Quote from: Nancarrow on December 17, 2013, 06:22:30 AM

Yawn. I've had the pdf of that paper on my laptop for a couple of years now. Keep rereading, trying to figure out what it's actually saying, every so often. Fascinating stuff but it's hardly 'breaking' SHA256, or even 41 out of 64 rounds of it.

If I understand correctly, they show how collisions can be found on their 'reduced' form of SHA256, in an amount of time that's only a fraction of brute-force time - they shave off a few powers of two, but still a huuuuuuge amount of time. There's an extension of this technique by Jian Guo and Krystian Matusiewicz, which must be downloadable from somewhere as I've got that on my HD too.

No u didn't this 24 rounds paper they reference is from 2012.

Quote from: coastermonger link=topic=https://bitcointalk.org/index.php?topic=373959.msg4002732#msg4002732

Don't tell me you're drawing conclusions from an article just by reading it's title and abstract. That's an absolute scientific no-no.

Link to full article: http://citeseerx.ist.psu.edu/viewdoc/download?rep=rep1&type=pdf&doi=10.1.1.215.5017

Quote

This
attack requires 2²⁴⁹ SHA-256 computation and 2¹⁶ · 10 words of memory

That's like 128 times better than brute force. Still billions of times longer than till heat death of universe.
Note that if they refine attack to something usable for type 0 Kardashev civilization we will have to change hash used in building Merkle tree, not POW so ASICs can stay as they are (at least until hashes get reaaaly low). Also I think that all altcoins use SHA256 for transactions.