BEP 30: Merkle hash torrent extension • Hacker News Board

Re: BEP 30: Merkle hash torrent extension

#11

Post by im3w1l » Mon, Feb 02, 2015, 2:50 AM UTC

JeremyBanks wrote: post #8

andrewchambers wrote: post #2

Isn't this how git works? I would have thought bit torrent did this all along.

Not exactly. Git uses per-file, per-commit, and per-directory hashes. It does make up a sort of hash tree, but the tree does not descend within a given file. You need to hash the entire file and determine its hash to know if any of the pieces you have are valid. This would be a problem for large files if many of those pieces come from untrusted sources -- you'd have to spend a lot of time/bandwidth downloading invali…

>The minimum data transfer in ideal circumstances is increased by log(N)

There should be roughly as many internal nodes as there are leaves, so there is a linear space increase. As the leaves are much bigger than the internal nodes, the linear factor is small.

Re: BEP 30: Merkle hash torrent extension

#12

Post by amluto » Mon, Feb 02, 2015, 3:03 AM UTC

I think it's sad that they're using SHA-1 for this. SHA-1 is a bit weak, and the hashes are too short. There's a reason that SHA-1 is deprecated for X.509 certificates.

At the very least, this should use SHA-256.

If they really did it right, though, the protocol would use a secure tree hash. The construction they're using has trivial collisions, which are only avoided because the size of the file comes from a trusted source. A good hash (e.g. the Sakura construction) doesn't have this problem. Fixing that would make the resulting torrent files or URLs a bit shorter, as the size could potentially be omitted.

Re: BEP 30: Merkle hash torrent extension

#13

Post by gojomo » Mon, Feb 02, 2015, 3:32 AM UTC

edonkey wrote: post #9

"Large torrent files put a strain on the Web servers distributing them". Finally! bittorrent designers are acknowledging the centralized deficiency in the torrent protocol and implementing Merkle / root hash distribution model, as eDonkey / eMule used since 2000's: https://en.wikipedia.org/wiki/Ed2k_URI_scheme#eD2k_hash_algo... 15 years later, everything old is new again.

ED2K was kind of a degenerate Merkle tree: large chunks (9.5 MiB) and only one level of leaves, all under the root.

Thus it didn't have some of the benefits of a full tree that this 2009 Bittorrent spec was hoping to achieve, such as verifying smaller-sized chunks without a metadata-cost that grows linearly with the size of the full resource.

(AFAIK, the 1st application of multi-level Merkle trees to P2P filesharing was the TigerTree hash I wrote up with Justin Chapweske in 2002. At first glance, it looks like this proposal makes the same mistake we did in our first draft, not distinguishing between leaf and node hashes, corrected in the final TigerTree spec version of March 2003.)

Re: BEP 30: Merkle hash torrent extension

#14

Post by mox1 » Mon, Feb 02, 2015, 3:59 AM UTC

amluto wrote: post #12

I think it's sad that they're using SHA-1 for this. SHA-1 is a bit weak, and the hashes are too short. There's a reason that SHA-1 is deprecated for X.509 certificates. At the very least, this should use SHA-256. If they really did it right, though, the protocol would use a secure tree hash. The construction they're using has trivial collisions, which are only avoided because the size of the file comes from a trusted…

Are you serious?

Realistically, these are bits of a video stream, not your bitcoin wallet or some other bits where security it of the upmost concern. Were talking millions of dollars of equipment to find a collision in SHA1 today....

How exactly is a 160 bit hash too short? Collisions can be had after 2^80 trys in naive scenario and 2^57.5 with an active attacker, not exactly easy...

Re: BEP 30: Merkle hash torrent extension

#15

Post by amluto » Mon, Feb 02, 2015, 4:28 AM UTC

mox1 wrote: post #14

amluto wrote: post #12

I think it's sad that they're using SHA-1 for this. SHA-1 is a bit weak, and the hashes are too short. There's a reason that SHA-1 is deprecated for X.509 certificates. At the very least, this should use SHA-256. If they really did it right, though, the protocol would use a secure tree hash. The construction they're using has trivial collisions, which are only avoided because the size of the file comes from a trusted…

Are you serious? Realistically, these are bits of a video stream, not your bitcoin wallet or some other bits where security it of the upmost concern. Were talking millions of dollars of equipment to find a collision in SHA1 today.... How exactly is a 160 bit hash too short? Collisions can be had after 2^80 trys in naive scenario and 2^57.5 with an active attacker, not exactly easy...

Torrents can be, and often are, executable. Many Linux distributions are available over Bittorrent, for example.

Breaking crypto, especially new crypto, should pass a much higher bar than "not exactly easy". 2^57.5 is not all that large by the standards of a big cloud provider or a government.

Re: BEP 30: Merkle hash torrent extension

#16

Post by mox1 » Mon, Feb 02, 2015, 4:34 AM UTC

amluto wrote: post #15

mox1 wrote: post #14

Earlier quoted context omitted.

