Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Bitcoin mining relies on generating a smaller hash than the so-called target (a function of the so-called difficultly), thus is vulnerable to a truncated preimage attack (you just need to obtain a certain number of leading zeroes).

I believe this is called a near preimage attack.

What is the current status of attacking truncated second preimages of SHA-256?

share|improve this question
Actually, Bitcoin mining seems closer to requiring to find $X$ such that $\text{SHA-256}(\text{SHA-256}(X))<\text{target}$ (I have the details fuzzy); so the function to attack is not $\text{SHA-256}$, but rather $\text{SHA-256}^2$. In any case, I know no attack, even theoretical, on even (full) $\text{SHA-256}$. – fgrieu Mar 27 '14 at 7:41
Often referred to as SHA-256d – figlesquidge Mar 27 '14 at 10:01
As far as I know, bitcoin mining is pretty much a brute-force effort: Try out different combinations, e.g. starting at a random value and then increment by $1$, so that you don't cover numbers that someone else already checked. There is no cryptanalysis done, or any kind of advanced attack technique. – tylo Mar 27 '14 at 14:29
@tylo I think the question was whether cryptanalysis techniques existed to improve upon brute force and thereby defeat the Bitcoin proof-of-work scheme. – Thomas Mar 28 '14 at 13:32

The current status as of the time I write this is: There are no known attacks on second pre-images for truncated SHA-256 that are faster than brute force.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.