user3784: Why do we use 2 hash functions (both SHA and RIPEMD) to create an address? Why not just use one hash function?

user2306: Except from Where is Double hashing performed in Bitcoin?

So why does he hash twice? I suspect it's in order to prevent
  length-extension attacks.
SHA-2, like all Merkle-Damgard hashes suffers from a property called
  "length-extension". This allows an attacker who knows H(x) to
  calculate H(x||y) without knowing x. This is usually not a problem,
  but there are some uses where it totally breaks the security. The most
  relevant example is using H(k||m) as MAC, where an attacker can easily
  calculate a MAC for m||m'. I don't think Bitcoin ever uses hashes in a
  way that would suffer from length extensions, but I guess Satoshi went
  with the safe choice of preventing it everywhere.
To avoid this property, Ferguson and Schneier suggested using SHA256d
  = SHA256(SHA256(x)) which avoids length-extension attacks. This construction has some minor weaknesses (not relevant to bitcoin), so I
  wouldn't recommend it for new protocols, and would use HMAC with
  constant key, or truncated SHA512 instead.
Answered by CodesInChaos


user85: RIPEMD was used because it produces the shortest hashes whose uniqueness is still sufficiently assured. This allows Bitcoin addresses to be shorter.
SHA256 is used as well because Bitcoin's use of a hash of a public key might create unique weaknesses due to unexpected interactions between RIPEMD and ECDSA (the public key signature algorithm). Interposing an additional and very different hash operation between RIPEMD and ECDSA makes it almost inconceivable that there might be a way to find address collisions that is significantly easier than brute force trying a large number of secret keys.
Essentially, it was a belt and suspenders approach. Bitcoin had to do something unique and rather than have to hope they got it exactly right, they overdesigned it.

3784: <p>Why do we use 2 hash functions (both SHA and RIPEMD) to create an address? Why not just use one hash function?</p>
 2306: <p>Except from <a href="https://bitcoin.stackexchange.com/a/8461/2306">Where is Double hashing performed in Bitcoin?</a></p>

<blockquote>
  <p>So why does he hash twice? I suspect it's in order to prevent
  length-extension attacks.</p>
  
  <p>SHA-2, like all Merkle-Damgard hashes suffers from a property called
  "length-extension". This allows an attacker who knows H(x) to
  calculate H(x||y) without knowing x. This is usually not a problem,
  but there are some uses where it totally breaks the security. The most
  relevant example is using H(k||m) as MAC, where an attacker can easily
  calculate a MAC for m||m'. I don't think Bitcoin ever uses hashes in a
  way that would suffer from length extensions, but I guess Satoshi went
  with the safe choice of preventing it everywhere.</p>
  
  <p>To avoid this property, Ferguson and Schneier suggested using SHA256d
  = SHA256(SHA256(x)) which avoids length-extension attacks. This construction has some minor weaknesses (not relevant to bitcoin), so I
  wouldn't recommend it for new protocols, and would use HMAC with
  constant key, or truncated SHA512 instead.</p>
  
  <p>Answered by CodesInChaos</p>
</blockquote>
 85: <p>RIPEMD was used because it produces the shortest hashes whose uniqueness is still sufficiently assured. This allows Bitcoin addresses to be shorter.</p>

<p>SHA256 is used as well because Bitcoin's use of a hash of a public key might create unique weaknesses due to unexpected interactions between RIPEMD and ECDSA (the public key signature algorithm). Interposing an additional and very different hash operation between RIPEMD and ECDSA makes it almost inconceivable that there might be a way to find address collisions that is significantly easier than brute force trying a large number of secret keys.</p>

<p>Essentially, it was a belt and suspenders approach. Bitcoin had to do something unique and rather than have to hope they got it exactly right, they overdesigned it.</p>
