fgrieu gives a compelling visual illustration, but we can quantify this too. From Harris 1960 (paywall-free), for a uniform random function $H$ on $\ell$ elements, the number of $q$ elements that lie on a cycle is distributed by $$p(q) = \frac{(\ell - 1)! \, q}{(\ell - q)! \, \ell^q},$$ whose expectation grows with $\frac 1 2 \sqrt{2 \pi \ell}$. If we model SHA-256 as a uniform random function (a model which breaks down when we consider length-extension attacks but largely reasonable on fixed-length inputs), we have $\ell = 2^{256}$. So the probability that any particular element is on a cycle is about $1/(2^{127} \sqrt{2\pi})$. In other words, unless you know something special about SHA-256, you will never even find an element on a cycle.

What about the distribution on cycle lengths $n$? It turns out to have the same distribution, with expected value $2^{127} \sqrt{2\pi}$ for a 256-bit function. So even if you somehow found an element on a cycle, you almost certainly wouldn't be able to confirm whether it's on a cycle or not—again, unless you know something special about SHA-256.

Pretty much everything else you need to know about these distributions for uniform random functions and permutations—and uniform random functions and permutations that never map an element to itself—is covered in the Harris paper too!

fgrieu gives a compelling visual illustration, but we can quantify this too. From Harris 1960 (paywall-free), for a uniform random function $H$ on $\ell$ elements, the number of $q$ elements that lie on a cycle is distributed by $$p(q) = \frac{(\ell - 1)! \, q}{(\ell - q)! \, \ell^q},$$ whose expectation grows with $\frac 1 2 \sqrt{2 \pi \ell}$. If we model SHA-256 as a uniform random function (a model which breaks down when we consider length-extension attacks but largely reasonable on fixed-length inputs), we have $\ell = 2^{256}$. So the probability that any particular element is on a cycle is about $1/(2^{127} \sqrt{2\pi})$. In other words, unless you know something special about SHA-256, you will never even find an element on a cycle.

What about the distribution on cycle lengths $n$? It turns out to have the same distribution, with expected value $2^{127} \sqrt{2\pi}$ for a 256-bit function. So even if you somehow found an element on a cycle, you almost certainly wouldn't be able to confirm whether it's on a cycle or not—again, unless you know something special about SHA-256.

Pretty much everything else you need to know about these distributions for uniform random functions and permutations—and uniform random functions and permutations that never map an element to itself—is covered in the Harris paper too!

fgrieu gives a compelling visual illustration, but we can quantify this too. From Harris 1960 (paywall-free), for a uniform random function $H$ on $\ell$ elements, the number of $q$ elements that lie on a cycle is distributed by $$p(q) = \frac{(\ell - 1)! \, q}{(\ell - q)! \, \ell^q},$$ whose expectation grows with $\frac 1 2 \sqrt{2 \pi \ell}$. If we model SHA-256 as a uniform random function (a model which breaks down when we consider length-extension attacks but largely reasonable on fixed-length inputs), we have $\ell = 2^{256}$. So the expected probability that any particular element is on a cycle is about $1/(2^{127} \sqrt{2\pi})$. In other words, unless you know something special about SHA-256, you will never even find an element on a cycle.

What about the distribution on cycle lengths $n$? It turns out to have the same distribution, with expected value $2^{127} \sqrt{2\pi}$ for a 256-bit function. So even if you somehow found an element on a cycle, you almost certainly wouldn't be able to confirm whether it's on a cycle or not—again, unless you know something special about SHA-256.

Pretty much everything else you need to know about these distributions for uniform random functions and permutations—and uniform random functions and permutations that never map an element to itself—is covered in the Harris paper too!

fgrieu gives a compelling visual illustration, but we can quantify this too. From Harris 1960 (paywall-free), for a uniform random function $H$ on $\ell$ elements, the number of $q$ elements that lie on a cycle is distributed by $$p(q) = \frac{(\ell - 1)! \, q}{(\ell - q)! \, \ell^q},$$ whose expectation grows with $\frac 1 2 \sqrt{2 \pi \ell}$. If we model SHA-256 as a uniform random function (a model which breaks down when we consider length-extension attacks but largely reasonable on fixed-length inputs), we have $\ell = 2^{256}$. So the probability that any particular element is on a cycle is about $1/(2^{127} \sqrt{2\pi})$. In other words, unless you know something special about SHA-256, you will never even find an element on a cycle.

What about the distribution on cycle lengths $n$? It turns out to have the same distribution, with expected value $2^{127} \sqrt{2\pi}$ for a 256-bit function. So even if you somehow found an element on a cycle, you almost certainly wouldn't be able to confirm whether it's on a cycle or not—again, unless you know something special about SHA-256.

Pretty much everything else you need to know about these distributions for uniform random functions and permutations—and uniform random functions and permutations that never map an element to itself—is covered in the Harris paper too!