原始文献 / 论坛帖 / Re: Stealing Coins
Re: Stealing Coins
Bitcointalk · 2010-07-25 20:01:40 UTC
引用自：knightmb 于 July 25, 2010, 07:44:02 PM（https://bitcointalk.org/index.php?topic=571.msg5736#msg5736）
如果我算出公钥 123456 生成哈希 ABCD
而且
公钥 654321 也生成哈希 ABCD
我手里还是没有私钥。
但按你说的，我只需要公钥 654321，就能冒充公钥 123456 花币了。
你还是得用公钥 654321 去签名。你得找一个碰撞，用的公钥还得是你知道私钥的那个。
当你认领一笔付到比特币地址的交易时，你给出和哈希匹配的公钥，然后必须用那把密钥签名。
Red 的意思是，快速生成不安全的公钥很容易，找到碰撞之后你能破解出私钥。
他指出，如果要求公钥必须是安全的——必须经过大量工作找到质数才算——那强度就超过了哈希函数本身。想暴力破解的人，每尝试一次都得花时间生成一把密钥。
英文原文
Quote from: knightmb on July 25, 2010, 07:44:02 PM（https://bitcointalk.org/index.php?topic=571.msg5736#msg5736）
If I figure out that Public Key 123456 generates Hash ABCD
and
Public Key 654321 also generates Hash ABCD
I'm still left without the Private Key.
But from what you are saying, all I need is Public Key 654321 and I can spend coin pretending to be Public Key 123456.
You would still have to sign it with public key 654321. You need to find a collision using a public key for which you know the private key.
When you claim a Bitcoin Address transaction, you give your public key that matches the hash, then you must sign it with that key.
Red's point is that it's easy to quickly generate insecure public keys which you could break and find the private key after you find a collision.
He points out that if the public key was required to be a secure one, one which must have required significant work to find the prime numbers, that would increase the strength above that of the hash function alone. Someone trying to brute force would have to take time generating a key for each attempt.