1
$\begingroup$

I am familiar with the fundamentals of cryptography as well as Digital Signatures. I understand how DSA like RSA works and the fundamentals of mathematics behind digital signing and verification. I also have a reasonable understanding of how bitcoin works. However I can not understand the role of hash function (SHA256) in bitcoin blockchain.

The role of a private key and its corresponding public key seems clear to me. - A public key can be used by the sender of a message to encrypt the message than can only be decrypted with the private key of the recipient. - A private key can be use to sign a message, so when the message is encrypted with the private key the recipient can verify, by using the pubic key, that the message must have been signed by the owner of the private key.

The questions rises is bitcoin protocol. I understand that the public key is use to derive the bitcoin address. Therefore, having the private key associated to that address allows you to prove that you are the owner of that address.

The hash function (SHA256) is used to make the digest of the of the transaction and block in the block chain. Somewhere I read that “To save time, digital signature protocols are often implemented with one-way hash functions (...). Instead of signing a document, Alice signs the hash of the document.”

Is that the only role of the hash function in the bitcoin protocol? what is the role of the hash function in the verification of the ownership of the address? couldn’t we get the same result of proving ownership without the has function?

$\endgroup$
  • $\begingroup$ Bitcoin signing actually uses ECDSA with double SHA256; see bitcoin.stackexchange.com/questions/46455/… . The address derivation uses SHA256 plus RIPEMD160 (usually plus base58check encoding, but that only adds convenience and safety not security). And the proof-of-work for the blockchain uses double SHA256 (by itself). All of these are covered by multiple Qs on bitcoin.SX as well as a few of those tagged bitcoin here. $\endgroup$ – dave_thompson_085 Oct 11 '17 at 2:21
  • $\begingroup$ @dave_thompson_085 I think the question is about the hashing step in the digital signature algorithm rather than the hashing steps in any part of the Bitcoin protocol (at least that's how I read the second to last paragraph). $\endgroup$ – puzzlepalace Oct 11 '17 at 4:25
1
$\begingroup$

One reason ECDSA (the elliptic curve variant of DSA used by Bitcoin) first hashes data is to make forging signatures harder. Consider the first two steps in ECDSA:

  1. Calculate $e = \mathit{HASH}(m)$, where $\mathit{HASH}$ is a cryptographic hash function, such as SHA-2.
  2. Let $z$ be the $L_n$ leftmost bits of $e$, where $L_n$is the bit length of the group order $n$.

Suppose instead that $z$ is the $L_n$ leftmost bits of the message $m$ instead. In that case the resulting signature is a valid signature for any message $m$ with the same $L_n$ leftmost bits. In the case of ECDSA in bitcoin $L_n = 256$, or 32 bytes (which would be 32 characters in ASCII encoding). This gives a lot of possible ways to forge a message as only 32 characters need to be the same for the signature to be valid.

The way to avoid this would be use all the bits of the message in the signature, but with arbitrarily large messages this can cause huge performance issues as we're now performing public key crypto on potentially much larger amounts of data.

So the idea of using the hash function is to take an arbitrarily large amount of data and transform it into a much smaller amount of data before performing any of the expensive operations on it. But we also need this to happen in a way such that it is hard, given message $m_1$, to find another message $m_2$ that produces the same hash output. Otherwise we again have the case that the signature for $m_1$ is also valid for $m_2$. The property of cryptographic hash functions (which SHA2 falls under) known as (second) pre-image resistance gives us this property.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.