Why do we use 2 hash functions (both SHA and RIPEMD) to create an address? Why not just use one hash function?


RIPEMD was used because it produces the shortest hashes whose uniqueness is still sufficiently assured. This allows Bitcoin addresses to be shorter.

SHA256 is used as well because Bitcoin's use of a hash of a public key might create unique weaknesses due to unexpected interactions between RIPEMD and ECDSA (the public key signature algorithm). Interposing an additional and very different hash operation between RIPEMD and ECDSA makes it almost inconceivable that there might be a way to find address collisions that is significantly easier than brute force trying a large number of secret keys.

Essentially, it was a belt and suspenders approach. Bitcoin had to do something unique and rather than have to hope they got it exactly right, they overdesigned it.

  • 2
    Do you have a reference to why SHA256 interacts (or is known/thought to interact) better than RIPEMD160 with ECDSA? Without any citations or underlying reasoning, I could argue the same thing: RIPEMD160 could have unexpected interactions with SHA256. Moreover, say RIPEMD160 was broken and only generated a set of 100 different hashes. Then it would be trivial to break this. Say SHA256 was broken instead. Then you'd be able to generate two keys that have the same hash (and some program may depend on that not being possible). If either SHA256 or RIPEMD160 is broken, so is this address scheme? Oct 28 '13 at 22:25
  • @HaroldR.Eason We know RIPEMD160 isn't broken in the way you suggest. The issue is whether it might be broken when used with ECDSA. But what Satoshi did is used SHA256+RIPEMD160 with ECDSA, which is much less likely to be broken. It's not that one interacts better than the other, it's that a flaw in the two of them composed seems almost impossible. Oct 28 '13 at 23:22
  • But if there's a break in SHA256 to generate collisions, then one could construct two addresses with the same hash, which makes bitcoin addresses no longer a real hash. It's plausible that some code would rely on the collision resistance property of bitcoin addresses in their code, though I don't know of any. Nov 4 '13 at 15:12

Except from Where is Double hashing performed in Bitcoin?

So why does he hash twice? I suspect it's in order to prevent length-extension attacks.

SHA-2, like all Merkle-Damgard hashes suffers from a property called "length-extension". This allows an attacker who knows H(x) to calculate H(x||y) without knowing x. This is usually not a problem, but there are some uses where it totally breaks the security. The most relevant example is using H(k||m) as MAC, where an attacker can easily calculate a MAC for m||m'. I don't think Bitcoin ever uses hashes in a way that would suffer from length extensions, but I guess Satoshi went with the safe choice of preventing it everywhere.

To avoid this property, Ferguson and Schneier suggested using SHA256d = SHA256(SHA256(x)) which avoids length-extension attacks. This construction has some minor weaknesses (not relevant to bitcoin), so I wouldn't recommend it for new protocols, and would use HMAC with constant key, or truncated SHA512 instead.

Answered by CodesInChaos

  • I will reformulate my question. RIPEMD is also used to create the address, my question is why do we use RIPEMD and SHA, why not to use only SHA?
    – anapaso
    Apr 5 '13 at 18:08
  • 2
    Right answer, but to a different question. ;) Apr 5 '13 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.