Cryptocurrency serving as hash breaking?

Question

There are many people mining for Bitcoin right this second.^{[Citation needed]}

Bitcoin's proof-of-work mining system is based on a hash function (SHA-256, I believe), and there are ASICs built specifically for mining this.

Would it be possible to engineer a cryptocurrency such that the calculations of the mining process could be used to break hashed passwords? Without the miners knowing?

And, assuming a worldwide mining community approximately equivalent to Bitcoin's and with dedicated hardware for the purpose, would this be a feasible way of breaking hashed passwords?

Answer 1

Maybe

First let's say what you got correct:

• ASIC is indeed used to mine, and mining is more or less calculating SHA-256 over and over (password hashing schemes use some things to make it somewhat harder for ASICs, but this won't be problem here - miners will use whats best).
• If large-enough mining community formed, breakage of passwords could be eased.

However, there would be some problems that could prevent acceptability of such cryptocurrency:

• It won't be possible to make it really without knowledge of miners, or at least some suspicions: To claim that you found block X, you would need to publish what password it was. It would be highly suspicious that some solution would be "Password123" "admin1" etc.
• You would need database of passwords to break. Normally, this is done by some kind of mathematical rule. You instead would publish a large database and claim it is random. This again would be suspicious. And if you allowed yourself to add more hashes to database, then it would be suspicious, as you had a way to easily mine any amount of this cryptocurrency for yourself (you can generate password, upload it and then immediately solve it yourself - you can however put that aside when you pay for blocks).

So in the end, it doesn't look that easy, but if people somehow didn't realize these red flags, it should be fairly easy to do (not including trust problems - only one cryptocurrency is widely-accepted so far - bitcoin). Also, if some password was really strong, whole bitcoin mining processing power won't help you - it just will be far too hard.

Answer 2

Note that for this answer I'm not going into details whether it would be picked up by anybody but rather only whether it's technically possible.

---

First we need to understand how a cryptocurrency works, especially the mining process and the blockchain. In Bitcoin, the mining process is essentially finding a number such that $\operatorname{SHA-256}(\text{HashOfLastBlock}\parallel\text{SomeOtherContent}\parallel \text{Nonce})\leq k$ for some difficulty $k$. The first one to find a nonce that satisfies this inequality publishes the next block and gets a bitcoin reward. Also the $k$ value gets adjusted every couple of thousand blocks so that mining always takes a roughly equal amount of time.

As you can see the beauty of the system lies in its simplicity and the easy adaptability to a given difficulty level. Now what you'd have to do is to replace this proof-of-work (ie finding the nonce) with something that instead revolves around breaking a password hash. The fact that this new system would be useable to break password hashes wouldn't be hideable by the way. Now what is really hard in this scheme (along with finding an appropriate formula for the PoW) is the common sharing of the database of hashes (where is it stored? in which order should hashes be processed? who is allowed to update it? how to you prevent "poisoned" entries that are introduced by miners for an easy reward / to slow down the other miners?) to crack and the calculation of the reward for the miner breaking the password first (clearly some are easier to break than others). So in short my answer: yes it's technically possible but practical deployment will be hard. One example of the mining problem could be $H(\text{HashOfLastBlock}\parallel\text{SomeOtherInfo}\parallel\text{Hash}\parallel\text{PWHash})\leq k$ for some much smaller than bitcoin-level $k$.

Of course the protocol could allow for dynamically adjusting various parameters related to the hash function (with an adapted reward?) to match common password hashing schemes. However this would drastically decrease attractivity of the coin as ASICs need to be much more complex now to accomodate the various parameter choices which are sometimes specifically picked to make ASIC-based attacks expensive.

Answer 3

Well in theory the answer is of course yes, but:

• you'd probably be stuck with a particular hash;
• you would probably be stuck with some minimum amount of iterations;
• you'd explicitly have to build in some kind of check and that will probably be noticed;
• you'd have to sneak in the input and the output without anybody noticing (or you may have to buy a lot of hardware yourself of course);

And of course, if anything is found out, the community is very likely to slightly change both the protocol for the miner and the password hash that is being attacked.

Note that often the input of miners is very minimum, basically you just give it a command and wait until it returns the value. People will get a bit angry if they are not mining anything while you are finding other peoples passwords.

Very likely your scheme will not fly and if it does you probably have to fend off the persons from who you "stole" the money they were trying to make.

It seems easier to me to slightly alter the hardware of existing miner for your purposes. I would not be surprised if such a machine already exists.