<p>The wiki claim that this is to prevent birthday attacks is wrong. If you can successfully execute a birthday attack on a single call to the hash function, you get a successful birthday attack on the second call. This is easy to see as having <code>hash(x) == hash(y)</code> implies <code>hash(hash(x)) == hash(hash(y))</code>.</p>

<p>If you really wanted to guard against this, you would do something like <code>hash(x||hash(x))</code>. Finding a collision in a single call to <code>hash</code> in this case would not directly yield a collision in the double call.</p>

CC BY-SA 3.0
2017-01-05T18:38:01.253Z
2017-01-05T18:38:01.253Z
mikeazo
<p>Like others have said, the wiki claim of this preventing birthday attacks is wrong. Rather, this was meant to prevent against <a href="https://en.wikipedia.org/wiki/Length_extension_attack" rel="noreferrer">length extension attacks</a>.</p>

<p>From <a href="https://crypto.stackexchange.com/a/884/56797">https://crypto.stackexchange.com/a/884/56797</a>:</p>

<blockquote>
  <p>SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
  excellent book "Practical Cryptography" (later updated by Ferguson,
  Schneier, and Kohno and renamed "Cryptography Engineering") as a way
  to make SHA-256 invulnerable to "length-extension" attack. They called
  it "SHA-256d". We started using SHA-256d for everything when we
  launched the Tahoe-LAFS project in 2006, on the principle that it is
  hardly less efficient than SHA-256, and that it frees us from having
  to reason about whether length-extension attacks are dangerous every
  place that we use a hash function. I wouldn't be surprised if the
  inventors of Bitcoin used it for similar reasons. Why not use SHA-256d
  instead of SHA-256?</p>
  
  <p>Note that the SHA-3 project required all candidates to have some
  method of preventing length-extension attacks. Some of them use a
  method that is rather like SHA-256d, i.e. they do an extra
  "finalization" hash of their state at the end, before emitting a
  result.</p>
</blockquote>

CC BY-SA 4.0
2022-02-22T02:45:48.057Z
Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.
Shelby Moore III
CC BY-SA 4.0
2018-03-09T08:14:43.490Z
2018-06-04T19:06:12.520Z
2018-06-04T19:06:12.520Z
Zain Rizvi
<p>The wiki <a href="https://en.bitcoin.it/wiki/Hashcash">answers this</a>. TLDR: to prevent against <a href="http://en.wikipedia.org/wiki/Birthday_attack">birthday attacks</a>.</p>

<blockquote>
  <p>Bitcoin is using two hash iterations (denoted SHA256^2 ie "SHA256 function squared") and the reason for this relates to a partial attack on the smaller but related SHA1 hash. SHA1's resistance to birthday attacks has been partially broken as of 2005 in O(2^64) vs the design O(2^80). While hashcash relies on pre-image resistance and so is not vulnerable to birthday attacks, a generic method of hardening SHA1 against the birthday collision attack is to iterate it twice. A comparable attack on SHA256 does not exist so far, however as the design of SHA256 is similar to SHA1 it is probably defensive for applications to use double SHA256. And this is what bitcoin does, it is not necessary given hashcash reliance on preimage security, but it is a defensive step against future cryptanalytic developments. The attack on SHA1 and in principle other hashes of similar design like SHA256, was also the motivation for the NIST SHA3 design competition which is still ongoing.</p>
</blockquote>

CC BY-SA 3.0
2017-01-05T18:34:22.890Z
That may be what the Wiki says, but that is not actually what it does. A collision in the single version (`hash(x)==hash(y)`) implies a collision in the double version. So the Wiki article is wrong.
mikeazo
CC BY-SA 3.0
2018-04-10T20:17:33.353Z
The wiki answer is wrong. See my answer below for a more thorough explanation
Zain Rizvi
CC BY-SA 3.0
2014-03-07T02:44:18.093Z
2014-03-07T02:44:18.093Z
Claudiu
<p>My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the <code>RIPEMD160(SHA256)</code>.</p>
<p>My lengthy and elaborate rationale is in <a href="https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565">my answer</a> on the related question.</p>

CC BY-SA 4.0
2022-03-02T11:51:33.367Z
I am advocating that _intelligent_ readers ignore all [politically motivated down votes](https://gist.github.com/shelby3/9613df1445c54f69c4c4f198a7c85cb9#why-did-satoshi-employ-double-hashing), i.e. all those that aren’t substantiated with a factual comment explaining why the answer is incorrect or not germane to the question. Subjective emotions and ignorance have scant utility against steelmanning logic. Imagine a platform for transparency where the identities of worthless, witness, pointless, imbecilic downvoters are hidden from the public.
Shelby Moore III
CC BY-SA 4.0
2022-02-22T10:34:30.290Z
2022-02-22T10:34:30.290Z
Shelby Moore III
<p>We don't know for sure, but the most popular theory is that a double hash was chosen to protect against <a href="http://en.wikipedia.org/wiki/Length_extension_attack">length extension attacks</a>.</p>

CC BY-SA 4.0
2022-02-22T02:48:13.843Z
Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.
Shelby Moore III
CC BY-SA 3.0
2013-01-07T06:35:01.657Z
2013-01-07T06:35:01.657Z
David Schwartz
<p>According to <a href="https://en.bitcoin.it/wiki/Protocol_specification#Hashes" rel="noreferrer">the wiki specification of the bitcoin protocol</a>, hashes are typically "computed twice". <a href="https://bitcoin.stackexchange.com/questions/5671/how-do-you-perform-double-sha-256-encoding">For example</a>:</p>

<pre><code>hello
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 (first round of sha-256)
9595c9df90075148eb06860365df33584b75bff782a510c6cd4883a419833d50 (second round of sha-256)
</code></pre>

<p>What is the reasoning for this? I imagine it somehow provides additional security, or protection against potential attack vectors, but I can't reason what those attacks might be.</p>

<hash><sha256>
Why are hashes in the bitcoin protocol typically computed twice (double computed)?
Stephen McCarthy
# Why are hashes in the bitcoin protocol typically computed twice (double computed)?

