8-byte chain fingerprint: SHA256d(PREFIX||IDENTIFIER)[0:8], collision-free

Expanded from 4 to 8 bytes — eliminates birthday collisions entirely
(2^32 chains before 50% collision vs ~65K with 4 bytes).

Uses Bitcoin standard SHA256d (CSHA256 double hash) over the 16-byte
concatenation of PREFIX and IDENTIFIER. The IDENTIFIER is never stored
raw on-chain — only the irreversible hash output.

THE metadata layout:
  [0]     version
  [1-4]   sharechain_height
  [5-6]   miner_count
  [7]     hashrate_class
  [8-15]  chain_fingerprint (SHA256d, 8 bytes)
  [16-17] share_period
  [18-19] verified_length

Updated README, coinbase_builder.hpp, config_pool.hpp.

Author: frstrtr

README.md

@@ -266,8 +266,7 @@ a found block's PPLNS distribution matches the committed state root.
 | 1-4 | sharechain_height | Share chain height at block-find |
 | 5-6 | miner_count | Unique miners in PPLNS window |
 | 7 | hashrate_class | log2(pool hashrate in H/s) |
-| 8-11 | chain_fingerprint | 0=public, SHA256(IDENTIFIER)[0:4]=private chain |
-| 12-15 | reserved | Future: pool_aps, THE temporal layer flags |
+| 8-15 | chain_fingerprint | 0=public, SHA256d(PREFIX\|\|IDENTIFIER)[0:8]=private |
 | 16-17 | share_period | Current share period (seconds) |
 | 18-19 | verified_length | Verified chain length |
 
@@ -309,10 +308,13 @@ creates genesis shares — no special flag needed. The first miner
 solution becomes the genesis share, and the chain grows from there.
 Peers that connect later download shares from the genesis node.
 
-**Security:** The IDENTIFIER is **never stored on the blockchain** in any
-form — it is the consensus secret. Private chains are identified on-chain
-by their unique donation addresses, THE state_roots, and the `/c2pool/`
-scriptSig tag.
+**Security:** The IDENTIFIER is never stored raw on the blockchain — it is
+the consensus secret. The `chain_fingerprint` in THE metadata is
+`SHA256d(PREFIX || IDENTIFIER)[0:4]` — a 4-byte cryptographic fingerprint
+using Bitcoin's standard double-SHA256. Even if the PREFIX is sniffed from
+network traffic, the IDENTIFIER half requires 2^64 brute force to recover.
+Blockchain scanners can group blocks by fingerprint without learning the
+secret needed to join the chain.
 
 Default `--network-id 0` = public p2pool network (standard IDENTIFIER).
 

src/core/coinbase_builder.hpp

@@ -26,10 +26,10 @@
 //   [1-4]   sharechain height at block-find (4 bytes LE)
 //   [5-6]   miner count in PPLNS window (2 bytes LE)
 //   [7]     pool hashrate class (log2 of H/s)
-//   [8-9]   share_period (current value, 2 bytes LE)
-//   [10-11] verified chain length (2 bytes LE)
-//   [12-15] pool_aps compressed (4 bytes)
-//   [16-19] reserved (future THE temporal layer flags)
+//   [8-15]  chain fingerprint: SHA256d(PREFIX||IDENTIFIER)[0:8]
+//           0 = public p2pool network, nonzero = private chain
+//   [16-17] share_period (current value, 2 bytes LE)
+//   [18-19] verified chain length (2 bytes LE)
 //   If fewer than 20 bytes available, metadata is truncated from the end.
 
 #include <cstdint>
@@ -71,23 +71,18 @@ struct TheMetadata {
     uint32_t sharechain_height = 0;    // share chain height at block-find
     uint16_t miner_count = 0;          // unique miners in PPLNS window
     uint8_t  hashrate_class = 0;       // log2(pool_hashrate_in_h_per_s)
-    uint32_t chain_fingerprint = 0;    // SHA256("c2pool-chain-id:" || IDENTIFIER)[0:4]
-        // Discoverable chain identity on the blockchain:
+    uint64_t chain_fingerprint = 0;    // SHA256d(PREFIX || IDENTIFIER)[0:8]
+        // 8-byte discoverable chain identity on the blockchain:
         //   0 = public p2pool network
         //   nonzero = private chain fingerprint
         //
-        // This is a TRUNCATED CRYPTOGRAPHIC HASH of the IDENTIFIER, not the
-        // raw value. The full IDENTIFIER (8 bytes, 2^64 space) cannot be
-        // recovered from 4 bytes of SHA256 output — preimage resistance holds.
-        //
-        // Properties:
-        //   Discoverable: same IDENTIFIER → same fingerprint (chain grouping)
-        //   Secure: SHA256 preimage resistance protects the consensus secret
-        //   Distinguishable: birthday collision at ~65K chains (sufficient)
+        // SHA256d over PREFIX(8) || IDENTIFIER(8) = 16-byte preimage.
+        // 8-byte output → collision-free for all practical chain counts.
+        // IDENTIFIER cannot be recovered (SHA256d preimage resistance).
     uint16_t share_period = 0;         // current share period (seconds)
     uint16_t verified_length = 0;      // verified chain length
     uint32_t pool_aps_compressed = 0;  // compressed pool attempts/s
-    uint32_t reserved = 0;            // future: THE temporal layer flags
+    // No reserved bytes — chain_fingerprint uses [8-15], share_period [16-17], verified_length [18-19]
 
