<p>There are a multitude of reasons.</p>
<ol>
<li><p>As @ThePiachu mentioned, there is <a href="https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions" rel="nofollow noreferrer">a theoretical 2^60 bit attack that is possible on SHA-1</a>, meaning that the algorithm is weaker than designed.</p>
</li>
<li><p>RIPEMD-160 was designed in the open academic community, in contrast to the NSA designed SHA-1 and SHA-2 algorithms.</p>
<p>It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits as this is <a href="https://crypto.stackexchange.com/questions/3153/sha-256-vs-any-256-bits-of-sha-512-which-is-more-secure">equally secure</a>. The fact that he didn't is some evidence to show that his decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.</p>
</li>
<li><p>Lastly, I believe RIPEMD is based on a different design to the SHA1/SHA2 algorithms, and thus attacks that apply to one may not be transferable to the other (which is good).</p>
</li>
</ol>

CC BY-SA 3.0
2013-11-11T13:37:07.167Z
Only the first is really an argument. The other two can be refuted by the fact that SHA-256 is used instead of another 256-bit hash.
SHA-256 is probably chosen for it's popularity, so why wouldn't SHA-1 be chosen for the same reason?
Steven Roose
CC BY-SA 3.0
2013-11-11T23:16:30.417Z
I don't quite agree. Just because one of the algorithms (SHA-256) is NSA-designed, doesn't mean that it still isn't a benefit to use an algorithm designed by another institution.
liamzebedee
CC BY-SA 3.0
2013-11-11T23:22:10.393Z
It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits. The fact that he didn't I think is some evidence to show that Satoshi's decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms. 

(http://crypto.stackexchange.com/questions/3153/sha-256-vs-any-256-bits-of-sha-512-which-is-more-secure)
liamzebedee
CC BY-SA 3.0
2013-11-12T02:08:29.323Z
I don't say that he should have used SHA-1 because it's NSA-designed. Just saying that it's weird that he uses SHA-256 for a 256-bit hash but RIPEMD-160 for a 160-bit hash while the same family of hashes that SHA-256 is in has a 16-bit variant as well. (I know that SHA-1 and SHA-2 are not entirely from the same family, but they share the same name..)
Steven Roose
CC BY-SA 3.0
2013-11-11T12:37:32.490Z
2013-11-11T23:31:25.113Z
2020-06-16T11:10:03.350Z
liamzebedee
<p>It could be due to <a href="https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions" rel="nofollow">a theoretical 2^60 bit attack that is possible on SHA-1</a>, meaning that the algorithm is weaker than designed. RIPEMD does not appear to have such weaknesses. </p>

CC BY-SA 3.0
2013-11-11T12:34:37.913Z
Hmm, I didn't know that. But still, chances are high that this theoretical flaw was found only because the algorithm is more popular than RIPEMD-160...
Steven Roose
CC BY-SA 3.0
2013-12-12T14:15:26.033Z
I'm looking into this again. The use of RIPEMD-160 in Bitcoin is not for security. Finding a collision would only allow you to find the public key of the address, which won't grant you access to the coins.
The security of the algorithm is not crucial for this case, so popularity would be the main deciding factor because it can strongly facilitate adoption.
Steven Roose
CC BY-SA 3.0
2013-12-12T18:41:06.487Z
@StevenRoose Actually, if you can generate a RIPEMD collision for an Address with a different private key that you control, you could spend all of the money of that address. We would have to revert to "pay to public key" payment algorithm.
ThePiachu
CC BY-SA 3.0
2013-12-13T11:10:29.750Z
Well, indeed. But collisions are generated by creating a specific input that will match a desired output. The inputs would be public keys. The public key from a private key is unpredictable and when you crack a hash function to generate collisions, I bet you want will do so with specific inputs, not random ones.
Steven Roose
CC BY-SA 3.0
2013-11-11T08:47:49.507Z
2013-11-11T08:47:49.507Z
ThePiachu
<p>Bitcoin uses both SHA-256 and RIPEMD-160 hashes. Most often a double-round SHA-256 is used, but for address generating, RIPEMD-160 is used because it generates a shorter hash value. RIPEMD-160 has a 160-bit or 20-byte hash value while SHA-256 has a 256-bit or 32-byte.</p>

<p><strong>So RIPEMD-160 is used for it's shorter hash. However, SHA-1 also produces a 160-bit hash. RIPEMD-160 is a less popular algorithm but in fact achieves exactly the same as SHA-1 does.</strong></p>

<p>The only real difference I can find on the internet is in the following fragment from <a href="https://en.wikipedia.org/wiki/RIPEMD-160" rel="noreferrer">RIPEMD-160's Wikipedia page</a>:</p>

<blockquote>
  <p>RIPEMD-160 was designed in the open academic community, in contrast to
  the NSA designed SHA-1 and SHA-2 algorithms. On the other hand,
  RIPEMD-160 appears to be used somewhat less frequently than SHA-1,
  which may have caused it to be less scrutinized than SHA. RIPEMD-160
  is not known to be constrained by any patents.</p>
</blockquote>

<p>Are patent issues the reason? Why is SHA-1 a problem but SHA-256 not? I know that SHA-1 and SHA-2 (of which SHA-256 is a part) are different iterations of the SHA initiative and so probably have very different legal implementation.</p>

<p>Does anyone really knows why RIPEMD-160 was chosen before the more popular SHA-1?</p>

<hash><sha256><ripemd160>
Why was the RIPEMD-160 hash algorithms chosen before SHA-1?
Steven Roose
# Why was the RIPEMD-160 hash algorithms chosen before SHA-1?

