SHA-256 Hashing

Suppose you want to prove that you wrote a document on a certain day, without revealing the document. Or you want a server to check your password without the server ever storing the password itself. Or you want thousands of strangers to agree on a shared ledger without trusting each other. All three problems need the same strange tool: a way to turn any piece of data into a short fingerprint that is easy to compute, but practically impossible to trace back to the data.

SHA-256 is one of the most widely used tools of this kind. Type the three letters abc into it and you get

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Change one letter to abd and the output becomes

a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9

The two outputs differ in 122 of their 256 bits, about half, which is what you would expect from two unrelated random strings. Nothing in the second output hints that the input changed by only one letter.

First, a Correction: It Is Not Encryption

The phrase "SHA-256 encryption" is common, but it is technically wrong, and the difference matters.

Encryption is a two-way process. You lock a message with a key, and anyone holding the right key can unlock it and recover the original message exactly. Nothing is lost.

SHA-256 is a cryptographic hash function. It is a one-way process with no key and no unlocking step. It takes an input of almost any length (up to $2^{64}-1$ bits) and always produces exactly 256 bits. ^[1] A full-length film and the single letter a both produce 256-bit outputs. There is nothing to decrypt, because the output does not contain the input. It contains a fingerprint of it.

So when people ask how to "decrypt" SHA-256, the honest answer has two parts:

1. In principle, the input is gone. Countless different inputs share every possible output. A 256-bit output cannot store a one-gigabyte file.
2. In practice, the question becomes: can you find any input that produces a given output? That is the real problem, and it is the one SHA-256 is designed to make impossible in practice.

The rest of this article explains how SHA-256 works, why nobody knows how to run it backwards, and what doing so would take.

The Three Promises of a Hash Function

A cryptographic hash function $H$ is expected to keep three promises. They were formalized carefully in the cryptographic literature, most clearly by Phillip Rogaway and Thomas Shrimpton. ^[2]

Let $n = 256$ be the output length in bits.

Preimage resistance (one-wayness). Given an output $y$, it should be infeasible to find any input $x$ with $H(x) = y$. The best generic method, guessing inputs at random, succeeds with probability $2^{-256}$ per guess, so it needs about $2^{256}$ guesses.

Second-preimage resistance. Given a specific input $x$, it should be infeasible to find a different input $x' \neq x$ with $H(x') = H(x)$. This also costs about $2^{256}$ guesses generically.

Collision resistance. It should be infeasible to find any two different inputs $x \neq x'$ with the same output. This is easier for an attacker, because of the birthday paradox: in a room of just 23 people, two probably share a birthday, even though there are 365 possible days. The number of pairs grows with the square of the number of people. For hash outputs, after trying $k$ random inputs, the chance that some pair collides is roughly

Setting this near 1 gives $k \approx 2^{n/2}$. For SHA-256, that is about $2^{128}$ hash evaluations.

These numbers describe what any attacker can do against any hash function, without exploiting its internal structure. A hash function is considered secure as long as no attack does meaningfully better.

How SHA-256 Works

SHA-256 was designed by the US National Security Agency and published by NIST in the early 2000s as part of the SHA-2 family. The current specification is FIPS 180-4, the Secure Hash Standard. ^[1] The algorithm is completely public. Its security does not depend on secrecy, only on the difficulty of the mathematics.

Step 1: Padding

The message is first extended so that its length is a multiple of 512 bits. SHA-256 appends a single 1 bit, then enough 0 bits, then the original message length written as a 64-bit number. Including the length stops certain tricks in which two messages of different lengths are made to look alike. ^[1]

Step 2: The Merkle–Damgård chain

The padded message is split into 512-bit blocks $M_1, M_2, \ldots, M_N$. SHA-256 keeps a 256-bit running state, starting from a fixed initial value $H_0$. It then feeds in one block at a time:

Here $f$ is the compression function: it takes the current 256-bit state and a 512-bit block and produces a new 256-bit state. The final state is the hash.

This structure was proposed independently by Ralph Merkle and Ivan Damgård in 1989. ^[3,4] Their key result was a guarantee: if the compression function $f$ is collision-resistant, and the length is included in the padding, then the full hash function is collision-resistant too. That lets designers focus all their effort on one fixed-size function.

