25

I know that a block is based on a random number called a nonce, but if that number is random and unknown to the miner, how is that number actually verified as the correct nonce and not some arbitrary number?

  • The nonce is public knowledge once a block is discovered. The number is available to the miner and the verifier. – Nayuki Jan 29 '16 at 6:37
38

Basically, there is no such thing as a "correct" nonce, only a set of possible "correct" blocks which can use any nonce they wish to obtain an acceptable hash. So the nonce is just "some arbitrary number". But in order to understand how nonces work, you first have to understand the hashing process by which blocks are produced.

Cryptographic hashes are a mathematical way of turning any set of data into a random number, called a hash. The hashing process is designed so that it's easy to calculate the hash of some data but nearly impossible to find data which will fit a specific hash, having even a slightly different set of data will produce a totally different hash, and so that the only way to find a hash with a particular property (say, being below a certain number) is to calculate lots of them until you get lucky.

In the Bitcoin network, only blocks with certain hashes get accepted and included in the official list. The criteria for which blocks "count" is that their hash has to be below a certain number called the target. The network adjusts this number up and down according to how frequently blocks are passing the test--this is how it's able to keep the rate of block production at an average of 10 minutes per block. So if the target is

00000692856290566183958127638592383846392938562929689273923968

then a block with a hash of

00000739485762992939239823472938472569106923385616929838472389

won't be accepted, but blocks with hashes of

00000683060299472046094517810601040976920106812102601296720934

00000000000000000000000000000000000000000000000000000000453737

or

00000692856290566183958127638592383846392938562929689273923967

will all pass with flying colours. These aren't real hashes--they're just examples.

A miner is taking a list of checked and valid transactions, putting them together in the right format, and then calculating their cryptographic hash. But let's say that the hash they get doesn't meet the criteria (as most of them don't). What are they supposed to do? The only way to get a different hash is to use at least slightly different data. So instead of messing up their list of valid transactions or anything like that, blocks have something called a nonce in them. The nonce is just a meaningless number that can be changed as many times as you like so that you can check a bunch of different hashes and see whether they pass the network's difficulty check. So when a miner is checking billions of hashes per second (as many of them are) they are just changing the nonce to something else, checking the hash of the whole block; changing the nonce to something else, checking the hash of the (now slightly different) block; changing the nonce again, etc.

In this sense a "correct" nonce is simply the one that allows the block to hash to an acceptable number. Just like there are many acceptable hashes, there are many different nonces which will work for the same block. But a miner only has to find one of them. Whichever one they find first is just fine.

You may also be interested in how the target is calculated.

  • 11
    In fact, because the nonce is only 32-bits, for most blocks, there is no valid nonce that will meet the difficulty. In that case, the miner does have to change the transaction set. Typically, the coinbase transaction is changed. (A meaningless field in the coinbase transaction is used as an 'extra' nonce.) – David Schwartz Sep 28 '11 at 18:36
  • 1
    I'm not sure how far back you mean, but at least as of 0.3.23, it would change the coinbase transaction if the nonce was exhausted. And, of course, all modern miners and mining pools do this. – David Schwartz Sep 28 '11 at 18:55
  • 2
    @eMansipater starting from the very first block at difficulty of one extra-nonce was used. With diffiuclty of 1 the odds of any particular hash meeting target is 1/(2^32). With only 2^32 nonce values there is a 36% chance for any given header NO nonce value will create a valid hash. That is at difficulty of 1. As difficulty rises the probability that no nonce in nonce range will make a valid hash only increases. – DeathAndTaxes Oct 13 '11 at 17:53
  • 1
    Very good answer! So, you can also say that the difficulty represents the amount of 0s which need to be at the beginning of the hash? – Kiril Jan 23 '15 at 17:26
  • 1
    Wow, great answer. One of the things I heard a lot when I started learning was "solving a really difficult problem" but not understanding what the problem was or why it was hard. This makes it clear what makes it "difficult" and that outside of this application, it's an essentially useless problem. – redOctober13 Jan 22 '16 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.