<p>As per <a href="https://bitcointalk.org/index.php?topic=1895455.msg18850808#msg18850808" rel="nofollow noreferrer">this</a> post by Gregory Maxwell, HASH160 provides enough security for the trivial case of public key hash based addresses, whereas script hash addresses can benefit from the additional protection against collisions provided by a longer hash.</p>

<p>The rest of the thread covers more details of the benefits of moving to sha256.</p>

CC BY-SA 4.0
2019-12-14T21:34:28.960Z
The strength of cryptographic hash is at best half that of the smallest hash of a cascaded chain of hash functions.  Hence, a Hash160 (sha256 | ripemd160) is only good for at most 80 bits of uniqueness. This means there is huge set of different private keys with public keys that can be hashed to the same address, a private key  to public address birthday attack if you will.
skaht
CC BY-SA 4.0
2019-12-15T19:09:58.757Z
@skaht Yes, but that's for collision attacks. For preimage attacks it's equal to the size of the smallest hash in the chain. Collision attacks are only a concern when you're jointly constructing an address with someone else (who you don't trust).
Pieter Wuille
CC BY-SA 4.0
2019-12-14T02:27:45.297Z
2019-12-14T02:27:45.297Z
Raghav Sood
<p>Why is it acceptable to use a  20 byte hash to represent single-sig witness programs whereas a 32 byte hash is used for pay to witness script hash?</p>

<security><segregated-witness><output>
Why is a 20 byte hash acceptable in p2wpkh but p2wsh needs 32 bytes?
Murch
# Why is a 20 byte hash acceptable in p2wpkh but p2wsh needs 32 bytes?

(Asked by: username_0 on 2019-12-13)

Why is it acceptable to use a 20 byte hash to represent single-sig witness programs whereas a 32 byte hash is used for pay to witness script hash?

**Tags:** security, segregated-witness, output


---

## 1 answers

### Answer by username_1 on 2019-12-14. Score: 1

As per [this](https://bitcointalk.org/index.php?topic=1895455.msg18850808#msg18850808) post by Gregory Maxwell, HASH160 provides enough security for the trivial case of public key hash based addresses, whereas script hash addresses can benefit from the additional protection against collisions provided by a longer hash.

The rest of the thread covers more details of the benefits of moving to sha256.

> **Comments:**
> **username_2**: The strength of cryptographic hash is at best half that of the smallest hash of a cascaded chain of hash functions.  Hence, a Hash160 (sha256 | ripemd160) is only good for at most 80 bits of uniqueness. This means there is huge set of different private keys with public keys that can be hashed to the same address, a private key  to public address birthday attack if you will.  
> **username_3**: @username_2 Yes, but that's for collision attacks. For preimage attacks it's equal to the size of the smallest hash in the chain. Collision attacks are only a concern when you're jointly constructing an address with someone else (who you don't trust).  

---

