Hashing & Cryptography

Difficulty: Beginner

Cryptographic hash functions are the mathematical backbone of blockchain technology. A hash function takes an input of any size and produces a fixed-size output - called a digest or hash - that appears random but is entirely deterministic. The same input always produces the same output, yet even the smallest change to the input produces a completely different hash. This property, known as the avalanche effect, is what makes hash functions so powerful for detecting tampering.

SHA-256 (Secure Hash Algorithm 256-bit) is the hash function used by Bitcoin and many other blockchain protocols. It produces a 256-bit (32-byte) output, typically represented as a 64-character hexadecimal string. SHA-256 has several critical properties: it is deterministic, it is computationally fast to compute, it is infeasible to reverse (pre-image resistance), it is infeasible to find two different inputs that produce the same hash (collision resistance), and it exhibits the avalanche effect. These properties make it ideal for creating block hashes, Merkle trees, and proof-of-work puzzles.

Public key cryptography (asymmetric cryptography) is the other pillar of blockchain security. Each participant in a blockchain network possesses a key pair: a private key (kept secret) and a public key (shared openly). The private key is a large random number, and the public key is mathematically derived from it using elliptic curve multiplication (most blockchains use the secp256k1 curve). It is computationally infeasible to derive the private key from the public key, which is what makes the system secure.

Digital signatures allow a user to prove ownership and authorize transactions without revealing their private key. To sign a transaction, the sender hashes the transaction data and then encrypts that hash with their private key. Anyone can verify the signature by decrypting it with the sender's public key and comparing the result to the transaction hash. If they match, the signature is valid - proving the transaction was authorized by the holder of the private key and that the data has not been altered since signing.

In blockchain systems, these cryptographic primitives work together seamlessly. Hash functions secure the chain structure by linking blocks and building Merkle trees. Public key cryptography secures identity and authorization - your public key (or a hash of it) serves as your address, and your private key lets you sign transactions. Understanding these fundamentals is essential because every layer of blockchain - from consensus to smart contracts - relies on these cryptographic guarantees.

Code examples

SHA-256 Hash Computation in JavaScript

const crypto = require('crypto');

function sha256(input) {
  return crypto.createHash('sha256').update(input).digest('hex');
}

// Same input always produces the same hash
console.log('Hash of "hello":', sha256('hello'));
console.log('Hash of "hello":', sha256('hello'));

// Tiny change produces completely different hash (avalanche effect)
console.log('Hash of "Hello":', sha256('Hello'));
console.log('Hash of "hello!":', sha256('hello!'));

// Fixed output size regardless of input size
console.log('Hash of "a":', sha256('a'));
console.log('Hash of a long string:', sha256('a'.repeat(10000)));

This demonstrates the key properties of SHA-256: determinism (same input = same hash), avalanche effect (tiny input change = entirely different hash), and fixed output size (always 64 hex characters regardless of input length).

Digital Signature with Elliptic Curve (Node.js)

const crypto = require('crypto');

// Generate a key pair (similar to blockchain wallet creation)
const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'secp256k1',
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

// Transaction data to sign
const transaction = JSON.stringify({
  from: '0xAliceAddress',
  to: '0xBobAddress',
  amount: 1.5,
  nonce: 42,
});

// Sign the transaction with the private key
const sign = crypto.createSign('SHA256');
sign.update(transaction);
const signature = sign.sign(privateKey, 'hex');
console.log('Signature:', signature.substring(0, 40) + '...');

// Verify the signature with the public key
const verify = crypto.createVerify('SHA256');
verify.update(transaction);
const isValid = verify.verify(publicKey, signature, 'hex');
console.log('Signature valid:', isValid);

// Tamper with the transaction and verify again
const tamperedTx = JSON.stringify({
  from: '0xAliceAddress',
  to: '0xBobAddress',
  amount: 100,  // changed from 1.5 to 100
  nonce: 42,
});
const verify2 = crypto.createVerify('SHA256');
verify2.update(tamperedTx);
const isTamperedValid = verify2.verify(publicKey, signature, 'hex');
console.log('Tampered signature valid:', isTamperedValid);

This demonstrates how digital signatures work in blockchain. The private key signs the transaction data, producing a signature. Anyone with the public key can verify the signature is authentic and that the data hasn't been modified. When the transaction amount is tampered with, verification fails.

Key points

• SHA-256 always produces a 256-bit (32-byte) output, typically displayed as 64 hexadecimal characters.
• Hash functions are one-way: you cannot recover the original input from the hash output.
• Bitcoin uses double SHA-256 (hashing the hash) for block headers and transaction IDs.
• Ethereum uses Keccak-256 (a variant of SHA-3) instead of SHA-256 for its hashing needs.
• The secp256k1 elliptic curve is used by both Bitcoin and Ethereum for key pair generation.

Concepts covered

SHA-256, Hash Functions, Digital Signatures, Public Key Cryptography