Bitcoin and all cryptocurrencies are built upon cryptographic algorithms that ensure their security. But most of the ones we used in the past have been replaced as vulnerabilities were progressively found in them, leading people to worry about what would happen when, inevitably, SHA-256 will become obsolete.
Secure Hash Algorithm 256, or SHA-256, is a pseudo-random function referred to as a hash function. It makes use of a process of complex mathematical steps, which given a text of arbitrary length (from a password to the entire archive of the Vatican) will return a string 64-character long. This string will be a combination of letters and numbers that is unique and will be used as the digital footprint of the input. The algorithm is called a one-way function because what it returns appears random, and it is impossible (or very difficult) to run it the other way and find the original input.
The use of SHA-256 is fundamental in the design of Bitcoin. It is the link between each block of the blockchain and the main mechanism on which the proof of work consensus is built. Each block of the chain contains the hash of the transactions included in it, and the hash of the previous block as a pointer, thus creating a chain. If a malicious entity tries to change a transaction in one of the blocks, by per example, writing that it received twenty thousand BTC instead of only one. The hash of this new block will be different, therefore the next block won’t point to it any more, and it will not be recognized as part of the chain. On top of this, as the output of the function is unpredictable, it is possible to build a consensus mechanism based on the amount of effort needed to generate hashes. Miners generate millions of hashes by feeding the function with the block’s transaction and a random seed until they find the right seed that creates a hash meeting the requirements of the Bitcoin protocol.
Many of the hash functions we used in the past such as SHA1 or MD5 have become obsolete as their algorithms were broken. As we said earlier, the hash functions take an arbitrary-sized input and return a 16-character long string. Therefore, the set of all inputs will be bigger than the one of all outputs, and even though very not likely, one would be able to produce the same hash with two different strings. Now, in the case of these past algorithms, people discovered ways to artificially creates collisions like these. However, it doesn’t mean they generated actual reverse functions but rather understood how to manipulate the outcome of the hash algorithms, which is slightly better than looking for collisions with a brute force method but still requires a lot of computing power.
If SHA-256 was to be broken the same way, Bitcoin could actually be impacted. However, whether the discovery was made public or not will decide if it could be used maliciously. In the case of a public announcement, attackers wouldn’t have the time to act on it as the network would most likely fork and switch to a new algorithm, or increase the difficulty of mining. Now, if the discovery was kept private, the hackers could use this slight advantage to mine faster than everyone else, thus receiving most of the rewards. And if they had enough computing power, could organize a 51% attack on the network, thus being able to double spend and get all the rewards. However, those behaviours would be very quickly caught by the network, as the rate of block generation would raise above the expected value of one per ten minutes. Finally, the funds of individuals would remain protected by different cryptographic tools, such as the discrete logarithms and RIPEMD-160, that would all need to be broken at once in secret to be accessed.
In conclusion, it is unlikely that the SHA-256 will entirely be broken one day, but rather subject to artificial collisions like its predecessors, which wouldn’t compromise the entire security of the network.