The construction has one known quirk, called length extension. Because the output is the internal state, someone who knows $H(m)$ and the length of $m$ can compute the hash of $m$ followed by extra data, without knowing $m$. This does not help reverse the hash, but it means SHA-256 should not be used naively as a keyed authentication code. The standard fix is HMAC, which wraps the hash in two keyed passes. ^[5]

Step 3: The compression function

Inside $f$, the 256-bit state is held as eight 32-bit words, traditionally called $a, b, c, d, e, f, g, h$. The 512-bit block is expanded into 64 words, and the state is scrambled in 64 rounds, one word per round.

All operations act on 32-bit words. The building blocks are:

• $\oplus$: bitwise XOR ("exclusive or").
• $\wedge$, $\neg$: bitwise AND and NOT.
• $\mathrm{ROTR}^k(x)$: rotate the bits of $x$ right by $k$ positions, with bits falling off the end reappearing at the front.
• $\mathrm{SHR}^k(x)$: shift right by $k$ positions, discarding bits.
• $+$: addition modulo $2^{32}$, meaning ordinary addition with any overflow past 32 bits thrown away.

From these, FIPS 180-4 defines six functions: ^[1]

Each has a simple job:

• Ch ("choose") uses each bit of $x$ as a switch: where $x$ has a 1, take the bit from $y$; where it has a 0, take the bit from $z$.
• Maj ("majority") outputs, bit by bit, whichever value appears in at least two of its three inputs.
• The $\Sigma$ and $\sigma$ functions combine three rotated copies of a word, so that every output bit depends on several distant input bits.

The message schedule. The first 16 words $W_0, \ldots, W_{15}$ are simply the 16 32-bit pieces of the block. The remaining 48 are generated from earlier ones:

This spreads every bit of the message across many rounds, so that no part of the input affects only one round.

The rounds. In each round $t = 0, \ldots, 63$, two temporary values are computed:

and then the eight words shift along like a conveyor belt:

After 64 rounds, the result is added word by word to the state that went in. That final addition means that even if someone could run the 64 rounds backwards, they would still not know which starting state to subtract.

The constants. The 64 round constants $K_t$ are the first 32 bits of the fractional parts of the cube roots of the first 64 prime numbers. The initial state $H_0$ comes from the fractional parts of the square roots of the first 8 primes. ^[1] These are sometimes called "nothing-up-my-sleeve numbers": they are chosen from an obvious public recipe, so that the designers could not have hidden a secret weakness in carefully tuned values.

Why the mixture matters

Each individual operation is easy to undo. XOR is its own inverse. Rotation can be reversed. Addition can be subtracted. The difficulty comes from mixing operations that belong to different kinds of algebra. XOR behaves nicely in one mathematical system (bits added without carries); modular addition behaves nicely in another (whole numbers with carries). Ch and Maj are nonlinear in both. An equation that is simple in one language becomes a tangle in the other, and after 64 rounds, each output bit depends on every input bit through an enormous, interlocking expression.

The avalanche effect

The visible result is the avalanche effect: changing a single input bit changes each output bit with probability close to one half, as if the output had been redrawn at random. That is what the abc and abd example shows. Without an avalanche, an attacker could make small changes to an input and watch the output move closer to a target. With it, every guess gives no information about how close you are. Being "one bit away" from the right input looks exactly like being completely wrong.

Why It Cannot Be Reversed

There are two distinct reasons, and they should be kept apart.

Reason 1: Information is destroyed (mathematical fact)

SHA-256 maps an effectively unlimited set of inputs into $2^{256}$ outputs. By the pigeonhole principle, most outputs have enormous numbers of inputs that produce them. Even an all-powerful computer could not tell you which one was "the" original. At best it could give you a matching input.

This is also why encryption and hashing are fundamentally different. An encryption function must be reversible, or you could never read your own messages. A hash function is designed to throw information away.

Reason 2: No shortcut is known (empirical, not proven)

Finding some matching input is still a well-defined problem. The question is whether there is any method faster than guessing. Here the status is more subtle:

• No one has proved that SHA-256 is one-way. In fact, no one has proved that any one-way function exists. A proof would settle famous open problems in computer science, including a version of the P versus NP question.
• What exists instead is evidence from failed attacks. For more than two decades, cryptographers around the world have tried to find structure in SHA-256 that could be exploited. Their best results only work on weakened versions.

