user78: Each blocked is hashed twice. Why isn't one application of SHA256 enough?

user153: From Zooko's answer provided in Crypto StackExchange:

SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
  excellent book "Practical Cryptography" (later updated by Ferguson,
  Schneier, and Kohno and renamed "Cryptography Engineering") as a way
  to make SHA-256 invulnerable to "length-extension" attack. They called
  it "SHA-256d".


78: <p>Each blocked is hashed twice. Why isn't one application of SHA256 enough?</p>
 153: <p>From <a href="https://crypto.stackexchange.com/a/884">Zooko's answer provided in Crypto StackExchange</a>:</p>

<blockquote>
  <p>SHA-256(SHA-256(x)) was proposed by Ferguson and Schneier in their
  excellent book "Practical Cryptography" (later updated by Ferguson,
  Schneier, and Kohno and renamed "Cryptography Engineering") as a way
  to make SHA-256 invulnerable to "length-extension" attack. They called
  it "SHA-256d".</p>
</blockquote>
