<p>There is no concatenation. The nonce is part of the block header. The block header is 80 bytes and is hashed twice. That means you first sha-256 hash the 80 byte block header, and then you hash the hash.</p>

<p>Starting different users in a pool at different nonce values would be useless. With modern hardware all possible nonce values are processed in a split second.</p>

<p>Instead different users are given a different template from which to generate different blocks (small variations of the same block). After a miner has tried all nonce values it generates a new block from the template and starts over.</p>

<p>Using templates ensures that each client can generate their own work without needing to talk to a mining pool server many times per second.</p>

<p>Using different templates for each user ensures that no two users in the pool will ever do the same work.</p>

<p>What part of the work does an ASIC chip do: <a href="https://bitcoin.stackexchange.com/a/41775/141">https://bitcoin.stackexchange.com/a/41775/141</a></p>

<p>Mining protocols: <a href="https://bitcoin.stackexchange.com/a/13307/141">https://bitcoin.stackexchange.com/a/13307/141</a></p>

CC BY-SA 3.0
2015-12-21T21:05:55.653Z
2015-12-21T21:05:55.653Z
2017-04-13T12:47:36.707Z
Dr.Haribo
<p><strong>There is no precise nonce finding protocol.</strong></p>

<p>The miner can <strong>arbitrarily</strong> choose a nonce c to perform the hashing operation.</p>

<p><strong>Mining is a mathematical game</strong> where the goal is to make the result of the hash function smaller than a given number (this is what "a result starting with x zeros" is looking for). The number is directly based on the current Bitcoin network difficulty and changes every two weeks to keep average block finding time at 600 seconds.</p>

<p><strong>Most nonce generators just increment by 1</strong> but the key is where they start. If you are solo mining, you can pick a random number. If you are mining with multiple devices or you are a pool administrator, you have to divide the work to avoid calculating the same hash twice (make sure they never use the same c).</p>

CC BY-SA 3.0
2015-12-21T23:24:45.893Z
What I meant was the synonymous word procedure, "A particular method for performing a task", so there is indeed a nonce finding protocol/procedure.
Erik Vesterlund
CC BY-SA 3.0
2015-12-21T23:37:40.847Z
precise is the operative word
Ron
CC BY-SA 3.0
2015-12-21T23:45:37.067Z
What do you mean? There is no ambiguity in the procedure. That all parameters are not decided beforehand doesn't mean the procedure is not precise.
Erik Vesterlund
CC BY-SA 3.0
2015-12-21T23:47:47.560Z
other than its size in bits, there is no protocol governing the generation of nonce values. Therefore there can be no precise procedure to generate it. Start at 0 and add 1, start at MAX and subtract 1... they're all valid.
Ron
CC BY-SA 3.0
2015-12-21T23:58:03.243Z
Yes but we're talking nonce finding, aren't we? Def: A nonce c is found if hash(hash(header||c)) < bound.
Erik Vesterlund
CC BY-SA 3.0
2015-12-22T01:38:42.817Z
From what I understand, any c is a nonce. If the result of the hash satisfies the requirements then you can call it a golden nonce. You point this out in your question with "finding a nonce c such that...", if the nonce only described the winners then there would be no need for "such that". If this is what you mean then your question is asking how to find a successful bitcoin block, the answer is brute force with any algorithm.
Ron
CC BY-SA 4.0
2021-03-15T05:02:52.807Z
@Ron your answer is somewhat contrary to Dr.Haribo's regarding the statement "Starting different users in a pool at different nonce values would be useless. With modern hardware all possible nonce values are processed in a split second."
Prince M
CC BY-SA 4.0
2021-04-26T16:13:43.970Z
@PrinceM The nonce is just one part of the header; given that it is only 32-bit (4 billion values), a miner with a hash rate of more than 4GH/s will process all possible nonce values in under a second. Dr.Haribo is correct here that you would need to modify other parts of the header such as the merkle root (by changing the tx list) or time.
Ron
CC BY-SA 3.0
2015-12-21T21:05:00.607Z
2015-12-21T23:39:14.760Z
2015-12-21T23:39:14.760Z
Ron
<p>There is no "protocol" for finding a suitable nonce value. Any value that, after hashing, produces a result matching the current difficulty is acceptable. How a given miner finds that value is completely up to the miner. It's not of any benefit for all miners to start at the same value (0) and work upwards, because then all but the fastest miner is duplicating work that others have already just done (and by definition, the fastest miner will win). So it is beneficial for miners to start somewhere where they don't think anybody else will have looked yet.</p>

