BA-02 · LESSON 03

Hash160 and Merkle trees

KEY DEFINITIONS

Terms used in this lesson

Hash160: SHA-256 followed by RIPEMD-160, producing the 20-byte hash used by several Bitcoin spending conditions.
SHA-256: A cryptographic hash function used throughout Bitcoin to produce fixed-size 256-bit digests.
RIPEMD-160: A 160-bit cryptographic hash function used in Bitcoin’s HASH160 construction.

Bitcoin combines two hash functions for some identifiers and arranges transaction hashes in a tree so one item can be proven part of a larger set.

55 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · merkle proofA Merkle proof reconnects one transaction to the block rootSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
LEAFTxid A, index 0
The proof starts from one exact transaction identifier and its position.
02
SIBLINGB is right of A
Position matters because HASH(A || B) is not HASH(B || A).
03
PARENTHASH256(A || B)
The first pair collapses into one parent hash.
04
NEXT SIBLINGCD is right
Only one neighboring hash per tree level is needed.
05
ROOTHASH256(AB || CD)
A match with the header merkle root proves inclusion in that block, subject to the block itself being accepted.

Rule shown: At each level, concatenate the two 32-byte hashes in their recorded left or right order, then hash twice with SHA-256.

STAGE 1 OF 5LEAF: Txid A, index 0

The proof starts from one exact transaction identifier and its position.

Governing relationship: At each level, concatenate the two 32-byte hashes in their recorded left or right order, then hash twice with SHA-256. Complete path: 1. LEAF, Txid A, index 0. The proof starts from one exact transaction identifier and its position. 2. SIBLING, B is right of A. Position matters because HASH(A || B) is not HASH(B || A). 3. PARENT, HASH256(A || B). The first pair collapses into one parent hash. 4. NEXT SIBLING, CD is right. Only one neighboring hash per tree level is needed. 5. ROOT, HASH256(AB || CD). A match with the header merkle root proves inclusion in that block, subject to the block itself being accepted.

1. State transitionWhat exists, what changes, and what results

BEFORE

Let leaves already have hashes A, B, C, and D. Define H(x) as the tree's pair-hash operation.

MECHANISM

Each item is serialized and hashed under the protocol's rule. In a Bitcoin block, transaction hashes become leaves of the transaction Merkle tree.

AFTER

A proof grows with tree height rather than total leaf count, but it proves only membership in the committed tree.

Text equivalent: Starting from Let leaves already have hashes A, B, C, and D. Define H(x) as the tree's pair-hash operation. The mechanism begins when Each item is serialized and hashed under the protocol's rule. In a Bitcoin block, transaction hashes become leaves of the transaction Merkle tree. The resulting lesson is A proof grows with tree height rather than total leaf count, but it proves only membership in the committed tree.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Build leaf hashes

Each item is serialized and hashed under the protocol's rule. In a Bitcoin block, transaction hashes become leaves of the transaction Merkle tree.

Complete path: 1. Build leaf hashes: Each item is serialized and hashed under the protocol's rule. In a Bitcoin block, transaction hashes become leaves of the transaction Merkle tree. 2. Combine pairs: Concatenate each left and right hash in order and hash the pair. If a Bitcoin tree level has an odd count, its final hash is duplicated for that level. 3. Repeat to one root: Each level halves the number of nodes until one root commits to every leaf and its position. 4. Prove one inclusion: A proof carries one sibling per tree level plus left-or-right positions. The verifier recomputes upward without receiving every leaf. 5. Keep HASH160 separate: HASH160 is a two-function 20-byte construction used in several Bitcoin commitments. It is not the block transaction Merkle algorithm.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Every proof step hashes the leaf with the correct left-or-right sibling and must reconstruct the committed root exactly.

CHANGED CONDITION

Changing a sibling or concatenation order produces another root; even a matching inclusion proof does not independently prove transaction validity.

Important distinction: A Merkle proof proves that the included transaction is valid. It proves that a leaf is included under a particular root. Transaction validity and whether that root belongs to an accepted valid block require additional checks.

Text equivalent: The accepted path is enforced by Every proof step hashes the leaf with the correct left-or-right sibling and must reconstruct the committed root exactly. If the required condition changes, Changing a sibling or concatenation order produces another root; even a matching inclusion proof does not independently prove transaction validity.

Loading lesson visuals...

Learn the idea

HASH160 means SHA-256 followed by RIPEMD-160, producing 20 bytes. A Merkle tree commits to many items by hashing leaves and then repeatedly hashing pairs until one Merkle root remains. A Merkle proof supplies the sibling hashes needed to recompute the root for one leaf.

GUIDED EXPLANATION1/5 ideas inspected

Build leaf hashes

Each item is serialized and hashed under the protocol's rule. In a Bitcoin block, transaction hashes become leaves of the transaction Merkle tree.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A Merkle proof proves that the included transaction is valid.”

It proves that a leaf is included under a particular root. Transaction validity and whether that root belongs to an accepted valid block require additional checks.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.