# Has a SHA256 output ever been found consisting entirely of the same character?

Is it possible to have an output consisting purely of one character and does this change the entropy of that output? (If that's even possible to ascertain.)

As an example, the Bitcoin cryptocurrency is slowly and inadvertently compiling a list of inputs which produce outputs with successively larger numbers of trailing zeros in its blockchain. Will these ever be used to study the SHA-256 algorithm?

• Entropy is defined for random variables. (The entropy of a constant random variable is 0.) – Elias Aug 3 '17 at 9:00
• A preimage of $000\dots 0$ has no more meaning than a preimage of any other hash value. Even if someone knew such a preimage, it is wrong to assume that such a preimage would help "to study the sha256 algorithm". I am not entirely sure what you actually mean with that, the statement is very unspecific. There already is a lot of cryptanylsis for SHA-256. – tylo Aug 3 '17 at 10:31

If any filtering criterion on the output of SHA-256 (with its definition independent of SHA-256 internals) leaves $n$ possible values out of $2^{256}$, then as far as we know,
• the expected number of hashes (compressions) required for this is $2^{256}/n$;
• the $n$ outputs are equiprobable, thus the entropy of the process generating SHA-256 hashes passing that criterion from random input is $\log_2(n)$ bit/output, or $n\log_2(n)2^{-256}$ bit/input.
An output consisting purely of one character is such a criterion, with $n=16$ if we read character as hexadecimal digit. It is expected that $2^{252}$ hashes would be necessary to achieve that. Based on blockchain statistics (currently $7\cdot10^{18}$ SHA-256d per second), I guestimate that less than $2^{95}$ SHA-256 hashes have been performed by mankind; thus, with overwhelming odds, nothing giving a hash passing said criteria was ever hashed. Our best estimate of the theoretical entropy rate of this process is $4$ bit/output, or $2^{-250}$ bit/input.