Quote from: prezbo on December 22, 2013, 07:57:03 AM

Quote from: MA5H3D on December 22, 2013, 01:26:38 AM

Compromised how?

This is an important question. Cryptography tends to get "cracked" step by step, it never goes from being secure to utterly and completely broken over night. If there's an indication of it having a weakness there is a lot of time to prepare.

This bears repeating and elaborating.

It's not like you go to bed and SHA256 is fine, and you wake up in the morning and it's broken. The chances of this happening to SHA256 are zero. The chances of this happening to anything written by you or I that hasn't been reviewed and examined by thousands of brilliant minds is pretty much guaranteed.

One day a researcher will publish a paper that shows that they can, say for example, drop the size of the brute-force keyspace for creating a collision by an order of magnitude or three. So instead of SHA256 being 2^256 strong, it will be "only" 2^252 strong.

Then someone else discovers another flaw that, say, allows them to partially recover the input based on a given hash, such that repeated hashing of messages that differ by a known amount allow an attacker to recover the original message.

In ways such as these, the strength of the algorithm is weakened over time. But the key point is that it happens over significant time - years. As soon as the first real dent is made in the strength of SHA256, we can begin discussing what should replace it, and how we move there.

Yes, mining hardware that utilises double-sha256 will be useless (although as was pointed out above, just because SHA256 is broken doesn't mean double-SHA256 is broken).

Such a move will take years. The first step would probably be to alter the Bitcoin protocol to allow a different hashing method. This hashing method would not be valid until the majority of miners and clients had moved to the protocol version that supports the new hash method. Then we enter the time of dual hashing. Old-style double-SHA256 hashes would be valid, but new style DERP512 hashes would also be equally valid. After enough time has passed, and enough blocks are mined using DERP512 instead of double-SHA256 (say, 10 to 1) then the network could cut over to only accept the new hashes, and the old miners would be retired. At least, that's one way to do it.