Practical preimages for 19- and 20-step SHA-256 with standard padding
Original title: Practical Preimages for 19- and 20-Step SHA-256 with Standard Padding
One CPU core solves arbitrary 19-step padded targets in median 19.5 seconds.
The authors present practical preimage attacks on 19- and 20-step SHA-256 that respect standard IV, Davies-Meyer feed-forward, and full FIPS 180-4 padding for arbitrary 256-bit targets. They introduce an exact O(1) inversion of the low padding byte, a causal bit-slice equivalence theorem, and a closed-form F2 upper-half inverse with compact lookup tables. One CPU core solves arbitrary 19-step padded targets in 1.2--86.4 s (median 19.5 s) after an 18 s table build. A 20-step padded preimage costs 2^{46.6} CPU-reference evaluations.
- 19-step preimages solved in 1.2-86.4s median 19.5s on one CPU core
- 20-step preimages require 191 node-hours or 9.0-22.2 GPU-hours
- 46 self-verifying witnesses provided including for SHA-256(abc) and 0^256
- Attacks cover 19-20 of 64 steps and do not threaten full SHA-256
From the original article
1 min read at arxiv.orgWe present practical preimage attacks on 19- and 20-step SHA-256 that respect the standard IV, Davies-Meyer feed-forward, and full FIPS 180-4 padding, for arbitrary prescribed 256-bit targets.
By Sebastian R. Wain · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.