I don't understand "PUZZLE FRIENDLY". Here the definition I read:

A hash function h is puzzle friendly if for every possible N-bit output value y, if K is chosen from a distribution with high minentropy, then it is infeasible to find X such that H(K // X) = Y, in time significantly less then 2^N.

And here is what is tried when mining:


"If the hash function satisfies the puzzlefriendliness property, then the only way to succeed in solving this hash puzzle is to just try enough nonces one by one until you get lucky"

Ok, but what would be the problem if the hash function wasn't puzzlefriendly? I assume that nonce is K in the definition.

1 Answer 1


In the most straightforward terms: Given a hash function H, that takes some input X from the user, and produces output Y, a good 'puzzle friendly' algorithm will not show any pre-determinable correlation between input X and output Y. That is to say, you cannot select a certain X, with hopes of returning a certain Y.

In practice, the bitcoin network accepts a block hash that is lower than some value (determined by the current network difficulty). The user should not be able to select inputs based on any sort of expected output value, the entire rang of input values* should have an equal chance of returning the desired output.

Otherwise, the user could discriminate against input values within certain ranges, thus narrowing their search field, and increasing their chance of finding a valid output. This would break the function as it is required for a POW cryptocurrency, by allowing users to make 'educated guesses'. In such a broken system, the more 'educated' a guess is, the higher chance the output will be the desired value. So the more you understand the (broken) algorithm, the less resources you would have to spend in order to compute a valid block hash.

Contrast this to the 'ideal' case where every user guess is equally likely to create a valid output. This is what is desired, and what is being referred to as a 'puzzle friendly' here.

*Note: user input includes more than just the nonce value. All input values that the user can alter would be included, there is no functional difference between changing the nonce, or changing the transaction structure

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.