Hash

A hash is the fixed-length output, also called a digest, that a hash function produces from input data of any size. A cryptographic hash function turns a word, a file or a whole block of transactions into a short string of characters in a way that is quick to compute, always gives the same result for the same input, and is practically impossible to reverse or to fake. In everyday usage "hash" means both the function and its output.

Hashes are among the most basic tools of cryptography and of every blockchain. They identify transactions, link blocks into a chain, build Merkle trees, derive addresses from keys and drive proof-of-work mining. Bitcoin's main function, SHA-256, has its own entry on SHA256; this entry covers hash functions in general, their properties and their uses in finance.

Think of a fingerprint. A person's fingerprint is tiny compared with the person, yet it identifies them, and you cannot rebuild the person from it. A hash is a fingerprint for data: a book, a payment or a password goes in, and a short, unique-looking code comes out.

Two things make the fingerprint useful. Change even one letter of the book and the fingerprint changes completely, so tampering is obvious. And there is no practical way to start from the fingerprint and work back to the book, or to write a different book with the same fingerprint. That is why a hash can stand in for data when you want to check it, without having to share or store the data itself.

A hash function suitable for security work is expected to have these properties:

• Deterministic. The same input always gives the same output.
• Fixed output size. SHA-256 always returns 256 bits (64 hexadecimal characters), whether the input is one letter or a gigabyte.
• Fast to compute. Anyone can hash data and check a hash cheaply.
• Preimage resistance. Given a hash, it is infeasible to find any input that produces it, so a hash cannot be "decrypted".
• Second-preimage resistance. Given one input, it is infeasible to find a different input with the same hash.
• Collision resistance. It is infeasible to find any two different inputs with the same hash.
• Avalanche effect. A tiny change in the input changes about half of the output bits, so similar inputs produce unrelated hashes.

Collisions must exist, because there are more possible inputs than outputs, but a good function makes finding one take an impractical amount of work. Because of the "birthday" effect, a generic search for a collision in an $n$-bit hash needs about:

• $W$ is the expected number of hash computations needed to find a collision by brute force.
• $n$ is the length of the hash output in bits.

Worked example: for SHA-256, $n = 256$, so $W \approx 2^{128} \approx 3.4 \times 10^{38}$ computations, far beyond the combined capacity of every computer on Earth. A 128-bit hash would offer only $2^{64} \approx 1.8 \times 10^{19}$, which is within reach of large, well-funded efforts.

Several families matter in finance and crypto:

• SHA-2. The family that includes SHA-256, standardised by the US National Institute of Standards and Technology (NIST) in FIPS 180-4. Bitcoin applies SHA-256 twice to block headers and transactions.
• Keccak-256. The function used throughout the Ethereum blockchain. It is the original Keccak design; the SHA-3 standard NIST published in 2015 uses slightly different padding, so the two give different outputs.
• RIPEMD-160. Combined with SHA-256 in Bitcoin to shorten a public key into the 160-bit hash behind many wallet addresses.
• Memory-hard functions. Scrypt, used by Litecoin, is designed to need lots of memory, which made specialised mining chips harder to build.
• Broken functions. MD5 and SHA-1 are no longer considered collision resistant; researchers from Google and CWI Amsterdam published a practical SHA-1 collision in 2017. They should not be used for signatures or integrity checks.

Hashes do several different jobs in a blockchain:

• Identifiers. Every transaction and block is known by its hash, which is what users look up in a block explorer.
• Chaining. Each block header contains the hash of the previous header, so changing history breaks every later link, the source of a chain's immutability.
• Mining. Miners vary a nonce and hash the header until the result is below a target; the network's total guessing speed is its hashrate.
• Commitments. A Merkle root commits to a whole list of transactions in one hash, and hash locks let Lightning Network payments be released only when a secret is revealed.
• Signatures. Digital signature schemes sign the hash of a message rather than the message itself.

Banks, payment firms and software vendors use hashes to check file integrity, to store passwords and to compare records without exposing them. Passwords should never be stored with a fast hash alone: a random salt is added, and slow, purpose-built functions such as bcrypt or Argon2 are used so that stolen password databases are costly to crack. A hash is not encryption: there is no key and no way to recover the input, so a hash protects data integrity rather than confidentiality.

Hashes are also not anonymous. Hashing a short or predictable value, such as a card number or a phone number, can often be reversed by hashing every possible value and comparing. Quantum computers running Grover's algorithm could in theory speed up preimage searches, which is one reason long outputs such as 256 bits are preferred.

• NIST: Hash Functions
• NIST FIPS 180-4: Secure Hash Standard