<p>Bitcoin uses double hashing almost everywhere it hashes in one of two variants:</p>

<ul>
<li><p>RIPEMD160(SHA256(x)) called Hash160 which produces a 160 bit output</p>

<ul>
<li>hashing the public key to generate part of a Bitcoin addresses</li>
</ul></li>
<li><p>SHA256(SHA256(x)) called Hash256 which produces a 256 bit output</p>

<ul>
<li>generating the checksum in a Bitcoin address</li>
<li>hashing the block in a merkle tree</li>
<li>linking transaction outputs and inputs</li>
<li>hash of the block header (and thus the proof of work and the link to the previous block)</li>
</ul></li>
</ul>

<p>It seems like Satoshi chose Hash256 whenever collisions are a problem, and Hash160 when only (multi target) second pre-images matter. This is consistent with a goal of achieving 128 bits of security.</p>

<p>You need a 2*n bit hash to achieve n bit collision resistance, and you need a t*n bit hash to achieve n bit second pre-image resistance. If we assume a conservative 4 billion targets, and a 128 bit security level, this leads to 256 bit hashes for collision resistance and 160 bit hashes for multi-target second-preimages.</p>

<p>So why does he hash twice? I suspect it's in order to prevent length-extension attacks.</p>

<p>SHA-2, like all Merkle-Damgard hashes suffers from a property called "length-extension". This allows an attacker who knows H(x) to calculate H(x||y) without knowing x. This is usually not a problem, but there are some uses where it totally breaks the security. The most relevant example is using H(k||m) as MAC, where an attacker can easily calculate a MAC for m||m'. I don't think Bitcoin ever uses hashes in a way that would suffer from length extensions, but I guess Satoshi went with the safe choice of preventing it everywhere.</p>

<p>To avoid this property, Ferguson and Schneier suggested using SHA256d = SHA256(SHA256(x)) which avoids length-extension attacks. This construction has some minor weaknesses (not relevant to bitcoin), so I wouldn't recommend it for new protocols, and would use HMAC with constant key, or truncated SHA512 instead.</p>

<p>Some related reading:</p>

<ul>
<li><a href="https://crypto.stackexchange.com/questions/779/hashing-or-encrypting-twice-to-increase-security">Hashing or encrypting twice to increase security?</a> on crypto.SE</li>
<li><a href="https://bitcointalk.org/index.php?topic=45456.0" rel="noreferrer">Cryptographic reasoning for double-hash?</a> on bitcointalk</li>
</ul>

CC BY-SA 4.0
2022-02-22T10:35:51.307Z
My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the `RIPEMD160(SHA256)`.

My lengthy and elaborate rationale is in [my answer](https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565) on the related question.
Shelby Moore III
CC BY-SA 4.0
2013-03-18T08:51:38.157Z
2018-07-29T21:49:32.210Z
2018-07-29T21:49:32.210Z
CodesInChaos
<p>Here's the main hashing function:</p>

<pre><code>template&lt;typename T1&gt;
inline uint256 Hash(const T1 pbegin, const T1 pend)
{
    static unsigned char pblank[1];
    uint256 hash1;
    SHA256((pbegin == pend ? pblank : (unsigned char*)&amp;pbegin[0]), (pend - pbegin) * sizeof(pbegin[0]), (unsigned char*)&amp;hash1);
    uint256 hash2;
    SHA256((unsigned char*)&amp;hash1, sizeof(hash1), (unsigned char*)&amp;hash2);
    return hash2;
}
</code></pre>

<p>I'd say anyplace that calls that uses SHA256 twice.</p>

<p>As for why, <a href="https://bitcoin.stackexchange.com/questions/4317/why-does-bitcoin-use-two-rounds-of-sha256?rq=1">see this</a>.</p>

