Metraipolis › archive › dc_8a240ecb65db

Practical Preimages for 19- and 20-Step SHA-256 with Standard Padding — arXiv:2611.00512

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.00512
License (as archived): CC0-1.0
Archived: 2026-11-03T11:17:02.101Z
SHA-256 of the archived text: 67ce011194a2e29609ad685c44cf77a534bc7015054823e2d5940bcc533a1b9d
Stable URL of this page: https://metraipolis.com/documento/dc_8a240ecb65db

How to cite

Practical Preimages for 19- and 20-Step SHA-256 with Standard Padding — arXiv:2611.00512 — arXiv (en), https://arxiv.org/abs/2611.00512 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_8a240ecb65db (Metraipolis archive dc_8a240ecb65db, sha256 67ce011194a2e29609ad685c44cf77a534bc7015054823e2d5940bcc533a1b9d)

BibTeX

@misc{dc8a240ecb65db,
  title = {Practical Preimages for 19- and 20-Step SHA-256 with Standard Padding — arXiv:2611.00512},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.00512},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_8a240ecb65db; sha256 67ce011194a2e29609ad685c44cf77a534bc7015054823e2d5940bcc533a1b9d},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.00512. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

We present practical preimage attacks on 19- and 20-step SHA-256 that respect the standard IV, Davies-Meyer feed-forward, and full FIPS 180-4 padding, for arbitrary prescribed 256-bit targets. Building on Basra's algebraic selector saturation and backward padding absorption, we introduce three techniques: an exact $O(1)$ inversion of the low padding byte $(W_{13} \bmod 256) = \mathtt{0x80}$ that leaves $(a_5, a_6)$ free for exact context shaping; a causal bit-slice equivalence theorem that prunes $99.74\%$ of right-hand candidate nodes across seven stages; and a closed-form $\mathbf{F}_2$ upper-half inverse paired with compact $Q_0^{-1}$ lookup tables. One CPU core solves arbitrary 19-step padded targets in $1.2$--$86.4$ s (median $19.5$ s) after an $18$ s table build. A 20-step padded preimage costs $2^{46.6}$ CPU-reference evaluations: $191$ node-hours on one 10-core Apple M4 CPU node (16 threads), or $9.0$--$22.2$ GPU-hours on one NVIDIA L4. A companion Zero-$a_3$ bridge inverts the unpadded 20-step compression function in $2^{38.1}$ evaluations. We provide 46 self-verifying witnesses, including 55-byte preimages of SHA-256("abc") and $0^{256}$. These attacks cover 19--20 of 64 steps and do not threaten full SHA-256.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.00512 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T11:02:07.178Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).