Cryptographic hash function

These functions exhibit an avalanche effect: changing one input bit alters about half the output. SHA-256, from NIST's SHA-2 family, with a 256-bit digest, is the basis of Bitcoin mining and identifiers. NIST announced Keccak as the SHA-3 contest winner on 2 October 2012 and published FIPS 202 in August 2015. An important nuance: Ethereum uses Keccak-256, not the standard SHA-3, because it predates FIPS 202 and differs in the padding byte; this is why SHA3-256 and Keccak-256 give different outputs for the same input. In zero-knowledge circuits, friendly hashes such as Poseidon, MiMC or Rescue are used, cheap to evaluate over finite fields.

It is the substrate of data integrity, addresses, commitments, proof of work and signatures. As long as no practical collisions exist, the structures that depend on it, such as Merkle trees and blockchains themselves, inherit its security.

Bitcoin applies double SHA-256 in its proof of work and in transaction identifiers. Ethereum uses Keccak-256 to derive addresses (the last 20 bytes of the public key hash), for function selectors and for state roots. Poseidon appears in Zcash and Starknet circuits and in zk-oriented Merkle trees. Every digital signature signs the hash of the message, and the security of a zk-STARK reduces directly to that of the hash used.