CC BY-SA 3.0
2013-03-17T18:24:03.107Z
2013-03-17T18:24:03.107Z
2017-04-13T12:47:33.610Z
Nick ODell
<p>We perform SHA-256d on extended RIPEMD-160 hash, running SHA-256 on it twice.
We take the first 4 bytes of our SHA-256d hash as our checksum, and append it to the
end of our extended RIPEMD-160 hash.
After converting the result to base58, we finally have our Bitcoin address.</p>

CC BY-SA 4.0
2020-08-03T01:35:48.950Z
2020-08-03T01:35:48.950Z
AlMayrink
<p>Bitcoin uses double hashing almost everywhere&gt;SHA256[SH256[X]]called Hash256 which produces a 160 bit out.Linking transaction outputs and inputs.Generating the checsum in a bitcoin address.Hashing the block in a merkle tree.</p>

CC BY-SA 4.0
2021-12-03T23:27:12.897Z
2021-12-03T23:27:12.897Z
PAUL ARISTHENE
<p>Hashing the block in a Merkle tree and with two rounds of SHA256 increases in security, so both function would have to be broken to undo the hash.</p>

CC BY-SA 4.0
2018-07-27T21:03:58.163Z
2018-07-27T21:03:58.163Z
johnny B. rivers
<p>I. To generate a Bitcoin address from an public key:</p>
<ol>
<li>run hash function SHA-256 on the key</li>
<li>run RIPEMD-160 on the key
This compresses address size to 160bits and is knows as &quot;double hashing&quot; (HASH160). This gives us the public key hash.</li>
<li>add a version byte in front of RIPEMD-160 hash and specify our network</li>
<li>Run a Base58check encode to obtain cheksum.</li>
<li>Run SHA-256 on RIPEMD-160 twice</li>
<li>Take first 4bytes of the SHA-256d hash as the checksum and add to end of the extended RIPEMD-160 hash</li>
<li>convert result to base 58 to obtain Bitcoin address</li>
</ol>
<p>II. To increase security by making SHA-256 tamper resistant
III. On message inputs and outputs</p>

CC BY-SA 4.0
2022-03-04T08:51:46.633Z
2022-03-04T08:51:46.633Z
user132813
<p>Senders specify a locking script and recipients specify an unlocking script. These stacked hashes confirm proof of work by the sending UTXO and legitimatecy of the recipient to receive the transaction. </p>

CC BY-SA 4.0
2018-08-13T00:30:18.977Z
This doesn't make sense and doesn't answer the question
meshcollider
CC BY-SA 4.0
2018-08-12T16:27:20.437Z
2018-08-12T16:27:20.437Z
Mkayhunt
<p>where in the Bitcoin Protocol is SHA256(SHA256(x)) performed and why?</p>

<protocol><hash><sha256>
Where is Double hashing performed in Bitcoin?
joe
# Where is Double hashing performed in Bitcoin?

(Asked by: username_0 on 2013-03-17)

where in the Bitcoin Protocol is SHA256(SHA256(x)) performed and why?

**Tags:** protocol, hash, sha256


---

## 7 answers

### Answer by username_1 on 2013-03-18. Score: 23

Bitcoin uses double hashing almost everywhere it hashes in one of two variants:

* RIPEMD160(SHA256(x)) called Hash160 which produces a 160 bit output

  + hashing the public key to generate part of a Bitcoin addresses
* SHA256(SHA256(x)) called Hash256 which produces a 256 bit output

  + generating the checksum in a Bitcoin address
  + hashing the block in a merkle tree
  + linking transaction outputs and inputs
  + hash of the block header (and thus the proof of work and the link to the previous block)

It seems like Satoshi chose Hash256 whenever collisions are a problem, and Hash160 when only (multi target) second pre-images matter. This is consistent with a goal of achieving 128 bits of security.

You need a 2\*n bit hash to achieve n bit collision resistance, and you need a t\*n bit hash to achieve n bit second pre-image resistance. If we assume a conservative 4 billion targets, and a 128 bit security level, this leads to 256 bit hashes for collision resistance and 160 bit hashes for multi-target second-preimages.

