2
$\begingroup$

Is it a good choice to drop double SHA-256 and use straight Blake2 in a Bitcoin-like blockchain (more POS oriented so it's not a mining problem)?

I'm talking about Blake2 because I've read more about it than Blake3, so this question may even consider Blake3.

I don't want to clone Bitcoin but experiment with variations to see what can be improved at low level, so I want to keep it as simple as possible while maintaining at least the bitcoin security level.

Based on my research, it seems Blake2 hash computation is as secure as double hashing SHA-256, correct?

If I've understood correctly, double hashing SHA-256 is done to prevent length extension attack, as one can read here. That's prevented by default on Blake2. Read about it here.

Is this correct?

I'd like to see the performance difference between using Blake2 instead of double SHA-256, but I don't want to upend security.

Improve this question
$\endgroup$
3
  • $\begingroup$ Do you want us the speed comparison? $\endgroup$
    – kelalaka
    Feb 8, 2021 at 23:14
  • $\begingroup$ I haven't read much about BLAKE3 either. It appears to be a slightly weakened (reduced round) version of BLAKE2, which itself is a tweaked and reduced round version of BLAKE. It should have the same general properties that you want as all the others. $\endgroup$
    – forest ♦
    Feb 8, 2021 at 23:14
  • $\begingroup$ @forest the most important change in Blake3 is that it always uses a tree mode. I recommend it as a collision resistant file hash. For hashing short messages I'd rather go with SHAKE-256, especially if performance doesn't trump security margin. $\endgroup$
    – CodesInChaos
    Feb 18 at 12:10

1 Answer 1

Reset to default
3
$\begingroup$

BLAKE2 can be used as a drop-in replacement for SHA-256d, yes. It is not vulnerable to the length extension attack. Whether or not you should use it in cryptocurrency is a more complex question, but it suffices to say that it will not be any less secure than using SHA-256d for your purposes.

Regarding the speed comparison, this will be more complex to answer as you'd need to specify if you want to encourage CPU mining, GPU mining, or ASIC mining for the cryptocurrency. The raw speed of the hash on a modern CPU will also vary, but BLAKE2 will be faster than SHA-256d. Exactly how much faster depends on the CPU's capabilities, such as SIMD features supported.

Improve this answer
$\endgroup$
5
  • $\begingroup$ thanks, what should I look for to understand the consequences of "use it or not" in cryptocurrency? I mean which topic should I study? I'm not a cryptographer but I want to understand as much as I can, thanks. $\endgroup$
    – Not Important
    Feb 8, 2021 at 23:16
  • $\begingroup$ @NotImportant That's an issue that's tangential to cryptography. You might want to read up on some of the theory behind cryptocurrency-based economies. For example, Bitcoin, Litecoin, and Monero are secure in that you cannot "forge" transactions, but they all have completely different focuses in terms of mining (Bitcoin is fast on ASICs, Litecoin uses scrypt to attempt to make ASICs slower, and Monero tries to be only efficient to mine on CPUs). $\endgroup$
    – forest ♦
    Feb 8, 2021 at 23:17
  • $\begingroup$ As I said in the OP, I want to focus more on POS than POW, so mining is not an issue and so I think that may be better to focus on sheer hash computation speed, do you see contraindications in this reasoning? $\endgroup$
    – Not Important
    Feb 8, 2021 at 23:18
  • $\begingroup$ @NotImportant In that case, then speed is pretty irrelevant since blocks are so small. $\endgroup$
    – forest ♦
    Feb 8, 2021 at 23:18
  • $\begingroup$ it's not that irrelevant when you want to sync a chain from scratch, the more you have to compute hashes, the more time you spend in the validation process, anyway that's part of benchmark I want to try out. Also I'm planning to use custom OP_CODES and have a state represented by merkle tree (think about smart contracts on ethereum to have a clue) so lot of hashing is involved $\endgroup$
    – Not Important
    Feb 8, 2021 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.