<p>A simple Google search for eb271cbcc2340d0b0e6212903e29f22e578ff69b will reveal the preimage to you.</p>

CC BY-SA 3.0
2017-08-28T21:04:49.970Z
Thanks. I didn't try that, and you're right, it does give the answer. My interpretation of the question was that there was something wrong in the formation of the script, or the notion of information hiding via hashes. For instance, if Alice chose a pre-image that isn't trivially dictionary attacked.

Perhaps I was over-thinking it.
biff pumpkin
CC BY-SA 3.0
2017-08-28T19:14:46.303Z
2017-08-28T19:14:46.303Z
Pieter Wuille
<p>I'm independently working my way through an excellent online course on bitcoin, made available from Stanford.  (<a href="https://crypto.stanford.edu/cs251" rel="nofollow noreferrer">https://crypto.stanford.edu/cs251</a>).</p>

<p>One of the problems in the homework challenges the student to create a scripSig that redeems an output locked with a simple SHA1 equality check:</p>

<blockquote>
  <p>Alice is on a backpacking trip and is worried about her devices containing
  private keys getting stolen. So she would like to store her bitcoins in such a way that they can
  be redeemed via knowledge of only a password. Accordingly, she stores them in the following
  ScriptPubKey address:</p>
  
  <p>OP_SHA1
  &lt;0xeb271cbcc2340d0b0e6212903e29f22e578ff69b>
  OP_EQUAL </p>
  
  <p>a. Write a ScriptSig script that will successfully redeem this transaction. [Hint: it should
  only be one line long.]</p>
</blockquote>

<p>While I understand why this is a terrible way to go about storing your coins, I can't come up with a 1 line scriptSig to redeem the funds without knowing the pre-image. </p>

<p>Granted any relaying node could just redirect the transaction output to themselves, after you give up the pre-image, but that doesn't seem to be what is being asked.</p>

CC BY-SA 3.0
2017-08-28T19:20:07.580Z
The title of your question seems unrelated to the actual question (are you asking why it is insecure - something you answer yourself, or how to solve the homework problem)?
Pieter Wuille
CC BY-SA 3.0
2017-08-28T21:09:12.363Z
I was interested in the 1 line solution to the problem, which I suspected would reveal a blind spot in my understanding of bitcoin's scripting language or the locking mechanism mechanism. Thanks for taking time to provide the answer.
biff pumpkin
<security><script><input-script>
Why is using a simple SHA1 in a scriptPubKey to emulate a "password" a security problem?
biff pumpkin
# Why is using a simple SHA1 in a scriptPubKey to emulate a "password" a security problem?

(Asked by: username_0 on 2017-08-28)

I'm independently working my way through an excellent online course on bitcoin, made available from Stanford. (<https://crypto.stanford.edu/cs251>).

One of the problems in the homework challenges the student to create a scripSig that redeems an output locked with a simple SHA1 equality check:

> Alice is on a backpacking trip and is worried about her devices containing
> private keys getting stolen. So she would like to store her bitcoins in such a way that they can
> be redeemed via knowledge of only a password. Accordingly, she stores them in the following
> ScriptPubKey address:
>
> OP\_SHA1
> <0xeb271cbcc2340d0b0e6212903e29f22e578ff69b>
> OP\_EQUAL
>
> a. Write a ScriptSig script that will successfully redeem this transaction. [Hint: it should
> only be one line long.]

While I understand why this is a terrible way to go about storing your coins, I can't come up with a 1 line scriptSig to redeem the funds without knowing the pre-image.

Granted any relaying node could just redirect the transaction output to themselves, after you give up the pre-image, but that doesn't seem to be what is being asked.

**Tags:** security, script, input-script

> **Comments:**
> **username_1**: The title of your question seems unrelated to the actual question (are you asking why it is insecure - something you answer yourself, or how to solve the homework problem)?  
> **username_0**: I was interested in the 1 line solution to the problem, which I suspected would reveal a blind spot in my understanding of bitcoin's scripting language or the locking mechanism mechanism. Thanks for taking time to provide the answer.  

---

## 1 answers

### Answer by username_1 on 2017-08-28. Score: 2 | Accepted answer

A simple Google search for eb271cbcc2340d0b0e6212903e29f22e578ff69b will reveal the preimage to you.

> **Comments:**
> **username_0**: Thanks. I didn't try that, and you're right, it does give the answer. My interpretation of the question was that there was something wrong in the formation of the script, or the notion of information hiding via hashes. For instance, if Alice chose a pre-image that isn't trivially dictionary attacked.  Perhaps I was over-thinking it.  

---