CC BY-SA 3.0
2015-12-20T20:14:23.283Z
I think you misunderstand my admittedly poorly phrased question. What I want to know is what must the miner compute? "Any value that, after hashing, produces a result matching the current difficulty is acceptable" - it is the hashing part I'm asking about. What precisely is hashed? blockheader||nonceOfMinersChoice, or hash(blockheader)||nonceOfMinersChoice, or something else?
Erik Vesterlund
CC BY-SA 3.0
2015-12-20T20:21:19.503Z
@ErikVesterlund: The hash is computed as `h(s||c)` (which means "concatenate the header and the nonce, and then hash the result") just as the text you quoted says. In the case of Bitcoin, the hash function is `h(x) = SHA256(SHA256(x))`.
Greg Hewgill
CC BY-SA 3.0
2015-12-20T20:24:07.507Z
So to be clear, it is sha256(sha256(s||c)), not sha256(s||c) or sha256(sha256(s)||c)?
Erik Vesterlund
CC BY-SA 3.0
2015-12-20T20:50:09.133Z
@ErikVesterlund: Yes, that's right.
Greg Hewgill
CC BY-SA 3.0
2015-12-21T20:45:53.370Z
No, you don't concatenate the nonce after the first hashing and then hash again. The nonce is part of the header, so it part of the first hashing.
Dr.Haribo
CC BY-SA 3.0
2015-12-20T20:09:27.163Z
2015-12-20T20:09:27.163Z
Greg Hewgill
<p>This mining simulator is a good visual of what is being hashed. </p>

<p><a href="http://www.yogh.io/#mine:last" rel="noreferrer">http://www.yogh.io/#mine:last</a></p>

<p>People are correct you don't have to change the Nonce it's just the fastest way to get a different hash output.  You could very well keep the nonce at 1 and change the timestamp, or the list of included transactions, which would change the merkelroot.</p>

<p>What's being hashed is version + previous block hash + merkel root + time + bits (target) + nonce.  This gets hashed twice sha256(sha256(blockheader))</p>

<p>The code and description here is pre
<a href="https://en.bitcoin.it/wiki/Block_hashing_algorithm" rel="noreferrer">https://en.bitcoin.it/wiki/Block_hashing_algorithm</a></p>

CC BY-SA 3.0
2015-12-23T22:58:46.847Z
Thanks! I mark this as _the_ answer since it answers my primary concern without the need for further clarifying
Erik Vesterlund
CC BY-SA 3.0
2016-02-21T11:47:37.643Z
The mining simulator is pretty cool!
Murch
CC BY-SA 3.0
2015-12-22T22:09:06.773Z
2015-12-22T22:09:06.773Z
Dustin Butler
<p>There are many descriptions of what mining is, but none of them describe it exactly. From what I gather:</p>

<blockquote>
  <p>Mining means finding a nonce c such that for some information s the hash value h(s||c) begins with a certain number of zeros (h is sha-256, || concatenation).</p>
</blockquote>

<p>The "information" is given <a href="https://en.bitcoin.it/wiki/Block_hashing_algorithm" rel="noreferrer">here</a>. The nonce is an integer that is incremented in the mining process. But it seems that it's not s||c that is hashed, but rather there is some double hashing going on, but of what, h(s)||c, h(s||c), h(s)||h(c)? I can't deduce it from the Python code in the previous link (NB: I'm code illiterate).</p>

<p>Also the nonce isn't just initialized at zero and then incremented until there's success:</p>

