Hash function and Digital Encryption Algorithm

Question

I am familiar with the fundamentals of cryptography as well as Digital Signatures. I understand how DSA like RSA works and the fundamentals of mathematics behind digital signing and verification. I also have a reasonable understanding of how bitcoin works. However I can not understand the role of hash function (SHA-256) in bitcoin blockchain.

The role of a private key and its corresponding public key seems clear to me.

• A public key can be used by the sender of a message to encrypt the message than can only be decrypted with the private key of the recipient.
• A private key can be use to sign a message, so when the message is encrypted with the private key the recipient can verify, by using the public key, that the message must have been signed by the owner of the private key.

The questions rises is bitcoin protocol. I understand that the public key is use to derive the bitcoin address. Therefore, having the private key associated to that address allows you to prove that you are the owner of that address.

The hash function (SHA-256) is used to make the digest of the of the transaction and block in the block chain. Somewhere I read that “To save time, digital signature protocols are often implemented with one-way hash functions (...). Instead of signing a document, Alice signs the hash of the document.”

I've got three related questions:

1. Is that the only role of the hash function in the bitcoin protocol?

2. What is the role of the hash function in the verification of the ownership of the address?

3. Couldn’t we get the same result of proving ownership without the hash function?

Answer 1

One reason ECDSA (the elliptic curve variant of DSA used by Bitcoin) first hashes data is to make forging signatures harder. Consider the first two steps in ECDSA:

1. Calculate $e = \text{HASH}(m)$, where $\text{HASH}$ is a cryptographic hash function, such as SHA-2.
2. Let $z$ be the $L_n$ leftmost bits of $e$, where $L_n$is the bit length of the group order $n$.

Suppose instead that $z$ is the $L_n$ leftmost bits of the message $m$ instead. In that case the resulting signature is a valid signature for any message $m$ with the same $L_n$ leftmost bits. In the case of ECDSA in bitcoin $L_n = 256$, or 32 bytes (which would be 32 characters in ASCII encoding). This gives a lot of possible ways to forge a message as only 32 characters need to be the same for the signature to be valid.

The way to avoid this would be use all the bits of the message in the signature, but with arbitrarily large messages this can cause huge performance issues as we're now performing public key crypto on potentially much larger amounts of data.

So the idea of using the hash function is to take an arbitrarily large amount of data and transform it into a much smaller amount of data before performing any of the expensive operations on it. But we also need this to happen in a way such that it is hard, given message $m_1$, to find another message $m_2$ that produces the same hash output. Otherwise we again have the case that the signature for $m_1$ is also valid for $m_2$. The property of cryptographic hash functions (which SHA-2 falls under) known as (second) pre-image resistance gives us this property.