4

Why is it acceptable to use a 20 byte hash to represent single-sig witness programs whereas a 32 byte hash is used for pay to witness script hash?

Improve this question

1 Answer 1

Reset to default
1

As per this post by Gregory Maxwell, HASH160 provides enough security for the trivial case of public key hash based addresses, whereas script hash addresses can benefit from the additional protection against collisions provided by a longer hash.

The rest of the thread covers more details of the benefits of moving to sha256.

Improve this answer
2
  • The strength of cryptographic hash is at best half that of the smallest hash of a cascaded chain of hash functions. Hence, a Hash160 (sha256 | ripemd160) is only good for at most 80 bits of uniqueness. This means there is huge set of different private keys with public keys that can be hashed to the same address, a private key to public address birthday attack if you will.
    – skaht
    Dec 14, 2019 at 21:34
  • 1
    @skaht Yes, but that's for collision attacks. For preimage attacks it's equal to the size of the smallest hash in the chain. Collision attacks are only a concern when you're jointly constructing an address with someone else (who you don't trust).
    – Pieter Wuille
    Dec 15, 2019 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.