The design of Bitcoin allows computers to compute a hash with 2 iterations of the SHA256 compression function instead of 3 on all but 1 out of every 2^32 attempts.

When Satoshi chose SHA256d for Bitcoin, did he intend to allow this?

1 Answer 1


I think Satoshi was not aware that the hashing routine could be optimized by the use of a midstate when he first created bitcoin.

If you look here, you can see that the first version of bitcoin that had the midstate optimization built into the miner was version 0.3.5 (it says 0.3.6 in the post, but you can see where someone quoted him that the post first read 0.3.5). He also says that it was implemented by someone called tcatm.

Also in 0.3.6, faster hashing:

- midstate cache optimisation thanks to tcatm

Satoshi mentions tcatm again here when trying to encourage people to upgrade to 0.3.8 by telling them they will get a better hash rate.

It's possible he knew it was possible and just didn't have time to implement it, I guess we'll probably never know for certain. But Gavin Andresen gave a talk on what Satoshi didn't know, and he speculated that Satoshi wasn't a very advanced cryptographer, based on some of the decisions made in bitcoin. As such, he may not have known about the inner workings of the hash function he selected, but just that SHA256d was regarded as a secure hash function.

EDIT: This may be the original post where tcatm proposed the midstate hashing optimization: https://bitcointalk.org/index.php?topic=648.0.

  • 2
    In this commit, Satoshi refers to it as "tcatm's [...] idea," so I think you're correct. However, I can't find anything he's written that says so explicitly.
    – Nick ODell
    Mar 27, 2015 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.