) = H1(y) = z, so we have
F(w) = z and F(x) = z.
So
F(w) = F(x) = z.
Thus, for inputs w and x the chained function F also collides. This is true for any collision in H2 and any length chain of functions.
So chaining functions together does nothing for collisions. What else can be done? One approach is to concatenate the outputs, interleave the bits and trim it down to 256-bits. There's plenty of accessible info on this topic available, for example
Guarding against cryptanalytic breakthroughs: combining multiple hash functionsWhereas their "improvement" is worse in the sense that it takes 3 cracks to make it very insecure and 2 cracks to make it perhaps insecure, whereas with Quark it takes 4 cracks.
Q: How does Heavycoin implement multiple cryptographic hash functions?
A: Heavycoin takes 64 bits from the output of each of 4 well-known cryptographic hash functions (SHA-256, Keccak-512, Grøestl-512 and BLAKE-512) and interleaves these bits into a combined 256-bit hash that is more resistant against collisions and second-preimage attacks.
Hope you realize that 2^64 is crackable with a server farm. If 3 of the 4 are cracked, then the 4th is useless in Heavy's design.
So if 192-bits of SHA256 are cracked, then SHA-256 is also useless. What outcome is more likely due to advances in cryptanalysis over the next 10 years? Will it be that SHA-256 is weakened OR will it be that 3 out of 4 of SHA-256, Keccak-512, Grøestl-512 and BLAKE-512 are weakened? We think the prior is more likely.
As you know, there are often tradeoffs in security. For example, if you desire resistance to preimage attacks, then you might trade some resistance to collision attacks, or vice versa. Heavycoin's overall approach is "not to put all the eggs in the same basket" in terms of collisions and second-preimage resistance. Other models could prioritize other security properties.
It's widely accepted that the collision resistance of cryptographic hash functions changes over time as cryptanalysis improves, the so-called
Lifetime of cryptographic hash functions. Also, some fear that entities (eg. NSA) could have more knowledge, control and influence over cryptographic advances than expected. As an example, the US government certainly does fund quiet a bit of research carried out in academia. Also, the Snowden leaks seem to indicate the NSA has acted to influence the design of weaker cryptography. These point are debatable, and there are too many annoying conspiracy theorists. Regardless, our philosophy is to treat everything with (a reasonable amount of) suspicion, even algorithms and practices that are currently considered to be "safe". Thus, let's not rely on a single cryptographic hash function.
In terms of combining cryptographic hash functions, there doesn't seem to be perfect solution. Nevertheless, Heavycoin tries to adopt a sensible method with the hope of "slowing down" the weakening of its hash algorithms over time (see Lifetime... above). There is a
prophetic post by Satoshi on this topic, where he speaks about what could be done if a "hash breakdown came gradually". Heavycoin's philosophy is to try to increase the likelihood that such a "breakdown" would be as gradual as possible. There are different ways to achieve this goal, but there is no perfect solution and each has different advantages and disadvantages. Heavycoin has chosen a concatenation/interleaving approach, whereas Quark has selected a function chaining approach.
