<p>The attacks are against a "poor man's" version of SHA-256, where less rounds are performed than in the real SHA-256. They are useless for breaking SHA-256 itself, and more so for the double SHA-256 used in Bitcoin mining.</p>

<p>Also, what would be most useful for mining is a preimage attack, and those are much harder than collision attacks. You can see in the table on Wikipedia that the proposed preimage attacks, though faster than pure brute force, are still impossibly complex.</p>

CC BY-SA 3.0
2014-11-12T08:53:50.307Z
2014-11-12T08:53:50.307Z
Meni Rosenfeld
<ol>
<li><p>Sha256 has no known vulnerabilities as of yet. As Meni Rosenfeld mentioned, the mentioned attacks only concern part of the rounds of Sha256, in order to have an actuall effective attack you'd have to fully break <em>all</em> rounds (64 in case of Sha256).</p></li>
<li><p>Even if Sha256 was broken, it <em>still</em> wouldn't directly affect mining, as Bitcoin uses <strong>double Sha256</strong> hashing:<br>Sha256d(x) = Sha256(Sha256(x))</p></li>
<li><p>Even if a full preimage attack on Sha256 was found, it <em>still</em> most likely would not affect Bitcoin, as in the mining process there is very little freedom to forge the input data. You can shuffle around some txs, vary the nonce, but not much else. It is extremely unlikely that whatever means the preimage attack uses to construct input data (to match the required hash value) is compatible with the way Bitcoin blocks are built up.</p></li>
</ol>

<p>This gives us more than enough time to migrate to another hashing algorithm, if regular Sha256 were ever to be compromised.</p>

CC BY-SA 3.0
2014-11-12T15:42:33.717Z
Assuming whoever discovers it is nice enough not to pick the millions they could get by mining ... Also, why couldn't you apply a preimage twice to undo a double hash?
ike
CC BY-SA 3.0
2014-11-13T05:37:38.453Z
If it was compromised in terms of a full preimage attack, then yes. But then still there's another factor at play, added it as nr.3
Maǳi Koǌo
CC BY-SA 3.0
2014-11-12T15:22:34.340Z
2014-11-13T10:06:58.073Z
2014-11-13T10:06:58.073Z
RocketNuts
<p><a href="http://en.wikipedia.org/wiki/SHA-2" rel="nofollow">Wikipedia</a> lists several vulnerabilities in SHA-256. Presumably, none of them can be used to mine faster, or it would be done already. Why don't these vulnerabilities lead to a problem for mining?</p>

<security><mining-technical-details><sha256>
Why don't any of the SHA-256 vulnerabilities matter for mining?
ike
# Why don't any of the SHA-256 vulnerabilities matter for mining?

(Asked by: username_0 on 2014-11-12)

[Wikipedia](http://en.wikipedia.org/wiki/SHA-2) lists several vulnerabilities in SHA-256. Presumably, none of them can be used to mine faster, or it would be done already. Why don't these vulnerabilities lead to a problem for mining?

**Tags:** security, mining-technical-details, sha256


---

## 2 answers

### Answer by username_1 on 2014-11-12. Score: 5

The attacks are against a "poor man's" version of SHA-256, where less rounds are performed than in the real SHA-256. They are useless for breaking SHA-256 itself, and more so for the double SHA-256 used in Bitcoin mining.

Also, what would be most useful for mining is a preimage attack, and those are much harder than collision attacks. You can see in the table on Wikipedia that the proposed preimage attacks, though faster than pure brute force, are still impossibly complex.


---

### Answer by username_2 on 2014-11-12. Score: 4

1. Sha256 has no known vulnerabilities as of yet. As username_1 username_1 mentioned, the mentioned attacks only concern part of the rounds of Sha256, in order to have an actuall effective attack you'd have to fully break *all* rounds (64 in case of Sha256).
2. Even if Sha256 was broken, it *still* wouldn't directly affect mining, as Bitcoin uses **double Sha256** hashing:  
   Sha256d(x) = Sha256(Sha256(x))
3. Even if a full preimage attack on Sha256 was found, it *still* most likely would not affect Bitcoin, as in the mining process there is very little freedom to forge the input data. You can shuffle around some txs, vary the nonce, but not much else. It is extremely unlikely that whatever means the preimage attack uses to construct input data (to match the required hash value) is compatible with the way Bitcoin blocks are built up.

This gives us more than enough time to migrate to another hashing algorithm, if regular Sha256 were ever to be compromised.

> **Comments:**
> **username_0**: Assuming whoever discovers it is nice enough not to pick the millions they could get by mining ... Also, why couldn't you apply a preimage twice to undo a double hash?  
> **username_3**: If it was compromised in terms of a full preimage attack, then yes. But then still there's another factor at play, added it as nr.3  

---