So "SHA-256 cannot be reversed" is best described as an accepted, well-tested assumption, not a theorem. It is similar in status to a physical theory that has survived every experiment so far.

What the best attacks achieve

The standard way to measure progress is to attack SHA-256 with fewer than its 64 rounds and see how many rounds can be broken.

• Collisions. In 2013, Florian Mendel, Tomislav Nad and Martin Schläffer described a collision attack on 31 of the 64 steps, with a cost of about $2^{65.5}$, and a practical attack on 38 steps in a weaker "semi-free-start" setting, where the attacker may also choose the starting state. ^[7] In 2024, Yingxin Li, Fukang Liu and Gaoli Wang extended the semi-free-start result to 39 steps, and in a separate paper with co-authors produced the first actual colliding pair for 31-step SHA-256. ^[8,9] After more than a decade stuck at 31 steps, a 2026 paper pushed the collision attack to 37 steps using automated searches for better differential trails. ^[25] A 2026 preprint, not yet peer reviewed at the time of writing, reports an actual colliding pair for 36 steps and a theoretical attack on 38 steps costing about $2^{104}$. ^[26]
• Preimages. The best preimage attacks, using a technique called bicliques, reach about 45 of the 64 rounds, and even then they are only marginally faster than brute force. ^[10]

No attack is known on full 64-round SHA-256 that beats the generic bounds. The remaining margin, roughly 25 rounds for collision attacks and about 19 for preimages, is the reason SHA-256 is still trusted. The recent progress is also a reminder that this margin is measured, not guaranteed.

It is worth remembering that this is how older hash functions fell. MD5 and SHA-1 were broken gradually, round by round, until a full collision for SHA-1 was finally computed in 2017, at a cost of about $2^{63}$ operations. ^[6] That history is why cryptographers watch round-reduced results closely. SHA-256 shows no sign of following the same path, but "no sign yet" is the honest form of the claim.

What Reversing It Would Take

Since no shortcut is known, reversing SHA-256 means guessing. How much guessing is that?

The brute-force numbers

Imagine a machine that performs $10^{21}$ SHA-256 evaluations per second. That is roughly the scale of the entire worldwide Bitcoin mining network in the mid-2020s, the largest hashing effort humans have ever built.

• Finding a collision needs about $2^{128} \approx 3.4 \times 10^{38}$ evaluations. At $10^{21}$ per second, that takes about $10^{10}$ years, comparable to the age of the universe.
• Finding a preimage needs about $2^{256} \approx 1.2 \times 10^{77}$ evaluations. At the same rate, that takes about $4 \times 10^{48}$ years.

For scale, $2^{256}$ is within a few orders of magnitude of common estimates for the number of atoms in the observable universe.

The thermodynamic argument

Faster computers do not change this picture much, because physics sets a floor on the energy cost of ordinary computation.

In 1961 Rolf Landauer argued that erasing one bit of information must release at least a minimum amount of heat: ^[11]

Here $k_B \approx 1.38 \times 10^{-23}\ \text{J/K}$ is Boltzmann's constant, $T$ is the temperature of the computer in kelvin, and $\ln 2 \approx 0.693$. At room temperature (300 K), $E_{\min} \approx 2.9 \times 10^{-21}$ joules per erased bit. This bound was confirmed experimentally in 2012 using a single microscopic bead in an optical trap. ^[12]

A brute-force search has to step through its candidates, and an ordinary counter moving through $2^{256}$ states must change bits at least that many times. Even under the generous assumption of one bit erased per candidate:

The Sun radiates about $3.8 \times 10^{26}$ watts. Over its entire ten-billion-year life, that is roughly $10^{44}$ joules. A brute-force preimage search on conventional hardware would need a few trillion times the Sun's total lifetime output, and that is before counting the thousands of operations inside each actual SHA-256 evaluation. Running the computer at the 3 K temperature of deep space lowers the figure by a factor of 100, which does not change the conclusion.

