<p>It reuses the <a href="https://en.wikipedia.org/wiki/Hashcash" rel="nofollow" title="Hashcash article in Wikipedia">HashCash</a> construct invented by Adam Back (a scheme for proving work was done to send an email, resulting in it being treated as less spammy by spam filters), though with a newer hash function and different header structure.</p>

CC BY-SA 3.0
2015-11-14T22:21:19.327Z
2016-04-21T12:22:13.000Z
2016-04-21T12:22:13.000Z
Pieter Wuille
<p>It seems to me that the reason the proof-of-work involves finding a hash beginning with a (temporarily) fixed number of zeroes is because one can easily check whether they have solved the problem by comparing the hash they have generated with the value 2^k, where k = (256 - # of zero bits) and doing so is a relatively inexpensive operation. Also, it is easy to make the problem arbitrarily difficult up to a certain point (as well as having the difficulty increase exponentially with the number of zeros). </p>

<p>Are there any other reasons for why this particular problem was chosen for the proof-of-work?</p>

CC BY-SA 3.0
2015-11-14T22:19:41.400Z
It doesn't check for a number of zero bits. It checks whether the hash, when interpreted as a 256-bit number, is lower than a target number. That target number is occasionally adjusted.
Pieter Wuille
CC BY-SA 3.0
2015-11-15T01:34:51.280Z
Is the target number a power of two, or can it be any 256-bit number?
Ali
CC BY-SA 3.0
2015-11-15T02:28:44.597Z
@Ali It can't be *any* 256 bit number (there's a format it needs to follow, [see here](http://bitcoin.stackexchange.com/questions/2924/how-to-calculate-new-bits-value)) but you can use very nearly any value.
Nick ODell
<hash><proof-of-work>
Why was finding a hash beginning with a certain number of zeroes chosen as the proof of work?
Ali
# Why was finding a hash beginning with a certain number of zeroes chosen as the proof of work?

(Asked by: username_0 on 2015-11-14)

It seems to me that the reason the proof-of-work involves finding a hash beginning with a (temporarily) fixed number of zeroes is because one can easily check whether they have solved the problem by comparing the hash they have generated with the value 2^k, where k = (256 - # of zero bits) and doing so is a relatively inexpensive operation. Also, it is easy to make the problem arbitrarily difficult up to a certain point (as well as having the difficulty increase exponentially with the number of zeros).

Are there any other reasons for why this particular problem was chosen for the proof-of-work?

**Tags:** hash, proof-of-work

> **Comments:**
> **username_1**: It doesn't check for a number of zero bits. It checks whether the hash, when interpreted as a 256-bit number, is lower than a target number. That target number is occasionally adjusted.  
> **username_0**: Is the target number a power of two, or can it be any 256-bit number?  
> **username_2**: @username_0 It can't be *any* 256 bit number (there's a format it needs to follow, [see here](http://bitcoin.stackexchange.com/questions/2924/how-to-calculate-new-bits-value)) but you can use very nearly any value.  

---

## 1 answers

### Answer by username_1 on 2015-11-14. Score: 7 | Accepted answer

It reuses the [HashCash](https://en.wikipedia.org/wiki/Hashcash "Hashcash article in Wikipedia") construct invented by Adam Back (a scheme for proving work was done to send an email, resulting in it being treated as less spammy by spam filters), though with a newer hash function and different header structure.


---