(Asked by: username_0 on 2013-01-07)

According to [the wiki specification of the bitcoin protocol](https://en.bitcoin.it/wiki/Protocol_specification#Hashes), hashes are typically "computed twice". [For example](https://bitcoin.stackexchange.com/questions/5671/how-do-you-perform-double-sha-256-encoding):

```
hello
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 (first round of sha-256)
9595c9df90075148eb06860365df33584b75bff782a510c6cd4883a419833d50 (second round of sha-256)

```

What is the reasoning for this? I imagine it somehow provides additional security, or protection against potential attack vectors, but I can't reason what those attacks might be.

**Tags:** hash, sha256


---

## 5 answers

### Answer by username_5 on 2013-01-07. Score: 21 | Accepted answer

We don't know for sure, but the most popular theory is that a double hash was chosen to protect against [length extension attacks](http://en.wikipedia.org/wiki/Length_extension_attack).

> **Comments:**
> **username_3**: Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.  

---

### Answer by username_1 on 2017-01-05. Score: 18

The wiki claim that this is to prevent birthday attacks is wrong. If you can successfully execute a birthday attack on a single call to the hash function, you get a successful birthday attack on the second call. This is easy to see as having `hash(x) == hash(y)` implies `hash(hash(x)) == hash(hash(y))`.

If you really wanted to guard against this, you would do something like `hash(x||hash(x))`. Finding a collision in a single call to `hash` in this case would not directly yield a collision in the double call.


---

### Answer by username_2 on 2018-03-09. Score: 14

Like others have said, the wiki claim of this preventing birthday attacks is wrong. Rather, this was meant to prevent against [length extension attacks](https://en.wikipedia.org/wiki/Length_extension_attack).

From <https://crypto.stackexchange.com/a/884/56797>:

> SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
> excellent book "Practical Cryptography" (later updated by Ferguson,
> Schneier, and Kohno and renamed "Cryptography Engineering") as a way
> to make SHA-256 invulnerable to "length-extension" attack. They called
> it "SHA-256d". We started using SHA-256d for everything when we
> launched the Tahoe-LAFS project in 2006, on the principle that it is
> hardly less efficient than SHA-256, and that it frees us from having
> to reason about whether length-extension attacks are dangerous every
> place that we use a hash function. I wouldn't be surprised if the
> inventors of Bitcoin used it for similar reasons. Why not use SHA-256d
> instead of SHA-256?
>
> Note that the SHA-3 project required all candidates to have some
> method of preventing length-extension attacks. Some of them use a
> method that is rather like SHA-256d, i.e. they do an extra
> "finalization" hash of their state at the end, before emitting a
> result.

> **Comments:**
> **username_3**: Length extension attacks [are impossible in Bitcoin](https://bitcoin.stackexchange.com/questions/110065/checksum-sha256sha256prefixdata-why-double-hashing#comment124932_110071) because length extension attacks only apply where the hashed data is secret. This answer is incorrect.  

---

### Answer by username_4 on 2014-03-07. Score: 12

The wiki [answers this](https://en.bitcoin.it/wiki/Hashcash). TLDR: to prevent against [birthday attacks](http://en.wikipedia.org/wiki/Birthday_attack).

> Bitcoin is using two hash iterations (denoted SHA256^2 ie "SHA256 function squared") and the reason for this relates to a partial attack on the smaller but related SHA1 hash. SHA1's resistance to birthday attacks has been partially broken as of 2005 in O(2^64) vs the design O(2^80). While hashcash relies on pre-image resistance and so is not vulnerable to birthday attacks, a generic method of hardening SHA1 against the birthday collision attack is to iterate it twice. A comparable attack on SHA256 does not exist so far, however as the design of SHA256 is similar to SHA1 it is probably defensive for applications to use double SHA256. And this is what bitcoin does, it is not necessary given hashcash reliance on preimage security, but it is a defensive step against future cryptanalytic developments. The attack on SHA1 and in principle other hashes of similar design like SHA256, was also the motivation for the NIST SHA3 design competition which is still ongoing.

> **Comments:**
> **username_1**: That may be what the Wiki says, but that is not actually what it does. A collision in the single version (`hash(x)==hash(y)`) implies a collision in the double version. So the Wiki article is wrong.  
> **username_2**: The wiki answer is wrong. See my answer below for a more thorough explanation  

---

### Answer by username_3 on 2022-02-22. Score: -4

My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the `RIPEMD160(SHA256)`.

My lengthy and elaborate rationale is in [my answer](https://bitcoin.stackexchange.com/questions/9202/why-does-bitcoin-use-two-hash-functions-sha-256-and-ripemd-160-to-create-an-ad/112565#112565) on the related question.

> **Comments:**
> **username_3**: I am advocating that _intelligent_ readers ignore all [politically motivated down votes](https://gist.github.com/shelby3/9613df1445c54f69c4c4f198a7c85cb9#why-did-satoshi-employ-double-hashing), i.e. all those that aren’t substantiated with a factual comment explaining why the answer is incorrect or not germane to the question. Subjective emotions and ignorance have scant utility against steelmanning logic. Imagine a platform for transparency where the identities of worthless, witness, pointless, imbecilic downvoters are hidden from the public.  

---