So why does he hash twice? I suspect it's in order to prevent length-extension attacks.

SHA-2, like all Merkle-Damgard hashes suffers from a property called "length-extension". This allows an attacker who knows H(x) to calculate H(x||y) without knowing x. This is usually not a problem, but there are some uses where it totally breaks the security. The most relevant example is using H(k||m) as MAC, where an attacker can easily calculate a MAC for m||m'. I don't think Bitcoin ever uses hashes in a way that would suffer from length extensions, but I guess Satoshi went with the safe choice of preventing it everywhere.

To avoid this property, Ferguson and Schneier suggested using SHA256d = SHA256(SHA256(x)) which avoids length-extension attacks. This construction has some minor weaknesses (not relevant to bitcoin), so I wouldn't recommend it for new protocols, and would use HMAC with constant key, or truncated SHA512 instead.

Some related reading:

* [Hashing or encrypting twice to increase security?](https://crypto.stackexchange.com/questions/779/hashing-or-encrypting-twice-to-increase-security) on crypto.SE
* [Cryptographic reasoning for double-hash?](https://bitcointalk.org/index.php?topic=45456.0) on bitcointalk

> **Comments:**
> **username_2**: My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the `RIPEMD160(SHA256)`.  My lengthy and elaborate rationale is in [my answer](https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565) on the related question.  

---

### Answer by username_3 on 2013-03-17. Score: 1

Here's the main hashing function:
template
inline uint256 Hash(const T1 pbegin, const T1 pend)
{
    static unsigned char pblank[1];
    uint256 hash1;
    SHA256((pbegin == pend ? pblank : (unsigned char*)&pbegin[0]), (pend - pbegin) * sizeof(pbegin[0]), (unsigned char*)&hash1);
    uint256 hash2;
    SHA256((unsigned char*)&hash1, sizeof(hash1), (unsigned char*)&hash2);
    return hash2;
}

I'd say anyplace that calls that uses SHA256 twice.
As for why, see this.


---

### Answer by username_4 on 2020-08-03. Score: 1

We perform SHA-256d on extended RIPEMD-160 hash, running SHA-256 on it twice.
We take the first 4 bytes of our SHA-256d hash as our checksum, and append it to the
end of our extended RIPEMD-160 hash.
After converting the result to base58, we finally have our Bitcoin address.


---

### Answer by username_5 on 2021-12-03. Score: 0

Bitcoin uses double hashing almost everywhere>SHA256[SH256[X]]called Hash256 which produces a 160 bit out.Linking transaction outputs and inputs.Generating the checsum in a bitcoin address.Hashing the block in a merkle tree.


---

### Answer by username_6 on 2018-07-27. Score: -1

Hashing the block in a Merkle tree and with two rounds of SHA256 increases in security, so both function would have to be broken to undo the hash.


---

### Answer by username_7 on 2022-03-04. Score: -2

I. To generate a Bitcoin address from an public key:

1. run hash function SHA-256 on the key
2. run RIPEMD-160 on the key
   This compresses address size to 160bits and is knows as "double hashing" (HASH160). This gives us the public key hash.
3. add a version byte in front of RIPEMD-160 hash and specify our network
4. Run a Base58check encode to obtain cheksum.
5. Run SHA-256 on RIPEMD-160 twice
6. Take first 4bytes of the SHA-256d hash as the checksum and add to end of the extended RIPEMD-160 hash
7. convert result to base 58 to obtain Bitcoin address

II. To increase security by making SHA-256 tamper resistant
III. On message inputs and outputs


---

### Answer by username_8 on 2018-08-12. Score: -3

Senders specify a locking script and recipients specify an unlocking script. These stacked hashes confirm proof of work by the sending UTXO and legitimatecy of the recipient to receive the transaction.

> **Comments:**
> **username_9**: This doesn't make sense and doesn't answer the question  

---