Two honest caveats belong here:

1. The argument assumes irreversible computing. Landauer's bound applies to erasing information. In principle, logically reversible computers can avoid it. Other physical limits still apply. The Margolus–Levitin theorem caps how many operations per second a system with a given energy can perform, and Seth Lloyd used such limits to estimate the "ultimate laptop". ^[13,14] Those ultimate limits are far looser than anything engineering can approach, so the thermodynamic argument is best read as a strong sanity check, not a proof of impossibility.
2. The argument protects $2^{256}$, not $2^{128}$. Repeating the Landauer calculation for $2^{128}$ steps gives roughly $10^{18}$ joules, which is small by national energy standards. What protects 128-bit security is time and the real cost of hardware, not thermodynamics. That is still an enormous margin, but it is a different kind of margin.

The small-input exception

There is one situation in which SHA-256 is "reversed" routinely: when the input comes from a small, guessable set. If the input is a common password, a date, or a word in the dictionary, an attacker does not need to search $2^{256}$ possibilities. They simply hash every likely candidate and compare. Precomputed lookup tables for common inputs make this even faster.

This does not break SHA-256. It exploits the fact that the input had very little uncertainty to begin with. A hash can only be as hard to reverse as its input is hard to guess.

What Quantum Computers Change

Quantum computers are often described as a threat to all cryptography. For hash functions the effect is real but limited. (See Grover's algorithm for how the relevant algorithm works.)

Preimages. Lov Grover's search algorithm can find a preimage of an $n$-bit hash with about $\tfrac{\pi}{4}\,2^{n/2}$ evaluations of the hash on a quantum computer, instead of $2^n$. ^[15] For SHA-256 that is about $2^{128}$ steps. This speedup is provably the best possible for generic search. However:

• Grover's steps must run largely one after another. Splitting the work across $P$ quantum machines only reduces the time by a factor of $\sqrt P$, not $P$.
• Each step requires running a full, reversible SHA-256 circuit on error-corrected qubits. A 2016 cost estimate by Amy and colleagues put a Grover preimage attack on SHA-256 at around $2^{166}$ logical-qubit-cycles once error correction is included, far above the naive $2^{128}$. ^[19]

Collisions. The Brassard–Høyer–Tapp algorithm reduces collision search to about $2^{n/3}$ quantum queries, around $2^{85}$ for SHA-256, but only by storing a similar number of values in quantum memory. ^[16] Daniel Bernstein argued that, once hardware cost is counted, this is not better than well-engineered classical parallel collision search, which already runs at about $2^{n/2}$ total work spread across many cheap machines. ^[17,18]

NIST's assessment is that large quantum computers would break today's public-key systems such as RSA and elliptic curves, while for hash functions like SHA-2 a "larger output" is sufficient. ^[20] In practice, SHA-256's 128-bit post-quantum preimage margin is widely regarded as adequate, and SHA-384 or SHA-512 are available where extra margin is wanted.

Established fact: Grover's algorithm gives a quadratic speedup for preimage search, and no quantum algorithm can do better for generic search. Current engineering reality: no existing quantum computer can run even a small fraction of a SHA-256 circuit with error correction.

Where SHA-256 Is Used

Bitcoin

Bitcoin uses SHA-256 in two central places. ^[21] Transactions are hashed together into a tree, so that changing any transaction changes the fingerprint of the entire block. And mining is a deliberate preimage-style search: miners repeatedly change a small field in a block header and hash it (twice) until the output happens to fall below a target number, meaning it begins with a long run of zeros.

Because no shortcut exists, the only way to find such a hash is to try enormous numbers of candidates. That is exactly the point: the cost of the search is the "proof of work" that makes rewriting history expensive. Notice that miners are not reversing SHA-256. They are solving a much easier problem, finding some input whose output lands in a large target range, and the difficulty is tuned so that the whole network succeeds about once every ten minutes.

Passwords: a common mistake

SHA-256 is often misused for storing passwords. The problem is that SHA-256 is designed to be fast. That is ideal for checking file integrity and terrible for passwords, because it lets an attacker test billions of password guesses per second on ordinary graphics hardware.

The Open Worldwide Application Security Project (OWASP) states plainly that fast hashes such as SHA-256 are unsuitable for password storage. ^[22] Password storage should use functions designed to be slow and memory-hungry, with a unique random "salt" for each user: Argon2id is the current first recommendation, followed by scrypt and bcrypt, with PBKDF2 where specific compliance rules require it. ^[22,23] NIST's digital identity guidelines give similar advice. ^[24]

Everywhere else

SHA-256 also underpins software update verification, digital signatures (which sign a hash of the document rather than the document itself), secure web connections, version control systems, and file deduplication. In each case it provides the same guarantee: if two fingerprints match, the data almost certainly matches too.

