Hash functions

A hash function takes any data, a word or a whole block, and produces a short fixed-size fingerprint called a hash.

Pearl uses hashes everywhere: to name transactions and blocks, to chain blocks together, to commit to data without revealing it, and to run its mining lottery. It uses two families. SHA-256 comes from Bitcoin. BLAKE3 is Pearl’s addition, and it powers the mining.

Try it

Type anything. Watch the hash change completely when you change a single letter, and compare SHA-256, SHA256d and BLAKE3 side by side.

What makes a good hash function?

Five properties. The first three are easy to see; the last two are what make hashes useful for security.

1. Deterministic. The same input always gives the same hash, on every computer.
2. Fixed size. SHA-256 and BLAKE3 (as Pearl uses it) always give 32 bytes, whether you hash one letter or a gigabyte.
3. Avalanche. A tiny change in the input changes about half the output bits. This is the avalanche effect.
4. One-way. Given a hash, you can’t find an input that produces it. This is preimage resistance.
5. No collisions. No one can find two different inputs with the same hash. This is collision resistance.

Here is the avalanche effect with real numbers. “Pearl” and “pearl” differ in one bit: P is 0x50 and p is 0x70.

The two hashes differ in 135 of their 256 bits. Nothing about the second hints that its input was almost the same as the first.

What is SHA-256, and what is SHA256d?

SHA-256 is the hash function Bitcoin is built on, standardised by NIST. It chops the input into 64-byte blocks and stirs each one through 64 rounds of mixing. Pearl uses it exactly as Bitcoin does.

SHA256d is SHA-256 applied twice: the hash of the hash. Pearl uses it for transaction IDs, Merkle roots, block hashes and the header’s proof commitment.

Take the real header of block 130,825, all 108 bytes:

1. Hash the header once

   SHA-256 of the 108 bytes gives 76db48f729868f9da8ff7dbe1aae143f3322cc64c2ce3602e6091a9fb23c842b.

2. Hash that 32-byte result again

   SHA-256 of those 32 bytes gives ae3355eec8af1f407f0e935739615e375f35bedcd556a75e13a093387651c83f.

3. Reverse the bytes for display

   3fc851763893a0135ea756d5dcbe355f375e613957930e7f401fafc8ee5533ae, the block hash every explorer shows. The reversal is explained on the byte order page.

Why hash twice? Satoshi never said. The usual explanation is that a second round blocks a weakness of SHA-256 called length extension. Whatever the reason, the double hash is part of the format, and Pearl keeps it.

Why did Pearl add BLAKE3?

Because of what mining needs. A Pearl miner commits to two big integer matrices, sometimes gigabytes of data, and must later prove that a couple of rows belonged to them. BLAKE3 was designed in 2020 and has three features that fit:

• It’s a tree. BLAKE3 splits its input into 1 KiB chunks, hashes each, then hashes pairs of results up to a single root. So the BLAKE3 hash of a matrix is the root of a Merkle tree, and a few rows can be proven with a short path of sibling hashes.
• It’s fast and parallel. Chunks can be hashed at the same time on many CPU or GPU cores.
• It has a keyed mode. Given a 32-byte key, BLAKE3 becomes a different function for every key. Pearl keys its hashes with the job key or a noise seed, so a result from one job means nothing in another. That’s a form of domain separation, like tagged hashes for SHA-256.

The same word gives a different BLAKE3 hash from its SHA-256 hash, of course:

The second one is real: it’s the salt Pearl’s consensus code has used since block 99,000 to tie matrix A’s noise seed to A’s size. See noise seeds.

Where does Pearl use each hash?

import { sha256 } from '@noble/hashes/sha2.js';
import { blake3 } from '@noble/hashes/blake3.js';

const msg = new TextEncoder().encode('Pearl');
sha256(msg);              // 72bc5561…dcf20ed5
sha256(sha256(msg));      // SHA256d: 2ec32b95…b184215f
blake3(msg);              // 64c73be7…eabcd1c0
blake3(msg, { key });     // keyed mode: key must be exactly 32 bytes