One of my friends is creating his own cryptocurrency, just as a fun project, and he made some design choices that I think are insecure, but I personally don't have enough expertise to evaluate.

Assuming we're considering an secp256k1 private/public key pair and a Bitcoin style address (just a hash of the pubkey), would it be feasible or even possible to attempt a birthday attack against this system if the hash (let's assume sha256 for this example) was truncated to a 14 byte output?

Bitcoin truncates to 20 bytes by running RIPEMD160 on top of sha256, which would put a birthday attack in the realm of 2^80 attempts, but if I understand correctly, a keypair could be generated corresponding to this 14 byte address in 2^56 operations, is that correct?


1 Answer 1


It is possible to find a collision for SHA-256 truncated to 14 bytes, using the method in Paul C. van Oorschot and Michael J. Wiener's Parallel Collision Search with Cryptanalytic Applications (in Journal of Cryptology, January 1999, Volume 12, Issue 1; free slightly earlier version available from the first author's website).

That requires about $2^{57}$ hashes (and little memory), which is extremely feasible nowadays. The cost when it is wanted collision among hashes of public keys with known private keys is higher, because we need $2^{57}$ EC-multiplication-and-hash; but that's still feasible.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.