Quote from: jonald_fyookball on May 02, 2017, 06:16:59 PM

Quote from: dinofelis on May 02, 2017, 06:03:09 PM

Quote from: tomtomtom7 on May 02, 2017, 03:26:12 PM

Quote from: BurtW on May 02, 2017, 02:31:59 PM

Did you see the final paragraph in this post?

https://bitcointalk.org/index.php?topic=1895455.msg18832108#msg18832108

I did, but didn't get it, but maybe I do now on rereading: We're talking about a collision of two P2SH addresses. That makes sense.

Yes, it took me some time to understand that too. The "lever arms" are a couple of private keys drawn from a set, that gives rise to a couple of public keys, to be combined with conditions (one is the counterparty's public key, the other is an own public key arbitrarily chosen of which one has the private key), giving rise to two P2SH hashes. One only needs to test on average a set of 2^80 private keys to find such a couple that has identical such P2SH hashes.
Note that it is somewhat more involved than just testing 2^80 private keys ; one needs to store somehow these results to find out what couple has a collision after the fact.

So once you do that, how does the attack work? How do you get the other party to use the compromised keys in the multisig?

The whole point is: you don't need a multisig to get paid out ! I didn't immediately realize this either, but the whole principle of bitcoin is that in order to have the "spending right" of an UTXO, you have to solve a puzzle of which the "question" hashes to the output address of that UTXO. In a simple transaction, that puzzle is "make a signature that corresponds to the public key that is this hash". In a 2-2 contract, however, that puzzle is whatever hashes to the given hash ; one such puzzle is the intended multisig: "make a signature that corresponds to the first public key, and make another signature that corresponds to the second public key".
But if you can find *another* puzzle description that hashes to the same hash, the solution to that other puzzle ALSO satisfies the spending requirement of that UTXO. That other puzzle has nothing to do with the first guy's public key.
You see, the explicit requirement is not present in the block chain: only its hash is. So whatever requirement that hashes to the same hash, can be considered as the "true requirement".

Compare it to the following situation: you buy a house, and instead of registering the whole act of sales, you only register its HASH with the notary. The notary knows that this house goes with that hash, that's all. So anyone that can write another act of sale, that hashes to the same hash, can act as the owner of the house, the notary will agree, and will let him sell the house while you don't even know it.

Now, the nasty thing with a double signature, is that the guy providing HIS signature has a lever on the true document, and is hence able to find a collision with a document entirely of his making. This is what reduces the 160 bit second-pre-image security to 80 bit collision security.