<p>My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the <code>RIPEMD160(SHA256)</code>.</p>
<p>My lengthy and elaborate rationale is in <a href="https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565">my answer</a> on the related question.</p>

CC BY-SA 4.0
2022-02-22T10:40:46.470Z
2022-02-22T10:40:46.470Z
Shelby Moore III
<p>From <a href="https://crypto.stackexchange.com/a/884">Zooko's answer provided in Crypto StackExchange</a>:</p>

<blockquote>
  <p>SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
  excellent book "Practical Cryptography" (later updated by Ferguson,
  Schneier, and Kohno and renamed "Cryptography Engineering") as a way
  to make SHA-256 invulnerable to "length-extension" attack. They called
  it "SHA-256d".</p>
</blockquote>

CC BY-SA 4.0
2022-02-22T10:40:05.303Z
Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.
Shelby Moore III
CC BY-SA 3.0
2012-07-30T21:52:01.200Z
2012-07-30T21:52:01.200Z
2017-04-13T12:48:25.933Z
Stephen Gornick
<p>Each blocked is hashed twice. Why isn't one application of SHA256 enough?</p>

<protocol><hash>
Why does Bitcoin use two rounds of SHA256?
ripper234
# Why does Bitcoin use two rounds of SHA256?

(Asked by: username_0 on 2012-07-30)

Each blocked is hashed twice. Why isn't one application of SHA256 enough?

**Tags:** protocol, hash


---

## 2 answers

### Answer by username_2 on 2012-07-30. Score: 13 | Accepted answer

From [Zooko's answer provided in Crypto StackExchange](https://crypto.stackexchange.com/a/884):

> SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
> excellent book "Practical Cryptography" (later updated by Ferguson,
> Schneier, and Kohno and renamed "Cryptography Engineering") as a way
> to make SHA-256 invulnerable to "length-extension" attack. They called
> it "SHA-256d".

> **Comments:**
> **username_1**: Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.  

---

### Answer by username_1 on 2022-02-22. Score: -1

My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the `RIPEMD160(SHA256)`.

My lengthy and elaborate rationale is in [my answer](https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565) on the related question.


---