Limitations and Open Questions

• Security is not proven. SHA-256's one-wayness and collision resistance rest on decades of failed attacks, not on a mathematical proof.
• Structural quirks exist. Length extension is a real property of the Merkle–Damgård design. It is harmless when SHA-256 is used correctly (for example inside HMAC) and harmful when it is not.
• Attacks improve unevenly. Collision attacks stalled at 31 steps from 2013 until 2026, then jumped to 37. The full 64 rounds remain far out of reach, but progress can come in bursts, so monitoring continues.
• Inputs matter. No hash protects a guessable input.
• Quantum effects are bounded but not zero. A mature, error-corrected quantum computer would halve the security exponent for preimages. That remains an engineering prospect, not a present capability.

The Bet Inside Every Hash

SHA-256 is a piece of pure mathematics that behaves, for all practical purposes, like a physical law: data goes in, a fingerprint comes out, and no one can walk the path backwards.

The algorithm is public and precisely specified. The best attacks reach only reduced versions; generic attacks cost $2^{128}$ for collisions and $2^{256}$ for preimages; and ordinary computation at the $2^{256}$ scale would demand far more energy than the Sun will ever produce.

A mathematical shortcut could still be discovered. Nothing proves that it cannot, and the histories of MD5 and SHA-1 show how suddenly confidence in a hash function can change. At a deeper level, computer science has not proved that true one-way functions exist at all. Every use of SHA-256, from a password check to a Bitcoin block, quietly bets that they do.

For related ideas about what physics allows and forbids a computer to do, see Grover's algorithm. For a very different kind of irreversibility, the one built into thermodynamics and time, see the block universe and determinism.

References

[1] National Institute of Standards and Technology (2015). "Secure Hash Standard (SHS)." Federal Information Processing Standards Publication FIPS 180-4. https://doi.org/10.6028/NIST.FIPS.180-4

[2] Rogaway, P., & Shrimpton, T. (2004). "Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance." Fast Software Encryption (FSE 2004), Lecture Notes in Computer Science, 371–388. https://doi.org/10.1007/978-3-540-25937-4_24

[3] Merkle, R. C. (1990). "One Way Hash Functions and DES." Advances in Cryptology – CRYPTO '89 Proceedings, Lecture Notes in Computer Science, 428–446. https://doi.org/10.1007/0-387-34805-0_40

[4] Damgård, I. B. (1990). "A Design Principle for Hash Functions." Advances in Cryptology – CRYPTO '89 Proceedings, Lecture Notes in Computer Science, 416–427. https://doi.org/10.1007/0-387-34805-0_39

[5] Krawczyk, H., Bellare, M., & Canetti, R. (1997). "HMAC: Keyed-Hashing for Message Authentication." RFC 2104, Internet Engineering Task Force. https://doi.org/10.17487/RFC2104

[6] Stevens, M., Bursztein, E., Karpman, P., Albertini, A., & Markov, Y. (2017). "The First Collision for Full SHA-1." Advances in Cryptology – CRYPTO 2017, Lecture Notes in Computer Science, 570–596. https://doi.org/10.1007/978-3-319-63688-7_19

[7] Mendel, F., Nad, T., & Schläffer, M. (2013). "Improving Local Collisions: New Attacks on Reduced SHA-256." Advances in Cryptology – EUROCRYPT 2013, Lecture Notes in Computer Science, 262–278. https://doi.org/10.1007/978-3-642-38348-9_16

[8] Li, Y., Liu, F., & Wang, G. (2024). "New Records in Collision Attacks on SHA-2." Advances in Cryptology – EUROCRYPT 2024, Lecture Notes in Computer Science, 158–186. https://doi.org/10.1007/978-3-031-58716-0_6

[9] Li, Y., Liu, F., Wang, G., Dong, X., & Sun, S. (2024). "The First Practical Collision for 31-Step SHA-256." Advances in Cryptology – ASIACRYPT 2024, Lecture Notes in Computer Science, 237–266. https://doi.org/10.1007/978-981-96-0941-3_8