Are you serious? Realistically, these are bits of a video stream, not your bitcoin wallet or some other bits where security it of the upmost concern. Were talking millions of dollars of equipment to find a collision in SHA1 today.... How exactly is a 160 bit hash too short? Collisions can be had after 2^80 trys in naive scenario and 2^57.5 with an active attacker, not exactly easy...

Torrents can be, and often are, executable. Many Linux distributions are available over Bittorrent, for example. Breaking crypto, especially new crypto, should pass a much higher bar than "not exactly easy". 2^57.5 is not all that large by the standards of a big cloud provider or a government.

Again "not exactly easy" today will cost you > $1 MILLION dollars, you are greatly exaggerating the actual problem.

If you have millions of dollars to spend and want to commit digital crimes, there are better methods than flipping bits in torrents......

Re: BEP 30: Merkle hash torrent extension

#17

Post by JeremyBanks » Mon, Feb 02, 2015, 4:35 AM UTC

gojomo wrote: post #13

edonkey wrote: post #9

"Large torrent files put a strain on the Web servers distributing them". Finally! bittorrent designers are acknowledging the centralized deficiency in the torrent protocol and implementing Merkle / root hash distribution model, as eDonkey / eMule used since 2000's: https://en.wikipedia.org/wiki/Ed2k_URI_scheme#eD2k_hash_algo... 15 years later, everything old is new again.

ED2K was kind of a degenerate Merkle tree: large chunks (9.5 MiB) and only one level of leaves, all under the root. Thus it didn't have some of the benefits of a full tree that this 2009 Bittorrent spec was hoping to achieve, such as verifying smaller-sized chunks without a metadata-cost that grows linearly with the size of the full resource. (AFAIK, the 1st application of multi-level Merkle trees to P2P filesharing…

Based on http://crypto.stackexchange.com/a/2108/342: BEP-30 should be safe. On its own, that root hash may be vulnerable to length-extension collisions. However, the root hash is never provided alone. It's included with the length in the torrent's infohash, preventing length-extension.

Re: BEP 30: Merkle hash torrent extension

#18

Post by beagle3 » Mon, Feb 02, 2015, 5:47 AM UTC

andrewchambers wrote: post #2

Isn't this how git works? I would have thought bit torrent did this all along.

git's smallest unit is a file - if your repostiory has one 3GB file, that's what is going to be hashed.

but bup[0] does so within a git repository to make incremental backup more efficient.

[0] https://github.com/bup/bup

Re: BEP 30: Merkle hash torrent extension

#19

Post by wereHamster » Mon, Feb 02, 2015, 5:52 AM UTC

mox1 wrote: post #16

amluto wrote: post #15

Earlier quoted context omitted.

Torrents can be, and often are, executable. Many Linux distributions are available over Bittorrent, for example. Breaking crypto, especially new crypto, should pass a much higher bar than "not exactly easy". 2^57.5 is not all that large by the standards of a big cloud provider or a government.

Again "not exactly easy" today will cost you > $1 MILLION dollars, you are greatly exaggerating the actual problem. If you have millions of dollars to spend and want to commit digital crimes, there are better methods than flipping bits in torrents......

$1 million today, at the cost of the average PC in a couple years. Think of the future.

Re: BEP 30: Merkle hash torrent extension

#20

Post by adamzochowski » Mon, Feb 02, 2015, 6:37 AM UTC

gojomo wrote: post #13

edonkey wrote: post #9

"Large torrent files put a strain on the Web servers distributing them". Finally! bittorrent designers are acknowledging the centralized deficiency in the torrent protocol and implementing Merkle / root hash distribution model, as eDonkey / eMule used since 2000's: https://en.wikipedia.org/wiki/Ed2k_URI_scheme#eD2k_hash_algo... 15 years later, everything old is new again.

ED2K was kind of a degenerate Merkle tree: large chunks (9.5 MiB) and only one level of leaves, all under the root. Thus it didn't have some of the benefits of a full tree that this 2009 Bittorrent spec was hoping to achieve, such as verifying smaller-sized chunks without a metadata-cost that grows linearly with the size of the full resource. (AFAIK, the 1st application of multi-level Merkle trees to P2P filesharing…

edonkey has two methods of file verification. The ED2K hash as you have mentioned. However, around 2004, edonkey world also received nicer AICH hashes. People that generate ed2k style links are encouraged to make include the

To recap:

ICH : inteligent corruption hash : also known as the old original ed2k method. Root hash is md4 and is generated from a series of md4 hashes generated for 9.5mb chunks. If a file is below 9.5mb then ed2k root hash is just the real md4 hash.

AICH : Advanced inteligent corruption hash : is a full Merkle tree using SHA1, where chunks are 180kb (with exception of a chunk on the 9.5MiB boundary). This weird part/chunking allows to map 53 of these AICH chunks perfectly into the ed2k chunks.