Hashes, addresses and what Grover really costs you
You will be able to explain what a hash guarantees, why an address is a hash of a key, and why hashing twice is not superstition.
The primitive
A fingerprint you cannot work backwards from.
SHA-256 turns any input into 32 bytes, such that finding a second input with the same output is computationally out of reach. That is what lets a block header commit to its entire contents in one field, and what lets Vigi Data prove a file has not changed without ever holding the file. A hash is a commitment, not encryption: there is nothing inside it to recover.
Illustration to come
Real photograph, close: an inked fingerprint on a paper record card. Tactile and analogue — the point is identification without the person being present.
The address
Your address is the hash of your public key, twice.
VigiChain addresses are the double SHA-256 of the ML-DSA public key. Hashing twice is inherited from Bitcoin and is not folklore: it removes a class of length-extension weakness and costs almost nothing. Hashing at all is what keeps a 1,952-byte key from having to appear on a screen, on paper or in a QR code before it is ever spent.
Illustration to come
Real photograph of a printed card or receipt carrying a QR code and a long hexadecimal string, held or lying on a table. It must be a made-up address, never a real funded one.
Grover
A quantum computer halves it, and 256 bits can afford that.
Grover searches an unstructured space in the square root of the time, which turns 2²⁵⁶ into an effective 2¹²⁸ — still far beyond any conceivable machine. This is precisely why the post-quantum problem is a signature problem: the hash side degrades gracefully while the signature side collapses. It is also why nobody serious proposes 512-bit hashes as the quantum answer.
Illustration to come
Real photograph: a folding ruler or measuring tape doubled back on itself so the halving is literal and physical. Simple, no digital effects.
The consequence for you
An address that has never spent has not published its key.
Until you spend, the network holds only the hash of your public key. That is a second layer of protection which classical chains also enjoy — and which evaporates the moment you spend, because spending publishes the key. On VigiChain it matters less, since the published key is post-quantum; it is still worth understanding why address reuse is a habit worth dropping everywhere.
Illustration to come
Real photograph of a sealed window envelope where only the address shows. Conveys “the outside identifies it, the inside is not visible yet”.
In short
- A hash commits to data; it is not encryption and holds nothing recoverable.
- A VigiChain address is the double SHA-256 of the ML-DSA public key.
- Grover halves effective hash strength, which 256 bits absorbs — the exposure is in signatures.
- An address that has never spent has published only a hash of its key.