HASH160: SHA-256 then RIPEMD-160

Wonder

1. Why would Bitcoin use two different hash functions in sequence?
2. What does a 160-bit hash offer that a 256-bit one does not?
3. How can a 20-byte hash be both secure and vulnerable?

Explore

1. A raw public key in Bitcoin is 33 bytes when compressed. This is too long for efficient use in transactions. To reduce it without losing cryptographic integrity, Bitcoin applies a two-step process: SHA-256 followed by RIPEMD-160. This combination is called HASH160 and results in a 160-bit (20-byte) output, compact enough for address encoding.
2. RIPEMD-160, designed in 1996 by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel, provides a shorter output than SHA-256 and came from an open academic design process. SHA-256 is first applied to the public key (or, for P2SH, the script), then RIPEMD-160 is applied to the SHA-256 output. This sequence provides a balance of security and efficiency, and it is used in Pay-to-PubKey-Hash (P2PKH), Pay-to-Script-Hash (P2SH), and Pay-to-Witness-PubKey-Hash (P2WPKH) outputs.
3. The use of two distinct hash functions adds a layer of defense in depth. Nesting helps mainly against preimage attacks, since finding a key that matches a given hash would mean defeating both functions; it does not help against collisions, because any SHA-256 collision is also a HASH160 collision. However, 160 bits of output implies a collision resistance of about 80 bits, which is acceptable for single-key address outputs. It becomes problematic in shared scripts where multiple parties contribute, which is why SegWit and Taproot use 32-byte values for native scripts.
4. A common claim is that hashing the key protects coins against future quantum computers. The protection is partial. Spending reveals the public key, so it covers only outputs whose keys have never been shown; address reuse removes it; and Taproot outputs place a public key directly on-chain. A capable quantum computer would threaten any exposed key.
5. To construct a Bitcoin address from a public key, HASH160 is applied, then the result is prefixed with a network identifier (0x00 for mainnet P2PKH), followed by a 4-byte checksum derived from double SHA-256. This 25-byte sequence is then Base58-encoded to create a human-readable address. This encoding removes ambiguous characters and includes a checksum to detect transcription errors.
6. To see this in practice, open a block explorer and search for a P2PKH transaction. Locate the scriptPubKey field, which should include the 20-byte hash. Compare this to the public key revealed when the output was spent. You will see that the public key is longer, and the hash is the shortened, encoded version used in the address.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• Dobbertin, Bosselaers & Preneel, 'RIPEMD-160' (1996)
• Mastering Bitcoin, 3rd ed. (2023)
• Bitcoin Wiki, 'Technical background of version 1 Bitcoin addresses'