Keccak256 of msg.sender and timestamp: what's the likelihood of an output coincidence?

Question

Let's think about this code:

function publishEtherBox (bytes32 _label, string _ownerUrl, uint _lifespan) external onlyWhenRunning() payable {
      require(ownerToEtherBoxes[msg.sender].length < 10);
      assert(bytes(_ownerUrl).length <= 200);
      address etherBoxAddress = address(keccak256(msg.sender, now));
      ownerToEtherBoxes[msg.sender].push(etherBoxAddress);
      etherBoxes[etherBoxAddress] = EtherBox({
        label: _label,
        owner: msg.sender,
        ownerUrl: _ownerUrl,
        expiration: now + _lifespan
      });
      emit EtherBoxPublished(msg.sender, nicknames[msg.sender], etherBoxAddress, _label, now);
      if(msg.value > 0){ owner.transfer(msg.value); }
  }

referring to the 4th line, it is obvious the it might lead to an output coincidence if multiple transactions from the same msg.sender are packed in the same block on the same timestamp. How to avoid that and what's the chance of getting the same behaviour using a proggressive nonce instead of now?

Answer 1

If the same account calls this function twice in the same block, the odds are 100% that keccak256(msg.sender, now) will return the same value.

If you hash a nonce that increases each time publishEtherBox is called, the odds of a collision are approximately 0%. You're taking 20 bytes of the hash output, which is what Ethereum itself uses to generate accounts. The math shows that it's almost impossible to generate a duplicate account, and thus it's almost impossible for your etherBoxAddress to be a duplicate if you use a nonce.