BEP XXXX: BitTorrent Protocol Version 3.0

1. The piece_hashes Dictionary

A new key, piece_hashes, is added to the info dictionary. This allows a torrent to include high-security hashes in a flat format similar to the original protocol.

• Key: piece_hashes

• Value: A dictionary where keys are algorithm specifiers and values are the concatenated binary hashes for each piece.

• Algorithm Specifiers: Standard strings such as SHA2-256 or SHA3-256. Specifiers may include a bit-width (e.g., SHA3-256-32 for 32-bit truncation). The bit-width must be a multiple of 8.

2. The info_pow (Proof of Work)

To prevent an attacker from generating two different info dictionaries that result in the same SHA-1 info_hash, a Proof of Work is required.

• Key: info_pow

• Value: A dictionary where keys are algorithm specifiers and values are the found binary hash with nonce appended.

• Algorithm Specifiers: Standard strings such as SHA2-256 or SHA3-256 with a difficulty bit-width appended (e.g., SHA3-256-18 for 18 bits of leading zeros).

• Hash A hash of the base hash and the nonce. The base hash is of the entire BEncoded info dictionary, with all hash+nonce values within the info_pow key zeroed.

• Nonce This is the nonce that is concatenated to the base hash, which is then hashed again to produce the final hash, which must have adequate zero bits. The nonce can be any length, but generally 8 bytes is sufficient.

To generate:

1. Select algorithms and difficulty levels based on available CPU resources. A good choice is SHA3-256-20 as it will take under a second to compute on low-power hardware yet is strong enough to make finding collisions very impractical.

2. Write the info_pow entry into the info dictionary, with a value is a dictionary, containing algorithm specifiers as keys and zerod-out strings of correct length (hash width + 8 bytes of nonce) as values.

3. For each algorithm, calculate the base hash of the BEncoded info dictionary.

4. For each algorithm, calculate the hash of the base hash (in binary format) with nonce appended. Keep incrementing the nonce until the calculated hash has the required number of leading zero bits.

5. For each algorithm, fill in the hash+nonce value in its corresponding info_pow sub-key.

To verify:

1. Store, then zero out all hash+nonce values for each sub-key in the info_pow dictionary.

2. For each algorithm, hash the BEncoded info dictionary to create the base hash, append the specified nonce onto the base hash, then calculate the final hash.

3. Verify that the final hash matches the one specified, and that it has the required number of leading zero bits.

Collision Resistance

By adding piece_hashes, the protocol moves to multi-hash validation. An attacker attempting a SHA-1 collision for a file piece would simultaneously need to collide the modern hash (e.g., SHA3-256) provided in the piece_hashes map, which is computationally infeasible.

Even when using a truncated hash, such as SHA3-256-32, the collision resistance is substantially improved. To succeed, an attacker must find a data block that yields the identical 160-bit SHA-1 hash AND the identical 32-bit SHA-3 fragment. This "AND" constraint makes finding malicious collisions computationally impractical.

Targeted Info-Hash Attacks

The info_pow mechanism forces an attacker to spend significant CPU time for every attempt to spoof an info-hash. This makes brute-forcing a collision expensive for malicious actors while remaining trivial for legitimate creators to generate during the initial torrent creation.