Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitTorrent v2 (2020)

blog.libtorrent.org

Post reply on HN
Print view View original

81–90 of 155 posts

Re: BitTorrent v2 (2020)

#81

Post by alophawen »

hannob wrote: post #39
alophawen wrote: post #27

Earlier quoted context omitted.

If you want to be reassured then sure. My take from reading that is in 2016 there was practical collision attacks demonstrated, which would be amplified with specialized hardware (compare to bitcoin mining). Btw cheers! I recall you from correspondence years ago regarding fuzz testing linux packages.

> My take from reading that is in 2016 there was practical collision attacks demonstrated No such thing happened. You're likely referring to this paper quoted in Wikipedia: https://eprint.iacr.org/2016/374.pdf This is 1. not about SHA256, but about the truncated sha2 algorithms and, more important, 2. it's an attack on reduced-round versions of these algorithms. That's a common thing in cryptoanalysis to do. You're b…

Absolutely, you are correct - the papers does not describe SHA256 as broken, but it is one step of many on the path for SHA256 to become broken in the future - which is in reply to your earlier comment:

> You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen

Re: BitTorrent v2 (2020)

#82

Post by EVa5I7bHFq9mnYK »

Stevvo wrote: post #58
dennis-tra wrote: post #12

I‘m wondering if they could avoid yet another breaking protocol change if SHA256 proves to be insecure (at some point in the future) if they made use of Multiformats [0]. At least IPFS went this way (Multiformats grew out of the IPFS development). [0] https://multiformats.io/

SHA1 collision was never much of a reason to change it in the first place; there is no practical attack that arises from it.

1) Take a popular game torrent 2) add crypto mining code 3) pad it so the SHA1 stays the same 4) seed it, the magnet links will pick up your version 5) profit!

Re: BitTorrent v2 (2020)

#84

Post by pimterry »

moolcool wrote: post #43

BitTorrent slaps so hard as a protocol, and DHTs are absolutely brilliant. With all of the recent hype about decentralization with the rise of crypto, I'm surprised BitTorrent hasn't seen much hype or revitalization as well.

To be fair, IPFS is a frequent player in the current hype, and is built on DHTs and obviously inspired by BitTorrent.

I think a major factor there is that IPFS supports pluggable transports, so it can easily be used in both backend and browsers environments directly, while WebTorrent (powered by WebRTC) can't directly communicate with most traditional BitTorrent clients (which use TCP/UDP directly) without going through a bridge node.

Re: BitTorrent v2 (2020)

#85

Post by cletus »

From a technical perspective, I love BitTorrent. I remember reading about it years ago and being amazed at the bandwidth efficiency and robustness it had. It still had some centralization (ie trackers) but they themselves could be duplicated (ie you could set up a tracker for an existing torrent).

The part that surprises me from reading this is the issues raised from moving from SHA1 to SHA256, specifically because that's 20 vs 32 bytes respectively. This has created compatibility issues.

The same thing happened with Git and it's a nightmare.

I honestly don't understand how this happens. We've gone through this many times for many years. Replacing your hash function should be built in from day one and for any project to come along in the 21st century and not do this is really gross negligence.

I really wonder how this happens. Like is it just hubris about how this hash function will be different? Or are engineers just so in love with the optimizations they get to make by assuming, say, 20 byte hashes? I really wish I knew.

Anyway, I'm a little sad BitTorrent only really found traction for pirating media. Whether you approve of that or not, it's still an astounding technical achievement.

Re: BitTorrent v2 (2020)

#86

Post by alonmln »

viktorelofsson wrote: post #9
kzrdude wrote: post #3

The wikipedia page doesn't say - do clients generally support this protocol now? https://en.wikipedia.org/wiki/Comparison_of_BitTorrent_clien...

BitTorrent v2 has been officially supported in PicoTorrent since the same date as the featured blog post from libtorrent :)

I just love PicoTorrent! It's exactly what I want from a Torrent client. Thanks!

Re: BitTorrent v2 (2020)

#87

Post by otterley »

hannob wrote: post #25
alophawen wrote: post #22

Earlier quoted context omitted.

There's nothing unlikely with such scenario. See MD5, SHA1 and so on. See current research on SHA256 https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida... https://dusted.codes/sha-256-is-not-a-secure-password-hashin... https://security.stackexchange.com/questions/34256/sha256-se...

The Wikipedia link is very reassuring regarding the security of SHA256. All attacks are very far away from going anywhere close to attacking full SHA256 and no major progress has been made lately. The password hashing remark is correct, but irrelevant. SHA256 is not a good password hash, because it's not made to be a password hash. Don't use it for passwords. The weaknesses that broke MD5/SHA1 were known since 1994.…

I’m not a cryptographer. Why isn’t SHA256 good as a password hash? Can you explain? And what’s a better alternative, and why?

Re: BitTorrent v2 (2020)

#88

Post by toomuchtodo »

banana_giraffe wrote: post #65
sitkack wrote: post #55

Earlier quoted context omitted.

Do you make visualizations of the traffic?

Some different views. For instance, to give some sense of a scale for the 250 or so v2 torrents seen every day is, here's a view of the total number of torrents it discovers each day [1]. (Or, more properly, this is the number of torrents it gathered complete metadata and validated against the infohash each day). One of these days I should find somewhere to put all these bits of metadata I've been downloading. [1] ht…

Consider creating a collection at the Internet Archive for these data sets.

Re: BitTorrent v2 (2020)

#89

Post by tinaprice »

cletus wrote: post #85

From a technical perspective, I love BitTorrent. I remember reading about it years ago and being amazed at the bandwidth efficiency and robustness it had. It still had some centralization (ie trackers) but they themselves could be duplicated (ie you could set up a tracker for an existing torrent). The part that surprises me from reading this is the issues raised from moving from SHA1 to SHA256, specifically because t…

I totally agree with this one, it just gained traction because of the pirating scene.

Re: BitTorrent v2 (2020)

#90

Post by dest »

pimterry wrote: post #84
moolcool wrote: post #43

BitTorrent slaps so hard as a protocol, and DHTs are absolutely brilliant. With all of the recent hype about decentralization with the rise of crypto, I'm surprised BitTorrent hasn't seen much hype or revitalization as well.

To be fair, IPFS is a frequent player in the current hype, and is built on DHTs and obviously inspired by BitTorrent. I think a major factor there is that IPFS supports pluggable transports, so it can easily be used in both backend and browsers environments directly, while WebTorrent (powered by WebRTC) can't directly communicate with most traditional BitTorrent clients (which use TCP/UDP directly) without going thro…

don't many traditional clients support webtorrent as well? https://feross.org/libtorrent-webtorrent/
Post reply on HN