<blockquote>
  <p>To avoid risking wasting work in this way, there needs to be a random starting point, and so the work becomes to find H(s,x,c)/2^(n-k) = 0 where x is random (eg 128-bits to make it statistically infeasible for two users to maliciously or accidentally start at the same point), and c is the counter being varied, and s is the service string. <a href="https://en.bitcoin.it/wiki/Hashcash#Adding_purpose" rel="noreferrer">(source)</a></p>
</blockquote>

<p>But that's the article describing hashcash, and who knows bitcoin might not have implemented the hashcash protocol as it was proposed.</p>

<p>So my question is, what is the exact protocol? I'd go and read the source code if I could but like I said I'm not code literate. Surely the answer must be possible to formulate concisely, something like:</p>

<blockquote>
  <p>Compute h(s||c) where c runs over 0,1,... until value begins with 15 zeros.</p>
</blockquote>

<p>or</p>

<blockquote>
  <p>Hash s and obtain x in manner X, then compute h(h(s)||c) where c runs over x,x+1,..., until value begins with 17 zeros.</p>
</blockquote>

<p>Sorry if this has been asked before, if so clearly I'm googling the wrong words, thanks.</p>

<mining-theory><nonce>
What is the precise nonce finding protocol?
Erik Vesterlund
# What is the precise nonce finding protocol?

(Asked by: username_0 on 2015-12-20)

There are many descriptions of what mining is, but none of them describe it exactly. From what I gather:

> Mining means finding a nonce c such that for some information s the hash value h(s||c) begins with a certain number of zeros (h is sha-256, || concatenation).

The "information" is given [here](https://en.bitcoin.it/wiki/Block_hashing_algorithm). The nonce is an integer that is incremented in the mining process. But it seems that it's not s||c that is hashed, but rather there is some double hashing going on, but of what, h(s)||c, h(s||c), h(s)||h(c)? I can't deduce it from the Python code in the previous link (NB: I'm code illiterate).

Also the nonce isn't just initialized at zero and then incremented until there's success:

> To avoid risking wasting work in this way, there needs to be a random starting point, and so the work becomes to find H(s,x,c)/2^(n-k) = 0 where x is random (eg 128-bits to make it statistically infeasible for two users to maliciously or accidentally start at the same point), and c is the counter being varied, and s is the service string. [(source)](https://en.bitcoin.it/wiki/Hashcash#Adding_purpose)

But that's the article describing hashcash, and who knows bitcoin might not have implemented the hashcash protocol as it was proposed.

So my question is, what is the exact protocol? I'd go and read the source code if I could but like I said I'm not code literate. Surely the answer must be possible to formulate concisely, something like:

> Compute h(s||c) where c runs over 0,1,... until value begins with 15 zeros.

or

> Hash s and obtain x in manner X, then compute h(h(s)||c) where c runs over x,x+1,..., until value begins with 17 zeros.

Sorry if this has been asked before, if so clearly I'm googling the wrong words, thanks.

**Tags:** mining-theory, nonce


---

## 4 answers

### Answer by username_5 on 2015-12-22. Score: 8 | Accepted answer

This mining simulator is a good visual of what is being hashed.

<http://www.yogh.io/#mine:last>

People are correct you don't have to change the Nonce it's just the fastest way to get a different hash output. You could very well keep the nonce at 1 and change the timestamp, or the list of included transactions, which would change the merkelroot.

What's being hashed is version + previous block hash + merkel root + time + bits (target) + nonce. This gets hashed twice sha256(sha256(blockheader))

The code and description here is pre
<https://en.bitcoin.it/wiki/Block_hashing_algorithm>

> **Comments:**
> **username_0**: Thanks! I mark this as _the_ answer since it answers my primary concern without the need for further clarifying  
> **username_6**: The mining simulator is pretty cool!  

---

### Answer by username_1 on 2015-12-21. Score: 4

There is no concatenation. The nonce is part of the block header. The block header is 80 bytes and is hashed twice. That means you first sha-256 hash the 80 byte block header, and then you hash the hash.

Starting different users in a pool at different nonce values would be useless. With modern hardware all possible nonce values are processed in a split second.

