In De Canniere & Rechberger's 2008 paper "Preimages for Reduced SHA-0 and SHA-1", the following statement appears on page 6:
Suppose that we restrict ourselves to the first $j$ + 1 bits of each expanded message word $W_i$ (denoted by $W^{j...0}_i$), and that we keep all state bits constant except for those at bit position $j$ + 2 (referred to as $a^{j+2}_i$). In this case, we can derive a simple relation (by collecting all constant parts into a $j$ + 1-bit word $C^{j...0}_i$ and a 1-bit variable $c^j_i$), which holds as long as $0 \leq j < 25$: $$ W^{j...0}_i = C^{j...0}_i − (f(c^j_i , a^{j+2}_{i−2} , a^{j+2}_{i−3}) \ll j) − (a^{j+2}_{i−4} \ll j). $$
I've been trying to understand why this relation holds for many hours, and still can't figure out how it can be true.
The $f$ function takes three inputs: $a_{i-1}^{j}$, $a_{i-2}^{j+2}$, and $a_{i-3}^{j+2}$. Therefore, $c_i^j = a_{i-1}^{j}$, but the text indicates that $c_i^j = a_{i}^{j+2}$. How is this possible?
What has happened to the $A_{i+1}$ and $A_i$ terms? Have they somehow been incorporated into $C_i^{j..0}$ by the text "collecting all constant parts"?
I'd be grateful for anyone who can point me in the direction of source code that implements a preimage attack like this, but if no such thing exists, then I'll be happy for an explanation of the above, and I'll try to work out the rest of the details myself.
Edit: is there a typo? If so, what is the correct relation? I ask because I've just noticed that on the previous page, the error word relation is definitely incorrect. It should be
$$ E_i = W_i \oplus ((W_{i+3} \oplus W_{i+8} \oplus W_{i+14} \oplus W_{i+16}) \ggg s) $$