<blockquote>
  <p>Is there a property on the SHA-256 function that asserts that on these 320 bits of freedom, one combination will give us a hash that is matching the diff requirements?</p>
</blockquote>

<p>No.</p>

<p>AFAIK there are in general hardly any research results about the possible SHA-256 output values and their probabilities.</p>

<p>Satoshi Nakamoto probably assumed that you will always be able to find a possible block by modifying the nonce and the Merkle root.</p>

<blockquote>
  <p>If not, does that mean that the blockchain could get stuck on a block because nobody can mine on it?</p>
</blockquote>

<p>Yes (Theoretically, but it is very unlikely which was already pointed out by Alpha)</p>

<p>Let us try to be more precise. If you only change the nonce and the Merkle root there are <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=256%2b32=288" alt="256 + 32 = 288"> bits you can change. So you have <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=2%5E%7B288%7D%5Chspace%7B1cm%7D(%5Csim%204.97%5Ctimes10%5E%7B86%7D)" alt="2&lt;sup&gt;288&lt;/sup&gt; (~4.97 x 10&lt;sup&gt;86&lt;/sup&gt;)"> possible inputs for the SHA-256 function ( If you find all <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=2%5E%7B256%7D" alt="2&lt;sup&gt;256&lt;/sup&gt;"> possible Merkle roots, which is also very difficult admittedly. but let's assume you accomplish this because you have many ways to change the Merkle root like changing bytes in the coinbase transaction and you can choose every combination of arbitrary valid transactions from the mempool).</p>

<p>Now take a look at the possible SHA-256 results, there are <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=16%5E%7B64%7D%5Chspace%7B1cm%7D(%5Csim%201.16%5Ctimes10%5E%7B77%7D)" alt="16&lt;sup&gt;64&lt;/sup&gt;(~1.16 x 10&lt;sup&gt;77&lt;/sup&gt;)"> possible SHA-256 outputs and <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=2%5E%7B288%7D%5Chspace%7B1cm%7D(%5Csim%204.97%5Ctimes10%5E%7B86%7D)" alt="2&lt;sup&gt;288&lt;/sup&gt; (~4.97 x 10&lt;sup&gt;86&lt;/sup&gt;)"> possible inputs. With these you should be able to find atleast one hash below the target. It would then be possible to create a new block.</p>

<p>Remember there are <img src="https://chart.googleapis.com/chart?cht=tx&amp;chl=%5Cfrac%7B2%5E%7B256%7D%7D%7B16%5E%7B64%7D%7D%20=%202%5E%7B32%7D%20=%204294967296" alt="2^288/16^64=2^32=4294967296"> times more inputs than the possible SHA-256 outputs.</p>

CC BY-SA 3.0
2018-01-02T16:50:32.647Z
2018-01-03T09:04:16.107Z
2018-01-03T09:04:16.107Z
anion
<p>The hash of a bitcoin block is generated from:</p>

<ol>
<li>Block version number (partially fixed<sup>*</sup>, 32 bits)</li>
<li>Previous block hash (fixed, 256 bits)</li>
<li>Merkle root (not fixed, 256 bits),</li>
<li>Time (not fixed, 32 bits),</li>
<li>Bits (partially fixed<sup>*</sup>, 32 bits),</li>
<li>Nonce (not fixed, 32 bits).</li>
</ol>

<p>So, the block hash is generated from 640 bits.
You can change 320 bits freely to try to have a hash that matches the current diff, and 320 bits are immutable.</p>

<p>Is there a property on the SHA-256 function that asserts that on these 320 bits of freedom, one combination will give us a hash that is matching the diff requirements?</p>

<p>If not, does that mean that the blockchain could get stuck on a block because nobody can mine on it?</p>

<hr>

<p><sup>* <em>"Partially fixed"</em> values could be changed by software updates for example. I assume that <em>partially fixed</em> values are fixed to simplify.</sup></p>

CC BY-SA 3.0
2018-01-03T09:17:42.070Z
The bits value is completely fixed. If you get it wrong, the block will be invalid.
Pieter Wuille
<bitcoin-core><mining-theory>
Is it possible to get stuck with a block that nobody can mine?
Jules Lamur
# Is it possible to get stuck with a block that nobody can mine?

