Why was the RIPEMD-160 hash algorithms chosen before SHA-1? Bitcoin uses both SHA-256 and RIPEMD-160 hashes. Most often a double-round SHA-256 is used, but for address generating, RIPEMD-160 is used because it generates a shorter hash value. RIPEMD-160 has a 160-bit or 20-byte hash value while SHA-256 has a 256-bit or 32-byte.

So RIPEMD-160 is used for it's shorter hash. However, SHA-1 also produces a 160-bit hash. RIPEMD-160 is a less popular algorithm but in fact achieves exactly the same as SHA-1 does.

The only real difference I can find on the internet is in the following fragment from RIPEMD-160's Wikipedia page:


  RIPEMD-160 was designed in the open academic community, in contrast to
  the NSA designed SHA-1 and SHA-2 algorithms. On the other hand,
  RIPEMD-160 appears to be used somewhat less frequently than SHA-1,
  which may have caused it to be less scrutinized than SHA. RIPEMD-160
  is not known to be constrained by any patents.


Are patent issues the reason? Why is SHA-1 a problem but SHA-256 not? I know that SHA-1 and SHA-2 (of which SHA-256 is a part) are different iterations of the SHA initiative and so probably have very different legal implementation.

Does anyone really knows why RIPEMD-160 was chosen before the more popular SHA-1?
There are a multitude of reasons.

As @ThePiachu mentioned, there is a theoretical 2^60 bit attack that is possible on SHA-1, meaning that the algorithm is weaker than designed.

RIPEMD-160 was designed in the open academic community, in contrast to the NSA designed SHA-1 and SHA-2 algorithms.
It is worth noting that Satoshi could've used SHA2-256 twice and truncated the second digest to 160 bits as this is equally secure. The fact that he didn't is some evidence to show that his decision was a conscious decision to use RIPEMD-160 over the NSA suit of algorithms.

Lastly, I believe RIPEMD is based on a different design to the SHA1/SHA2 algorithms, and thus attacks that apply to one may not be transferable to the other (which is good).