Hash Functions � The Foundation of Blockchain

Properties of Cryptographic Hash Functions

• Deterministic: The same input ALWAYS produces the same output � no randomness
• Fast to compute: Computing SHA-256 of any input takes microseconds
• Preimage resistant: Given hash H, it is computationally infeasible to find any input M such that hash(M) = H (one-way function)
• Second preimage resistant: Given M1, it is computationally infeasible to find M2 where hash(M1) = hash(M2)
• Collision resistant: It is computationally infeasible to find ANY two different inputs that produce the same hash
• Avalanche effect: Changing even 1 bit of input changes ~50% of output bits � tiny input changes cause enormous output changes

SHA-256 in Python

import hashlib

def sha256(data: str) -> str:
    return hashlib.sha256(data.encode("utf-8")).hexdigest()

# Deterministic: same input -> same output, always
print(sha256("Hello, Blockchain!"))
# e3b22d3f84c8c... (always the same)

# Avalanche effect: tiny change -> completely different hash
print(sha256("Hello, Blockchain!"))
print(sha256("Hello, Blockchain."))  # period instead of !
# Outputs are completely different � ~50% of bits change

# Any length input -> fixed 256-bit (64 hex chars) output
print(len(sha256("a")))              # 64
print(len(sha256("a" * 1_000_000))) # still 64

# Bitcoin uses DOUBLE SHA-256 (hash of hash) for extra security
def double_sha256(data: str) -> str:
    first = hashlib.sha256(data.encode()).digest()   # raw bytes
    second = hashlib.sha256(first).hexdigest()        # hex string
    return second

tx_id = double_sha256("Alice -> Bob: 5 BTC")
print(f"Transaction ID: {tx_id[:20]}...")

# Key insight: there are 2^256 possible SHA-256 outputs.
# To find a collision by brute force would require ~2^128 attempts.
# That is more than the number of atoms in the observable universe.

Common Mistakes

• Confusing hashing with encryption � encryption is reversible (with the key); hashing is one-way. You cannot decrypt a hash. SHA-256 is not encryption
• Using MD5 or SHA-1 for security � MD5 and SHA-1 are broken; collision attacks are practical. Always use SHA-256 or SHA-3 for security applications
• Assuming SHA-256 protects against quantum computers � Grover's algorithm can find SHA-256 preimages in O(2^128) quantum operations, halving effective security. SHA-256 remains secure for now but post-quantum hash research is active

Tip

Practice Task

Quick Quiz

Common Mistake