# SHA-256 Reversing A String of Equal Length

I've done a lot of reading on how SHA-256, I've found that SHA-256 is irreversible because more data is fed into the hashed string than the hash string contains. But, what if the data that was inputted was equal in size to the output string, a string of 64 characters is inputted a string of 64 characters is outputted. Would it be possible to reverse the hashed data back to the original string?

• "I've found that SHA-256 is irreversible because more data is fed into the hashed string than the hash string contains." I think any correct answer should debunk this idea. – Maarten Bodewes Sep 5 '15 at 10:28

SHA256 gives 256 bits, which is 32 bytes, not 64 "characters" (please use the well-defined bits and bytes). When written in hexadecimal notation, you need 64 characters from 0-9a-f, but the length of the hash is 256 bits.

Yes, you could invert the hash. Unfortunately, a straightforward lookup table would be too large to store, but you can still do brute force without memory. This would take you on average $2^{255}$ tries (that's many).

There have been papers, like "Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 family" which discuss preimage resistance attacks on the SHA-2 family, but they're, as far as I know, all academical breaks (meaning they cannot really be exploited efficiently.

• So I'm wondering how are the 32 bytes of output calculated using the data that is inputted? – user27545 Sep 5 '15 at 7:10
• @will it's a Merkle-Damgård construction, basically what they do is running the input several times through a compression function. See the SHA-2 wiki under "Hash standard" or the Merkle-Damgård wiki. – Keelan Sep 5 '15 at 7:15
• Worth noting "compression function" in cryptography is not same as data compression used in .zip etc files. Most importantly, there is no simple paired "decompression" that gets the original data back. – Neil Slater Sep 5 '15 at 8:01
• What if I wanted to calculate the SHA-256 value of a string using a calculator, pencil and a piece of paper. What mathematical steps does the string undergo in order to generate the same output every time? I'm not a mathematician so please try to explain the functions with detail. Thanks for the help so far. – user27545 Sep 5 '15 at 8:03
• @will Just look at the Wiki link that Camil gave, it gives the pseudo-code so you can implement yourself and not worth repeating here. It would take a very long time to do with a calculator, pencil and paper, but it is possible. – Neil Slater Sep 5 '15 at 8:10

SHA-256 - or any cryptographically secure hash - relies on the internal construction of the hash to have the one-way property. This one-way property is maintained for any kind and size of input.

However, if the input domain is small enough then it may be able to brute force the hash value. As SHA-256 is not keyed anybody can perform the calculations. So all the attacker has to do is to compare the hash output of a candidate message against the hash of the original message.

Now you've indicated an input and output domain of 64 characters. I'll assume hexadecimals here. That would mean an input/output of 32 bytes or 256 bits. So you would have $2^{256}$ values to try if you would have to try them all. You can of course find the hash earlier than that, so on average you would have to try $2^{256} / 2 = 2^{255}$ values. This is considered unfeasible.

If you have multiple values to test then you would find a matching candidate "much earlier", if you consider anything above $2^{128}$ "much earlier", as it is still completely unfeasible.

So the answer to "Would it be possible to reverse the hashed data back to the original string?" is "no". This answer does however assume that every possible byte (or hexadecimal character) is equally likely. If the input domain is much smaller it may be possible to brute force it using the method above.

Above assumes that SHA-256 isn't broken in any non-academical sense.