[10] Khovratovich, D., Rechberger, C., & Savelieva, A. (2012). "Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family." Fast Software Encryption (FSE 2012), Lecture Notes in Computer Science, 244–263. https://doi.org/10.1007/978-3-642-34047-5_15

[11] Landauer, R. (1961). "Irreversibility and Heat Generation in the Computing Process." IBM Journal of Research and Development, 5(3), 183–191. https://doi.org/10.1147/rd.53.0183

[12] Bérut, A., Arakelyan, A., Petrosyan, A., Ciliberto, S., Dillenschneider, R., & Lutz, E. (2012). "Experimental verification of Landauer's principle linking information and thermodynamics." Nature, 483, 187–189. https://doi.org/10.1038/nature10872

[13] Lloyd, S. (2000). "Ultimate physical limits to computation." Nature, 406, 1047–1054. https://doi.org/10.1038/35023282

[14] Margolus, N., & Levitin, L. B. (1998). "The maximum speed of dynamical evolution." Physica D: Nonlinear Phenomena, 120(1–2), 188–195. https://doi.org/10.1016/S0167-2789(98)00054-2

[15] Grover, L. K. (1996). "A fast quantum mechanical algorithm for database search." Proceedings of the 28th Annual ACM Symposium on Theory of Computing (STOC '96), 212–219. https://doi.org/10.1145/237814.237866

[16] Brassard, G., Høyer, P., & Tapp, A. (1998). "Quantum cryptanalysis of hash and claw-free functions." LATIN'98: Theoretical Informatics, Lecture Notes in Computer Science, 163–169. https://doi.org/10.1007/BFb0054319

[17] Bernstein, D. J. (2009). "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?" SHARCS'09 Workshop Record. https://cr.yp.to/hash/collisioncost-20090823.pdf

[18] van Oorschot, P. C., & Wiener, M. J. (1999). "Parallel Collision Search with Cryptanalytic Applications." Journal of Cryptology, 12(1), 1–28. https://doi.org/10.1007/PL00003816

[19] Amy, M., Di Matteo, O., Gheorghiu, V., Mosca, M., Parent, A., & Schanck, J. (2017). "Estimating the Cost of Generic Quantum Pre-image Attacks on SHA-2 and SHA-3." Selected Areas in Cryptography – SAC 2016, Lecture Notes in Computer Science, 317–337. https://doi.org/10.1007/978-3-319-69453-5_18

[20] Chen, L., Jordan, S., Liu, Y.-K., Moody, D., Peralta, R., Perlner, R., & Smith-Tone, D. (2016). "Report on Post-Quantum Cryptography." NIST Interagency Report NISTIR 8105. https://doi.org/10.6028/NIST.IR.8105

[21] Nakamoto, S. (2008). "Bitcoin: A Peer-to-Peer Electronic Cash System." https://bitcoin.org/bitcoin.pdf

[22] OWASP Foundation. "Password Storage Cheat Sheet." OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

[23] Biryukov, A., Dinu, D., & Khovratovich, D. (2016). "Argon2: New Generation of Memory-Hard Functions for Password Hashing and Other Applications." 2016 IEEE European Symposium on Security and Privacy (EuroS&P), 292–302. https://doi.org/10.1109/EuroSP.2016.31

[24] Grassi, P. A., Fenton, J. L., Newton, E. M., et al. (2017). "Digital Identity Guidelines: Authentication and Lifecycle Management." NIST Special Publication 800-63B. https://doi.org/10.6028/NIST.SP.800-63b

[25] Zhang, Z., Li, M., Gao, L., & Wang, M. (2026). "Collision Attacks on SHA-256 up to 37 Steps with Improved Trail Search." Advances in Cryptology – EUROCRYPT 2026, Lecture Notes in Computer Science, 91–120. https://doi.org/10.1007/978-3-032-25333-0_4

[26] Li, Y., Zhang, Z., Li, M., Liu, F., Qian, H., & Zhu, J. (2026). "Pushing Collision Attacks on SHA-2 to 39 Steps." IACR Cryptology ePrint Archive, Paper 2026/1120 (preprint). https://eprint.iacr.org/2026/1120