# Finding the IV values for SHA-256

I should start by saying this question has little to no practical application. It is purely recreational. I am not trying to solve a specific problem, beyond "I wonder…"

If I had an initial input (say 64 bytes long, all in hex) and I had a desired output, is there an efficient way (read: not brute force) to find IV values that would give the desired output, after 64 rounds?

In other words, accepting that SHA-256 has no backdoor, how would I find IVs that did create a backdoor?

• You might be interested in this paper; Technically it's about SHA1, but it is about playing with the IVs. – Ella Rose Jul 8 '17 at 20:21

SHA-256 is a Merkle-Damgård hash using a compression function built per the Davies-Meyer construction. Assuming the known input fits 55 bytes (that is, can be expressed as at most 110 hex characters, which either matches the question, or is close to that), it is padded into a single 512-bit block $B$. What's asked amounts to finding 256-bit $I$ with $E_B(I)\boxplus I=H$ where $E$ is a 64-round 256-bit block cipher having 512-bit key $B$, $H$ is the 256-bit desired output, and $\boxplus$ is 256-bit addition without carry across 32-bit boundaries. For an idealized cipher, there's demonstrably nothing better than brute force to solve this problem, and we do not know a significantly better method for the particular cipher used in SHA-256.
For larger input, what's asked seems to require breaking that same problem except for a different (or a few different) values of $H$ obtained by breaking the second and possibly later round(s), thus is likely not much easier (rather, slightly harder). And provably, if we could break the multi-rounds problem in general, that would allow to break the one-round problem with about the same work.