What is/was reason behind the 'double hash'?

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Here are some quotes of satoshi's posts that support the previously given answers...
From this topic: /index.php?topic=571.msg5712#msg5712

For "shorter addresses"

Quote from: satoshi on July 25, 2010, 02:06:23 PM

-snip- To make Bitcoin Addresses short, they are a hash of the public key, not the public key itself.

Security of HASH160

Quote from: satoshi on July 25, 2010, 03:48:01 PM

-snip-
Bitcoin Addresses are the only place where 160-bit hash is used. Everything else is SHA-256. They're calculated as:

bitcoinaddress = RIPEMD-160(SHA-256(publickey))

Correct me if I'm wrong (please, and I'll gladly eat crow) but I think it would be hard to use an analytical attack on RIPEMD-160 in this case. An analytical attack prescribes a certain range or pattern of inputs to try that will greatly increase your chance of finding a collision. Here, you don't have that kind of control over RIPEMD-160's input, because the input is the output of SHA-256. If an analytical attack helps you find an input to RIPEMD-160 that produces a collision, what are you going to do with it? You still have to get SHA-256 to output that value, so you would still have to break SHA-256 too.

For brute force, RIPEMD-160(SHA-256(x)) is no stronger than RIPEMD-160 alone. But for analytical attack, it seems like you must analytical attack both RIPEMD-160 and SHA-256. If I'm wrong, then the strength is the same as RIPEMD-160 and the SHA-256 only serves as one round of key strengthening.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: Charles-Tim on May 01, 2022, 04:10:44 AM

According to what I saw on Wikipedia:

Quote from: https://en.m.wikipedia.org/wiki/RIPEMD

The 256- and 320-bit versions of RIPEMD provide the same level of security as RIPEMD-128 and RIPEMD-160, respectively; they are designed for applications where the security level is sufficient but longer hash result is necessary.

RIPEMD160 produces hash that is shorter though in the process of bitcoin address generation but has 128 bit of security which is secure enough.

RIPEMD160 still provides the same 160-bit security due to its size and the algorithm.
The reason why the bigger versions (256 and 320 bit alternatives) produce smaller security is because they are not different algorithms, instead they just extend the hash of the 128-bit and 160-bit algorithms.

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

According to what I saw on Wikipedia:

Quote from: https://en.m.wikipedia.org/wiki/RIPEMD

The 256- and 320-bit versions of RIPEMD provide the same level of security as RIPEMD-128 and RIPEMD-160, respectively; they are designed for applications where the security level is sufficient but longer hash result is necessary.

RIPEMD160 produces hash that is shorter though in the process of bitcoin address generation but has 128 bit of security which is secure enough.

Cookdata

hero member

Activity: 1106

Merit: 912

Not Your Keys, Not Your Bitcoin

Quote from: a298b112 on April 30, 2022, 11:43:10 PM

Turns out a Bitcoin address is Base58Check encoded double hash (SHA256 and RIPEMD160) of public key. What is the reason to hash it twice? First with SHA256 and then RIPEMD160? Thanks.

In addition to the response above, basically, SHA256 gives you 32 bytes (256 bits) and the RIPEMD160 function gives you 20 bytes (160 bits) of data, when you compared the two functions, RIPEMD160 provides a shorter version of data and this gives allows us to save a lot of space on blocks of transactions and easily encode it to base58 bitcoin address format.
I think the main reason why they adopt two hash functions is just to add extra security so that we don't rely on a single function as we don't know what the future may tell if SHA256 becomes vulnerable.

pooya87

legendary

Activity: 3472

Merit: 10611

I don't think Satoshi (who made this decision) has ever answered this question, so we have to guess.

What HASH160 seems to prevent is second pre-image attacks. It also is both shorter (compared to SHA256) and provides the at least 128-bits of security that exists everywhere else in Bitcoin.

a298b112

member

Activity: 159

Merit: 36

Turns out a Bitcoin address is Base58Check encoded double hash (SHA256 and RIPEMD160) of public key. What is the reason to hash it twice? First with SHA256 and then RIPEMD160? Thanks.

Topic: What is/was reason behind the 'double hash'? (Read 136 times)