user1307: Bitcoin uses both SHA-256 and RIPEMD-160 hashes. Most often a double-round SHA-256 is used, but for address generating, RIPEMD-160 is used because it generates a shorter hash value. RIPEMD-160 has a 160-bit or 20-byte hash value while SHA-256 has a 256-bit or 32-byte.
So RIPEMD-160 is used for it's shorter hash. However, SHA-1 also produces a 160-bit hash. RIPEMD-160 is a less popular algorithm but in fact achieves exactly the same as SHA-1 does.
The only real difference I can find on the internet is in the following fragment from RIPEMD-160's Wikipedia page:

RIPEMD-160 was designed in the open academic community, in contrast to
  the NSA designed SHA-1 and SHA-2 algorithms. On the other hand,
  RIPEMD-160 appears to be used somewhat less frequently than SHA-1,
  which may have caused it to be less scrutinized than SHA. RIPEMD-160
  is not known to be constrained by any patents.

Are patent issues the reason? Why is SHA-1 a problem but SHA-256 not? I know that SHA-1 and SHA-2 (of which SHA-256 is a part) are different iterations of the SHA initiative and so probably have very different legal implementation.
Does anyone really knows why RIPEMD-160 was chosen before the more popular SHA-1?

user323: It could be due to a theoretical 2^60 bit attack that is possible on SHA-1, meaning that the algorithm is weaker than designed. RIPEMD does not appear to have such weaknesses. 

user1732: There are a multitude of reasons.

As @ThePiachu mentioned, there is a theoretical 2^60 bit attack that is possible on SHA-1, meaning that the algorithm is weaker than designed.

RIPEMD-160 was designed in the open academic community, in contrast to the NSA designed SHA-1 and SHA-2 algorithms.
It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits as this is equally secure. The fact that he didn't is some evidence to show that his decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.

Lastly, I believe RIPEMD is based on a different design to the SHA1/SHA2 algorithms, and thus attacks that apply to one may not be transferable to the other (which is good).



1307: <p>Bitcoin uses both SHA-256 and RIPEMD-160 hashes. Most often a double-round SHA-256 is used, but for address generating, RIPEMD-160 is used because it generates a shorter hash value. RIPEMD-160 has a 160-bit or 20-byte hash value while SHA-256 has a 256-bit or 32-byte.</p>

<p><strong>So RIPEMD-160 is used for it's shorter hash. However, SHA-1 also produces a 160-bit hash. RIPEMD-160 is a less popular algorithm but in fact achieves exactly the same as SHA-1 does.</strong></p>

<p>The only real difference I can find on the internet is in the following fragment from <a href="https://en.wikipedia.org/wiki/RIPEMD-160" rel="noreferrer">RIPEMD-160's Wikipedia page</a>:</p>

<blockquote>
  <p>RIPEMD-160 was designed in the open academic community, in contrast to
  the NSA designed SHA-1 and SHA-2 algorithms. On the other hand,
  RIPEMD-160 appears to be used somewhat less frequently than SHA-1,
  which may have caused it to be less scrutinized than SHA. RIPEMD-160
  is not known to be constrained by any patents.</p>
</blockquote>

<p>Are patent issues the reason? Why is SHA-1 a problem but SHA-256 not? I know that SHA-1 and SHA-2 (of which SHA-256 is a part) are different iterations of the SHA initiative and so probably have very different legal implementation.</p>

<p>Does anyone really knows why RIPEMD-160 was chosen before the more popular SHA-1?</p>
 323: <p>It could be due to <a href="https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions" rel="nofollow">a theoretical 2^60 bit attack that is possible on SHA-1</a>, meaning that the algorithm is weaker than designed. RIPEMD does not appear to have such weaknesses. </p>
 1732: <p>There are a multitude of reasons.</p>
<ol>
<li><p>As @ThePiachu mentioned, there is <a href="https://en.wikipedia.org/wiki/Sha-1#Comparison_of_SHA_functions" rel="nofollow noreferrer">a theoretical 2^60 bit attack that is possible on SHA-1</a>, meaning that the algorithm is weaker than designed.</p>
</li>
<li><p>RIPEMD-160 was designed in the open academic community, in contrast to the NSA designed SHA-1 and SHA-2 algorithms.</p>
<p>It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits as this is <a href="https://crypto.stackexchange.com/questions/3153/sha-256-vs-any-256-bits-of-sha-512-which-is-more-secure">equally secure</a>. The fact that he didn't is some evidence to show that his decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.</p>
</li>
<li><p>Lastly, I believe RIPEMD is based on a different design to the SHA1/SHA2 algorithms, and thus attacks that apply to one may not be transferable to the other (which is good).</p>
</li>
</ol>