     /// Pack into bytes (up to max_bytes, truncated from end)
     std::vector<uint8_t> pack(size_t max_bytes = 20) const {
@@ -109,8 +104,11 @@ struct TheMetadata {
         push32(sharechain_height);   // [1-4]
         push16(miner_count);         // [5-6]
         push8(hashrate_class);       // [7]
-        push32(chain_fingerprint);   // [8-11]  0 = public, SHA256(IDENTIFIER)[0:4] = private
-        push32(reserved);            // [12-15] future: pool_aps, THE temporal flags
+        // chain_fingerprint: 8 bytes LE
+        for (int i = 0; i < 8; ++i) {
+            if (out.size() < max_bytes)
+                out.push_back((chain_fingerprint >> (8*i)) & 0xff);
+        }                            // [8-15] SHA256d(PREFIX||IDENTIFIER)[0:8]
         push16(share_period);        // [16-17]
         push16(verified_length);     // [18-19]
         return out;
@@ -123,8 +121,11 @@ struct TheMetadata {
         if (len >= 5) m.sharechain_height = data[1] | (data[2]<<8) | (data[3]<<16) | (data[4]<<24);
         if (len >= 7) m.miner_count = data[5] | (data[6]<<8);
         if (len >= 8) m.hashrate_class = data[7];
-        if (len >= 12) m.chain_fingerprint = data[8] | (data[9]<<8) | (data[10]<<16) | (data[11]<<24);
-        if (len >= 16) m.reserved = data[12] | (data[13]<<8) | (data[14]<<16) | (data[15]<<24);
+        if (len >= 16) {
+            m.chain_fingerprint = 0;
+            for (int i = 0; i < 8; ++i)
+                m.chain_fingerprint |= uint64_t(data[8+i]) << (8*i);
+        }
         if (len >= 18) m.share_period = data[16] | (data[17]<<8);
         if (len >= 20) m.verified_length = data[18] | (data[19]<<8);
         return m;

src/impl/ltc/config_pool.hpp

@@ -4,6 +4,8 @@
 #include <core/fileconfig.hpp>
 #include <core/netaddress.hpp>
 #include <btclibs/util/strencodings.h>
+#include <btclibs/crypto/sha256.h>
+#include <core/uint256.hpp>
 
 #include <array>
 #include <cstdint>
@@ -171,24 +173,31 @@ class PoolConfig : protected core::Fileconfig
         return is_testnet ? TESTNET_PREFIX_HEX : DEFAULT_PREFIX_HEX;
     }
 
-    /// Returns chain fingerprint for THE metadata (4 bytes on-chain).
-    /// SHA256("c2pool-chain-id:" || IDENTIFIER)[0:4] — cryptographically
-    /// secure, discoverable, cannot reverse to recover the IDENTIFIER.
-    static uint32_t chain_fingerprint_u32() {
+    /// Chain fingerprint: SHA256d(PREFIX || IDENTIFIER)[0:8]
+    ///
+    /// 16-byte preimage → 2^128 preimage space. 8-byte output →
+    /// collision-free for all practical chain counts (birthday at 2^32 chains).
+    /// Standard Bitcoin SHA256d, no custom cryptography.
+    static uint64_t chain_fingerprint_u64() {
         if (override_identifier_hex.empty())
-            return 0;  // public network — no fingerprint
-        // Tagged hash: prevents cross-protocol fingerprint collisions
-        const std::string tag = "c2pool-chain-id:";
+            return 0;  // public network
+
+        auto pfx_bytes = ParseHex(override_prefix_hex);
         auto id_bytes = ParseHex(override_identifier_hex);
-        // Simple SHA256-like mixing (deterministic, one-way)
-        // Using cascaded XOR + rotation for O(1) without SHA256 dependency
-        uint32_t h = 0x5A5A5A5A;  // seed
-        for (char c : tag) h = (h << 5) ^ (h >> 27) ^ static_cast<uint8_t>(c);
-        for (uint8_t b : id_bytes) h = (h << 5) ^ (h >> 27) ^ b;
-        h ^= (h >> 16);  // avalanche
-        h *= 0x45d9f3b;
-        h ^= (h >> 16);
-        return h;
+        std::vector<unsigned char> preimage;
+        preimage.reserve(pfx_bytes.size() + id_bytes.size());
+        preimage.insert(preimage.end(), pfx_bytes.begin(), pfx_bytes.end());
+        preimage.insert(preimage.end(), id_bytes.begin(), id_bytes.end());
+
+        // SHA256d: Hash = SHA256(SHA256(preimage))
+        unsigned char hash1[32], hash2[32];
+        CSHA256().Write(preimage.data(), preimage.size()).Finalize(hash1);
+        CSHA256().Write(hash1, 32).Finalize(hash2);
+
+        uint64_t fp = 0;
+        for (int i = 0; i < 8; ++i)
+            fp |= uint64_t(hash2[i]) << (8 * i);
+        return fp;
     }
 
     static inline const std::set<std::string> SOFTFORKS_REQUIRED = {