BA-02 · LESSON 07

Tagged hashes

KEY DEFINITIONS

Terms used in this lesson

BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.
Preimage: The original secret data whose hash equals a previously committed value.
SHA-256: A cryptographic hash function used throughout Bitcoin to produce fixed-size 256-bit digests.
BIP0340 challenge tag: The domain-separation label used by BIP340 when hashing the Schnorr signature challenge.

A tagged hash adds a purpose label before hashing. This stops the same bytes from being mistaken for a message used by a different protocol rule.

55 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · cryptographyFrom secret material to a verifiable commitmentSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
INPUTMessage or scalar
The exact byte string or private scalar is the starting state.
02
DOMAINTag and encoding
Domain separation and serialization decide which bytes the primitive commits to.
03
PRIMITIVETagged hashes
This lesson isolates the exact operation used by Tagged hashes.
04
ARTIFACTDigest, point, or signature
The result is fixed-size and can be passed to a verifier.
05
CHECKSame bytes, same rule
A changed message, domain, key, or encoding must fail the intended verification.

Rule shown: One-way operations expose a checkable result without exposing the secret input.

STAGE 1 OF 5INPUT: Message or scalar

The exact byte string or private scalar is the starting state.

Governing relationship: One-way operations expose a checkable result without exposing the secret input. Complete path: 1. INPUT, Message or scalar. The exact byte string or private scalar is the starting state. 2. DOMAIN, Tag and encoding. Domain separation and serialization decide which bytes the primitive commits to. 3. PRIMITIVE, Tagged hashes. This lesson isolates the exact operation used by Tagged hashes. 4. ARTIFACT, Digest, point, or signature. The result is fixed-size and can be passed to a verifier. 5. CHECK, Same bytes, same rule. A changed message, domain, key, or encoding must fail the intended verification.

1. State transitionWhat exists, what changes, and what results

BEFORE

Let m be the bytes 01 02. Compare tags Example/leaf and Example/challenge.

MECHANISM

Choose a fixed tag such as BIP0340/challenge that describes one exact use. Tags are part of the specification, not user-selected labels.

AFTER

The message did not change; the protocol meaning encoded by the tag changed.

Text equivalent: Starting from Let m be the bytes 01 02. Compare tags Example/leaf and Example/challenge. The mechanism begins when Choose a fixed tag such as BIP0340/challenge that describes one exact use. Tags are part of the specification, not user-selected labels. The resulting lesson is The message did not change; the protocol meaning encoded by the tag changed.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Name the protocol context

Choose a fixed tag such as BIP0340/challenge that describes one exact use. Tags are part of the specification, not user-selected labels.

Complete path: 1. Name the protocol context: Choose a fixed tag such as BIP0340/challenge that describes one exact use. Tags are part of the specification, not user-selected labels. 2. Hash the tag: Compute t = SHA-256(tag bytes). This gives a fixed 32-byte context value. 3. Prefix the message: Construct t || t || m. Repeating the 32-byte digest fills one SHA-256 block before message data under standard SHA-256. 4. Hash the prefixed bytes: The final SHA-256 digest is the tagged hash. A different tag gives a different prefix even when m is identical. 5. Prevent cross-context reuse: A value valid as a nonce derivation input should not automatically be interpreted as a challenge or tree leaf. Domain separation makes those namespaces cryptographically distinct.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The preimage is exactly SHA256(tag) twice followed by complete message bytes, and the full digest is recomputed.

CHANGED CONDITION

A different fixed tag changes the prefix, while malformed odd-length hexadecimal must be rejected instead of silently becoming an empty message.

Important distinction: Adding a human-readable label beside a normal hash provides domain separation. The context must be part of the bytes fed into the defined cryptographic construction. Documentation alone does not alter the digest.

Text equivalent: The accepted path is enforced by The preimage is exactly SHA256(tag) twice followed by complete message bytes, and the full digest is recomputed. If the required condition changes, A different fixed tag changes the prefix, while malformed odd-length hexadecimal must be rejected instead of silently becoming an empty message.

Loading lesson visuals...

Learn the idea

Domain separation makes the same bytes hash differently in different protocol contexts. BIP340 tagged hashing defines H_tag(m) as SHA-256(SHA-256(tag) || SHA-256(tag) || m). The repeated tag digest initializes SHA-256 with a context-specific prefix.

GUIDED EXPLANATION1/5 ideas inspected

Name the protocol context

Choose a fixed tag such as BIP0340/challenge that describes one exact use. Tags are part of the specification, not user-selected labels.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Adding a human-readable label beside a normal hash provides domain separation.”

The context must be part of the bytes fed into the defined cryptographic construction. Documentation alone does not alter the digest.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.