(Asked by: username_0 on 2013-11-11)

Bitcoin uses both SHA-256 and RIPEMD-160 hashes. Most often a double-round SHA-256 is used, but for address generating, RIPEMD-160 is used because it generates a shorter hash value. RIPEMD-160 has a 160-bit or 20-byte hash value while SHA-256 has a 256-bit or 32-byte.

**So RIPEMD-160 is used for it's shorter hash. However, SHA-1 also produces a 160-bit hash. RIPEMD-160 is a less popular algorithm but in fact achieves exactly the same as SHA-1 does.**

The only real difference I can find on the internet is in the following fragment from [RIPEMD-160's Wikipedia page](https://en.wikipedia.org/wiki/RIPEMD-160):

> RIPEMD-160 was designed in the open academic community, in contrast to
> the NSA designed SHA-1 and SHA-2 algorithms. On the other hand,
> RIPEMD-160 appears to be used somewhat less frequently than SHA-1,
> which may have caused it to be less scrutinized than SHA. RIPEMD-160
> is not known to be constrained by any patents.

Are patent issues the reason? Why is SHA-1 a problem but SHA-256 not? I know that SHA-1 and SHA-2 (of which SHA-256 is a part) are different iterations of the SHA initiative and so probably have very different legal implementation.

Does anyone really knows why RIPEMD-160 was chosen before the more popular SHA-1?

**Tags:** hash, sha256, ripemd160


---

## 2 answers

### Answer by username_1 on 2013-11-11. Score: 4

There are a multitude of reasons.

1. As @username_2 mentioned, there is [a theoretical 2^60 bit attack that is possible on SHA-1](https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions), meaning that the algorithm is weaker than designed.
2. RIPEMD-160 was designed in the open academic community, in contrast to the NSA designed SHA-1 and SHA-2 algorithms.

   It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits as this is [equally secure](https://crypto.stackexchange.com/questions/3153/sha-256-vs-any-256-bits-of-sha-512-which-is-more-secure). The fact that he didn't is some evidence to show that his decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.
3. Lastly, I believe RIPEMD is based on a different design to the SHA1/SHA2 algorithms, and thus attacks that apply to one may not be transferable to the other (which is good).

> **Comments:**
> **username_0**: Only the first is really an argument. The other two can be refuted by the fact that SHA-256 is used instead of another 256-bit hash. SHA-256 is probably chosen for it's popularity, so why wouldn't SHA-1 be chosen for the same reason?  
> **username_1**: I don't quite agree. Just because one of the algorithms (SHA-256) is NSA-designed, doesn't mean that it still isn't a benefit to use an algorithm designed by another institution.  
> **username_1**: It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits. The fact that he didn't I think is some evidence to show that Satoshi's decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.   (http://crypto.stackexchange.com/questions/3153/sha-256-vs-any-256-bits-of-sha-512-which-is-more-secure)  
> **username_0**: I don't say that he should have used SHA-1 because it's NSA-designed. Just saying that it's weird that he uses SHA-256 for a 256-bit hash but RIPEMD-160 for a 160-bit hash while the same family of hashes that SHA-256 is in has a 16-bit variant as well. (I know that SHA-1 and SHA-2 are not entirely from the same family, but they share the same name..)  

---

### Answer by username_2 on 2013-11-11. Score: 2

It could be due to [a theoretical 2^60 bit attack that is possible on SHA-1](https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions), meaning that the algorithm is weaker than designed. RIPEMD does not appear to have such weaknesses.

> **Comments:**
> **username_0**: Hmm, I didn't know that. But still, chances are high that this theoretical flaw was found only because the algorithm is more popular than RIPEMD-160...  
> **username_0**: I'm looking into this again. The use of RIPEMD-160 in Bitcoin is not for security. Finding a collision would only allow you to find the public key of the address, which won't grant you access to the coins. The security of the algorithm is not crucial for this case, so popularity would be the main deciding factor because it can strongly facilitate adoption.  
> **username_2**: @username_0 Actually, if you can generate a RIPEMD collision for an Address with a different private key that you control, you could spend all of the money of that address. We would have to revert to "pay to public key" payment algorithm.  
> **username_0**: Well, indeed. But collisions are generated by creating a specific input that will match a desired output. The inputs would be public keys. The public key from a private key is unpredictable and when you crack a hash function to generate collisions, I bet you want will do so with specific inputs, not random ones.  

---