(Asked by: username_0 on 2018-01-02)

The hash of a bitcoin block is generated from:

1. Block version number (partially fixed\*, 32 bits)
2. Previous block hash (fixed, 256 bits)
3. Merkle root (not fixed, 256 bits),
4. Time (not fixed, 32 bits),
5. Bits (partially fixed\*, 32 bits),
6. Nonce (not fixed, 32 bits).

So, the block hash is generated from 640 bits.
You can change 320 bits freely to try to have a hash that matches the current diff, and 320 bits are immutable.

Is there a property on the SHA-256 function that asserts that on these 320 bits of freedom, one combination will give us a hash that is matching the diff requirements?

If not, does that mean that the blockchain could get stuck on a block because nobody can mine on it?

---

\* *"Partially fixed"* values could be changed by software updates for example. I assume that *partially fixed* values are fixed to simplify.

**Tags:** bitcoin-core, mining-theory

> **Comments:**
> **username_1**: The bits value is completely fixed. If you get it wrong, the block will be invalid.  

---

## 1 answers

### Answer by username_2 on 2018-01-02. Score: 2 | Accepted answer

> Is there a property on the SHA-256 function that asserts that on these 320 bits of freedom, one combination will give us a hash that is matching the diff requirements?

No.

AFAIK there are in general hardly any research results about the possible SHA-256 output values and their probabilities.

Satoshi Nakamoto probably assumed that you will always be able to find a possible block by modifying the nonce and the Merkle root.

> If not, does that mean that the blockchain could get stuck on a block because nobody can mine on it?

Yes (Theoretically, but it is very unlikely which was already pointed out by Alpha)

Let us try to be more precise. If you only change the nonce and the Merkle root there are ![256 + 32 = 288](https://chart.googleapis.com/chart?cht=tx&chl=256%2b32=288) bits you can change. So you have ![2<sup>288</sup> (~4.97 x 10<sup>86</sup>)](https://chart.googleapis.com/chart?cht=tx&chl=2%5E%7B288%7D%5Chspace%7B1cm%7D(%5Csim%204.97%5Ctimes10%5E%7B86%7D)) possible inputs for the SHA-256 function ( If you find all ![2<sup>256</sup>](https://chart.googleapis.com/chart?cht=tx&chl=2%5E%7B256%7D) possible Merkle roots, which is also very difficult admittedly. but let's assume you accomplish this because you have many ways to change the Merkle root like changing bytes in the coinbase transaction and you can choose every combination of arbitrary valid transactions from the mempool).

Now take a look at the possible SHA-256 results, there are ![16<sup>64</sup>(~1.16 x 10<sup>77</sup>)](https://chart.googleapis.com/chart?cht=tx&chl=16%5E%7B64%7D%5Chspace%7B1cm%7D(%5Csim%201.16%5Ctimes10%5E%7B77%7D)) possible SHA-256 outputs and ![2<sup>288</sup> (~4.97 x 10<sup>86</sup>)](https://chart.googleapis.com/chart?cht=tx&chl=2%5E%7B288%7D%5Chspace%7B1cm%7D(%5Csim%204.97%5Ctimes10%5E%7B86%7D)) possible inputs. With these you should be able to find atleast one hash below the target. It would then be possible to create a new block.

Remember there are ![2^288/16^64=2^32=4294967296](https://chart.googleapis.com/chart?cht=tx&chl=%5Cfrac%7B2%5E%7B256%7D%7D%7B16%5E%7B64%7D%7D%20=%202%5E%7B32%7D%20=%204294967296) times more inputs than the possible SHA-256 outputs.


---

