Algorithms & computing / SHA-256 / geometric hashing
SHA-256: geometric measurements, corrected by matched controls
The later SHA-256 working paper studies the evolution of a fully specified internal state. Its strongest contribution is a measurement protocol and a correction of earlier geometric claims, rather than a claim to break the hash function.
Research settingIBM
TL;DR
In brief
The question
Can the evolving internal state of SHA-256 be studied with exactly defined geometric measurements, and do any apparent patterns survive properly matched controls?
What the work does
Instrumented SHA-256 implementations, heat-kernel graphs on sampled working states, one-bit intervention and cube-sum measurements, frozen receipts, 57 tests and a 26-check verifier that recomputes reported numbers.
What is still open
Whether the residual round-2 cube contrast and the isolated round-7 contrast repeat under preregistered, equal-budget, significance-matched comparisons; no attack or security claim is made.
Available recordSeptember 2026 local working paper and retained evidence digest; distinct from the earlier deposited dual-torus manuscript.
From the research record
Inspect the work
Original figures, recorded values, and explicit model details. Each exhibit identifies its source and what the comparison means.
Bit significance changes the apparent advantage
Scroll horizontally to inspect the full figure →
Original September 2026 figure. Left: round-2 responses at the 32 positions of W0, discovery and holdout. Right: candidate-minus-control minimum Hamming distance on 256 fresh bases; negative favors the candidate. Blue uses 20 uniform control sets, orange 40 significance-matched sets. Bars are descriptive 95% base-bootstrap intervals, conditional on the sampled sets; rounds are discrete evaluations.
early_structure.png · Original paper figure; copied without alteration
The round-two matched-control result
Scroll horizontally to inspect the full table →
| Comparison | Reported value |
|---|---|
| Fresh base messages | 256 |
| Patterns per six-position set per base | 15 |
| Significance-matched control sets | 40 |
| Candidate minus matched-control mean | +1.55 Hamming bits |
| Descriptive 95% base-bootstrap interval | [+1.14, +1.96] bits |
| Matched sets with lower mean minimum | 36 |
Positive values favor the controls. The candidate is worse at this endpoint after matching bit significance. This is a working-state search experiment, not a collision or preimage attack.
sha256_measurement.tex · 10 September 2026 working paper; Early structure and independent evaluation
followup_numbers.tex · MatchedSearchDiffTwo, MatchedSearchCITwo, MatchedSearchBelowTwo
The research in context
A cryptographic hash function such as SHA-256 compresses a message into a fixed 256-bit digest. Its design aim is that small input changes spread unpredictably through 64 rounds of additions, rotations and bitwise mixing, so that no shortcut reveals inputs or collisions. Researchers study the intermediate working state—eight 32-bit registers updated each round—to see how quickly a change spreads. The difficulty is methodological: random-looking data produce apparent structure easily, so any pattern must be compared against an appropriate reference population before it means anything.
The September 2026 working paper defines every object exactly. Messages of 55 bytes are padded to one block; two implementations are used, a scalar one checked against Python’s hashlib and a vectorized one checked against it at selected rounds. One experiment builds a 30-nearest-neighbour graph on 512 terminal working states and computes its full Laplacian spectrum and heat trace, with the same pipeline applied to uniformly random 256-bit points. Others flip each of 440 input bits and count changed state bits, and compute cube sums (XORs over all settings of a chosen bit subset). Results are stored as frozen receipts with a verifier.
Several measurements return bounded negative answers under these conditions. For the spectral gap, and for all sixteen paired heat-trace comparisons, the SHA-minus-random intervals contain zero. The whole working state saturates at about half its 256 bits roughly six rounds after a message word enters. Two classifiers trained on actual digests average 50.3% and 49.8% accuracy over five fits each. The paper reports these as measurements of specified projections, not as evidence of security.
An explicit state space and an intervention
The reviewed September paper represents the eight 32-bit working registers as a 256-bit state and measures changes under declared input interventions. Hamming distance, graph spectra, and heat traces are specified observables of this representation. They do not by themselves establish intrinsic curvature or topology of SHA-256.
An exact round-one result has a direct modular-arithmetic explanation: the stated most-significant-bit intervention changes exactly two working-state bits. Later-round statistical claims need controls because bit position and input-entry timing affect the measured separation.
Why the choice of control changed the conclusion
The results digest reports an early-round candidate advantage against uniformly sampled control positions. Much of that advantage disappears or reverses when controls are matched for bit significance. The question changes from “does this subset beat random positions?” to “does it beat positions with the same simple arithmetic advantage?”
The retained record includes effects that failed to repeat, unresolved intervals, and a residual cube-statistic contrast whose cause is not established. Those distinctions make the work a more representative computational study than the older headline about a dual-torus architecture.
A measurement paper, with its correction history intact
The later paper explicitly claims no attack, distinguisher, security proof, or theorem about intrinsic SHA-256 geometry. It preserves the earlier code and withdrawn claims for audit. The old DOI below identifies that earlier work; it is not the identifier of the September revision. The revised release and evidence archives need their own public publication link.
The next research step
Publish the corrected release with its evidence manifest and verifier as the primary reading. Any future candidate search should predeclare an equal-budget, significance-matched comparison before interpreting a geometric pattern.
Background mathematics and definitions
For an elementary starting point, distinguish ordinary integer addition from fixed-width addition. Carries connect bit positions, while reduction discards overflow beyond the word. A proposed geometric representation must state which of these relationships it preserves and which information it omits.
- w
- Word width in bits; the hero uses a four-bit teaching example.
- Carry
- Information passed from one bit position to the next during addition.
- Attack model
- The target task, accessible information, and permitted computational resources.
Illustrative example
In four bits, 0111 + 0001 produces 1000. The three low-order carry transitions are real arithmetic structure. Their existence does not reveal how to find collisions or preimages in a cryptographic hash.
This background example is separate from the source records and the main technical figure.
Source record
Additional source versions reviewed
-
sha-256-heat_kernel/README.mdLocal project manuscript or report · not republished here -
sha-256-heat_kernel/RESULTS.mdLocal project manuscript or report · not republished here
No new experiments are reported in this research note. Figure captions distinguish saved research records, source-model calculations, and explanatory diagrams.