Instead different users are given a different template from which to generate different blocks (small variations of the same block). After a miner has tried all nonce values it generates a new block from the template and starts over.

Using templates ensures that each client can generate their own work without needing to talk to a mining pool server many times per second.

Using different templates for each user ensures that no two users in the pool will ever do the same work.

What part of the work does an ASIC chip do: <https://bitcoin.stackexchange.com/a/41775/141>

Mining protocols: <https://bitcoin.stackexchange.com/a/13307/141>


---

### Answer by username_2 on 2015-12-21. Score: 2

**There is no precise nonce finding protocol.**

The miner can **arbitrarily** choose a nonce c to perform the hashing operation.

**Mining is a mathematical game** where the goal is to make the result of the hash function smaller than a given number (this is what "a result starting with x zeros" is looking for). The number is directly based on the current Bitcoin network difficulty and changes every two weeks to keep average block finding time at 600 seconds.

**Most nonce generators just increment by 1** but the key is where they start. If you are solo mining, you can pick a random number. If you are mining with multiple devices or you are a pool administrator, you have to divide the work to avoid calculating the same hash twice (make sure they never use the same c).

> **Comments:**
> **username_0**: What I meant was the synonymous word procedure, "A particular method for performing a task", so there is indeed a nonce finding protocol/procedure.  
> **username_2**: precise is the operative word  
> **username_0**: What do you mean? There is no ambiguity in the procedure. That all parameters are not decided beforehand doesn't mean the procedure is not precise.  
> **username_2**: other than its size in bits, there is no protocol governing the generation of nonce values. Therefore there can be no precise procedure to generate it. Start at 0 and add 1, start at MAX and subtract 1... they're all valid.  
> **username_0**: Yes but we're talking nonce finding, aren't we? Def: A nonce c is found if hash(hash(header||c)) < bound.  
> **username_2**: From what I understand, any c is a nonce. If the result of the hash satisfies the requirements then you can call it a golden nonce. You point this out in your question with "finding a nonce c such that...", if the nonce only described the winners then there would be no need for "such that". If this is what you mean then your question is asking how to find a successful bitcoin block, the answer is brute force with any algorithm.  
> **username_3**: @username_2 your answer is somewhat contrary to username_1's regarding the statement "Starting different users in a pool at different nonce values would be useless. With modern hardware all possible nonce values are processed in a split second."  
> **username_2**: @username_3 The nonce is just one part of the header; given that it is only 32-bit (4 billion values), a miner with a hash rate of more than 4GH/s will process all possible nonce values in under a second. username_1 is correct here that you would need to modify other parts of the header such as the merkle root (by changing the tx list) or time.  

---

### Answer by username_4 on 2015-12-20. Score: 0

There is no "protocol" for finding a suitable nonce value. Any value that, after hashing, produces a result matching the current difficulty is acceptable. How a given miner finds that value is completely up to the miner. It's not of any benefit for all miners to start at the same value (0) and work upwards, because then all but the fastest miner is duplicating work that others have already just done (and by definition, the fastest miner will win). So it is beneficial for miners to start somewhere where they don't think anybody else will have looked yet.

> **Comments:**
> **username_0**: I think you misunderstand my admittedly poorly phrased question. What I want to know is what must the miner compute? "Any value that, after hashing, produces a result matching the current difficulty is acceptable" - it is the hashing part I'm asking about. What precisely is hashed? blockheader||nonceOfMinersChoice, or hash(blockheader)||nonceOfMinersChoice, or something else?  
> **username_4**: @username_0: The hash is computed as `h(s||c)` (which means "concatenate the header and the nonce, and then hash the result") just as the text you quoted says. In the case of Bitcoin, the hash function is `h(x) = SHA256(SHA256(x))`.  
> **username_0**: So to be clear, it is sha256(sha256(s||c)), not sha256(s||c) or sha256(sha256(s)||c)?  
> **username_4**: @username_0: Yes, that's right.  
> **username_1**: No, you don't concatenate the nonce after the first hashing and then hash again. The nonce is part of the header, so it part of the first hashing.  

---

