Overview
A hash function is one of the most fundamental building blocks of Bitcoin's security model. It transforms any input data into a fixed-size output (called a hash or digest) in a way that is fast to compute, deterministic, and practically impossible to reverse. Bitcoin relies on cryptographic hash functions throughout its design -- from mining and block linking to address generation and Merkle trees.
Required Properties
A cryptographic hash function must satisfy several properties to be suitable for use in Bitcoin:
┌────────────────────────────────────────────────────────────┐
│ │
│ 1. DETERMINISTIC │
│ Same input → always same output │
│ │
│ 2. FAST COMPUTATION │
│ Hash can be computed quickly for any input │
│ │
│ 3. PRE-IMAGE RESISTANCE (one-way) │
│ Given hash H, cannot find input M such that hash(M)=H │
│ │
│ 4. SECOND PRE-IMAGE RESISTANCE │
│ Given input M1, cannot find M2≠M1 with same hash │
│ │
│ 5. COLLISION RESISTANCE │
│ Cannot find any M1≠M2 where hash(M1) = hash(M2) │
│ │
│ 6. AVALANCHE EFFECT │
│ Small change in input → drastically different output │
│ │
└────────────────────────────────────────────────────────────┘
Hash Functions in Bitcoin
SHA-256 (Secure Hash Algorithm 256-bit):
- Output: 256 bits (32 bytes)
- Used for: Mining (double-SHA-256), transaction IDs, Merkle trees, block hashes
- Bitcoin uses double-SHA-256 (applying SHA-256 twice) in many contexts for additional security
RIPEMD-160:
- Output: 160 bits (20 bytes)
- Used for: Address generation via HASH160 = RIPEMD-160(SHA-256(data))
- The shorter output produces more compact addresses
HMAC-SHA512:
- Used for: HD wallet key derivation (BIP32)
- Provides both hashing and message authentication
Example: Double SHA-256
Input: "bitcoin"
Step 1: SHA-256("bitcoin")
→ 6b88c087247aa2f07ee1c5956b8e1a9f4c7f892a70e324f1bb3d161e05ca107b
Step 2: SHA-256(result from step 1)
→ 5765a933a24a2c2c3ba710586e0cff3d0dfeb53c42e58b7e8e5f9a073e42a327
This double-hashing pattern is used for TXIDs and block hashes.
Why SHA-256 Was Chosen
Satoshi Nakamoto chose SHA-256 for several reasons:
- Well-analyzed by the cryptographic community at the time of Bitcoin's creation
- Part of the SHA-2 family designed by the NSA, with no known practical weaknesses
- 256-bit output provides a security level of 128 bits against collision attacks
- Efficient to implement in both software and hardware
Common Misconceptions
- Hash functions are not encryption algorithms. They do not use keys, and there is no way to "decrypt" a hash to recover the original input.
- "SHA-256 was designed by the NSA" does not mean it has a backdoor. It has been extensively analyzed by independent cryptographers worldwide and remains considered secure.
- While SHA-256 is computationally fast, this is a feature for mining. The difficulty of mining comes from finding a specific hash output, not from the cost of computing a single hash.