SN-1646 已核对来源，附原文与上下文。
引用 · 发言者未注明这里有一篇论文声称能在 2^52 次密码运算内找到 SHA-1 碰撞。而一个最优安全的哈希需要 2^80 次运算。2^52 仍然很大，但已经进入集群和僵尸网络的射程。
Here is a paper that claims to find SHA-1 collisions in 2^52 crypto operations. And optimally secure hash would take 2^80 operations. 2^52 time is still large, but it is getting into cluster and botnet range.
2^80 是指能用生日攻击的情况。这里用不了生日攻击，因此难度是完整的 2^160 位。不过，如果你要攻击的是 100 万（2^20）笔交易中的任意一笔，可以做部分生日攻击：2^160/2^20 = 2^140。
2^80 is if you can use a birthday attack. You can't use a birthday attack for this, so the difficulty is the full 2^160 bits. Although, if you were trying to crack any one of 1 million (2^20) transactions, you could do a partial birthday attack 2^160/2^20 = 2^140.
比特币地址是唯一用到 160 位哈希的地方。其他一切都是 SHA-256。计算方式是：
Bitcoin Addresses are the only place where 160-bit hash is used. Everything else is SHA-256. They're calculated as:
bitcoinaddress = RIPEMD-160(SHA-256(publickey))
bitcoinaddress = RIPEMD-160(SHA-256(publickey))
如果我说错了请纠正我（拜托，我乐意认错），但我认为这种情况下对 RIPEMD-160 很难实施分析型攻击。分析型攻击会指定某个输入范围或模式去尝试，大幅提高找到碰撞的概率。而在这里，你对 RIPEMD-160 的输入没有这种控制力，因为输入是 SHA-256 的输出。如果分析型攻击帮你找到一个能产生碰撞的 RIPEMD-160 输入，你拿它怎么办？你还得让 SHA-256 输出那个值，因此你照样还得破解 SHA-256。
Correct me if I'm wrong (please, and I'll gladly eat crow) but I think it would be hard to use an analytical attack on RIPEMD-160 in this case. An analytical attack prescribes a certain range or pattern of inputs to try that will greatly increase your chance of finding a collision. Here, you don't have that kind of control over RIPEMD-160's input, because the input is the output of SHA-256. If an analytical attack helps you find an input to RIPEMD-160 that produces a collision, what are you going to do with it? You still have to get SHA-256 to output that value, so you would still have to break SHA-256 too.
对暴力破解而言，RIPEMD-160(SHA-256(x)) 并不比单独的 RIPEMD-160 更强。但对分析型攻击而言，似乎必须同时分析攻击 RIPEMD-160 和 SHA-256。如果我错了，那强度就等于 RIPEMD-160，SHA-256 只是充当一轮密钥加强而已。
For brute force, RIPEMD-160(SHA-256(x)) is no stronger than RIPEMD-160 alone. But for analytical attack, it seems like you must analytical attack both RIPEMD-160 and SHA-256. If I'm wrong, then the strength is the same as RIPEMD-160 and the SHA-256 only serves as one round of key strengthening.
