What is a cryptographic hash function in blockchain?

A cryptographic hash function takes an input of any size and produces a fixed-size output called a digest, for example SHA-256 always outputs 256 bits. To be suitable for blockchain use it must be deterministic, fast to compute forward, and one-way, meaning infeasible to reverse from digest back to input. This makes a hash a compact, tamper-evident fingerprint of data, and a blockchain is essentially a chain of these hash pointers.

What security properties must a blockchain hash function have?

Three properties are essential: preimage resistance, meaning you cannot find an input for a given digest; second-preimage resistance, meaning you cannot find a different input matching a given input's digest; and collision resistance, meaning you cannot find any two distinct inputs with the same digest. A related practical property is the avalanche effect, where flipping one input bit flips roughly half the output bits.

What hash functions do major blockchains use?

Bitcoin uses SHA-256 for block hashing, transaction identifiers, and mining, and combines it with RIPEMD-160 for compact addresses. Ethereum uses Keccak-256 for addresses, state, and storage, which differs slightly from the finalized SHA3-256 standard in its padding, so the two produce different outputs and must not be confused. Some protocols use fast modern hashes such as BLAKE2 and BLAKE3.

What is a length-extension attack on a hash function?

A length-extension attack affects hashes built on the Merkle-Damgard construction, such as SHA-256, where knowing the hash of a message lets an attacker compute the hash of that message plus an appended suffix without knowing the original input. Bitcoin sidesteps this by hashing twice, a construction called SHA256d, and sponge-based functions like SHA-3 are not susceptible at all. This shows that using a hash correctly matters as much as choosing a strong one.

What is the avalanche effect in hashing?

The avalanche effect means that flipping a single bit of the input flips roughly half of the output bits, so digests look random and reveal nothing about their inputs. It ensures that even nearly identical inputs produce completely different, unpredictable hashes. Proof-of-work systems additionally rely on puzzle-friendliness, meaning there is no strategy better than brute-force trial to find an input whose hash meets a target.

⛓ Blockchain & Applied Crypto

Cryptographic Hash Functions in Blockchain

Q: Why do blockchains use 256-bit hashes?

Collision resistance is the hardest property to uphold because of the birthday paradox, which lets an attacker expect a colliding pair after roughly the square root of the output space, about 2 to the power n-over-2 tries for an n-bit digest rather than the full 2 to the n. Standardizing on 256-bit outputs keeps even that reduced bound, around 2 to the 128th, far beyond any feasible search. This is why major blockchains choose 256-bit hash functions.

Cryptographic hash functions are the single most pervasive primitive in blockchain technology. They link blocks together, commit to transactions, generate addresses, and drive proof-of-work mining. If digital signatures prove who authorized something, hash functions prove that data has not changed. Understanding cryptographic hash functions in blockchain is therefore essential to understanding blockchain security itself.

What a Cryptographic Hash Function Is

A hash function takes an input of any size and produces a fixed-size output called a digest or hash. For example, SHA-256 always outputs 256 bits, whether the input is a single byte or a gigabyte. A hash suitable for cryptography must go far beyond this basic behavior. It must be:

Deterministic: the same input always yields the same digest.
Fast to compute in the forward direction.
One-way: infeasible to reverse from digest back to input.

These make a hash a reliable, compact fingerprint of data. A structure that stores a hash of the data it points to is often called a hash pointer, and a blockchain is essentially a chain of hash pointers.

Core Security Properties

Three formal properties define a secure cryptographic hash function, and blockchains depend on all of them:

Preimage resistance: given a digest, it is infeasible to find any input that produces it. This protects hashed commitments and addresses.
Second-preimage resistance: given one input, it is infeasible to find a different input with the same digest. This keeps an attacker from swapping data under an unchanged hash.
Collision resistance: it is infeasible to find any two distinct inputs that hash to the same digest. Merkle trees and transaction identifiers rely on this.

A related practical property is the avalanche effect: flipping a single input bit flips roughly half the output bits, so digests look random and reveal nothing about their inputs. Proof-of-work systems additionally exploit puzzle-friendliness, meaning there is no strategy better than brute-force trial to find an input whose hash meets a target.

Collision resistance is the hardest of these properties to uphold. The birthday paradox means an attacker can expect to find some colliding pair after roughly the square root of the output space, about 2 to the power n-over-2 tries for an n-bit digest, rather than the full 2 to the n. This is precisely why major blockchains standardize on 256-bit outputs, which keep even that reduced bound far beyond the reach of any feasible search.

Hash Functions Used in Blockchains

Different chains standardize on different hash functions:

SHA-256 anchors Bitcoin, used for block hashing, transaction identifiers, and mining.
Keccak-256 is used throughout Ethereum for addresses, state, and storage. It differs slightly from the finalized NIST SHA3-256 standard in its padding, so the two produce different outputs and must not be confused.
RIPEMD-160 produces a shorter 160-bit digest and is combined with SHA-256 to create compact Bitcoin addresses.
BLAKE2 and BLAKE3 are fast, modern hashes used by several protocols.

Some networks deliberately choose memory-hard functions for mining so that specialized hardware has less of an advantage over commodity machines, aiming to keep mining more decentralized.

Where Hashing Shows Up

Hashing is woven through every layer of a blockchain:

Block linking: each block header includes the hash of the previous header, forming the chain and making tampering evident.
Merkle roots: all transactions in a block are committed into one root hash.
Proof of work: miners search for a header whose hash is below a difficulty target, the mechanism behind proof of work and proof of stake.
Addresses: public keys are hashed to produce shorter, safer identifiers.
Commitments: a party can publish a hash of data to lock it in without revealing it, then disclose the data later to prove they did not change it.

Length Extension and Double Hashing

Not all constructions behave identically. SHA-256 uses the Merkle-Damgard construction, which is vulnerable to a length-extension attack: knowing the hash of a message can let an attacker compute the hash of that message plus an appended suffix without knowing the original input. This can be dangerous in naive authentication schemes.

Bitcoin sidesteps the issue by hashing twice, a construction called SHA256d:

SHA256d(x) = SHA256(SHA256(x))   # blocks length-extension tricks

Hash functions such as SHA-3, which is built on a sponge construction, are not susceptible to length extension at all. The lesson is that the security of a blockchain depends not only on choosing a strong hash function but on using it correctly.

Key Takeaways

Cryptographic hash functions turn arbitrary data into fixed-size, one-way, tamper-evident fingerprints.
Blockchain security relies on preimage, second-preimage, and collision resistance, plus the avalanche effect for unpredictability.
SHA-256, Keccak-256, and RIPEMD-160 are the workhorses of major blockchains, with Keccak-256 differing subtly from standardized SHA3-256.
Hashing underpins block linking, Merkle roots, proof of work, addresses, and commitments.
Construction details matter: Merkle-Damgard hashes allow length-extension attacks, which Bitcoin mitigates with double hashing and SHA-3 avoids by design.

hashingsha-256keccakcryptographyblockchain