Why does SHA-256d (double SHA-256) in Bitcoin have a constrained message schedule in the second hash?
Bitcoin mining uses SHA-256d: SHA-256(SHA-256(data)).
I recently discovered experimentally (IACR ePrint 2026/109079) that the second SHA-256 application has a structurally constrained message schedule:
- The second hash always receives exactly 32 bytes (the first hash output) + fixed Merkle-Damgård padding
- This makes W[8-15] in the second hash always constant (0x80000000... + length encoding)
- Only 30 unique carry patterns exist in the second hash vs theoretical 2^64
- Measurable cross-hash anti-correlation: 9.56σ (confirmed real, scales as √N)
My questions:
-
Was this structural property of SHA-256d considered when Bitcoin adopted double-SHA-256? Or was it chosen purely for length-extension attack resistance?
-
Is there any documentation of this constrained W-schedule effect in Bitcoin's design rationale?
-
Does this property have any known implications for Bitcoin's security model beyond length-extension resistance?
The correlation is not exploitable (r=0.03, <0.1% variance explained), but it is a measurable deviation from ideal independence of the two hash applications.
from Recent Questions - Bitcoin Stack Exchange https://ift.tt/zFeAjX6
via IFTTT