Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256?
I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally imagine that a bitcoin miner randomed onto one.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Would possessing a string with the sha-256 hash of all zero bits lead to an attack on sha-256?
No, it would not lead to any useful attack on SHA-256. You’ld only have an input string that hashes to 256 zero-bit output. It may be nice to know and look at, but it doesn’t buy you anything useful to attack SHA-256. All in all, it’s no different from any other hash value produced by hashing some value to another specific SHA-256 output. Just because your input renders an SHA-256 output of 256 zero-bits doesn’t mean, nor indicate that SHA-256 is broken and it certainly doesn’t open an attack vector on SHA-256.
I could easily imagine that a specialized attack leaked knowledge of how to do it,
At the time of writing this, no such attack is known. Remember that SHA-256 has been around for a few years. The algorithm has been tested, analysed, attacked, and verified by governmental agencies as well as independant people worldwide. If there would be any weakness/shortcut in the algorithm which would enable someone to produce a 256 zero-bit hash, it would have been found. But no such findings have been made… which is why we all SHA-256 a “well vetted, cryptographically secure hash”.
Besides, being able to say “I have this set of bytes that, when I feed it to SHA-256, outputs an all-zero hash” doesn’t open any door to a cryptographical attack. It’s no different from knowing that “hello world” hashes to “b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9”.
Having knowledge of something like that doesn’t point at a weakness or attack vector. It’s what SHA-256 does: hash a specific input into a specific output. If that output happens to be
000…000 then so be it. It may be nice for some people to know how to produce a 256 zero-bit output, but it doesn‘t have any impact whatsoever on the security claims of SHA-256.
Things would be different if some weakness in the algorithm was found which would enable us to produce any specific, chosen output we like… eg: 256 one-bits (FFF…FFF) or another series of 256 output bits (123…321). Even more interesting would be finding a way to produce collisions for SHA-256 (where two different inputs produce the same output), which would be disasterous. But all that isn’t the case. No such weaknesses have been found over the years.
but I could equally imagine that a bitcoin miner randomed onto one.
I honestly doubt that any bitcoin miner will produce anything that has any influence on SHA-256 just by hunting down the next Bitcoin block. Even if a Bitcoin miner would happen to find a 256 zero-bit output, it wouldn’t gain you anything as it’s still like the “hello world” hash example I mentioned above. Knowing which input bytes produce an SHA-256 output of 256 zero-bit hash doesn’t buy you anything which could be used as an attack… not even a coffee.
Some distantly related Q&As which might (or might not) be interesting for further reading:
It doesn't in principle imply an attack on SHA-256 any more than a preimage under 963e35c37ea59f3f6fa35d72fb0ba47e1e1523fae867eeeb7ead64b55ff22b77 does, but it might have some consequences for cryptosystems that use SHA-256: for example, it leads to an existential forgery under any public key in (EC)DSA. (For EdDSA, the preimage would have to have a particular prefix for each public key, so it's an even remoter possibility that this would be relevant.)
However, on a sociotechnical level, we might infer that you must have learned something very interesting about SHA-256 in order to find such a preimage! It's not going to happen by a lucky guess stumbling upon an input that a random 256-bit function sends to zero.
It might not lead to an attack but it would be interesting, so you should tell everyone what the message was and how you found it. The following challenges have the same difficulty as far as I understand it today:
Finding a message that gives the digest
Finding a message other than "hello world" that gives the digest
Picking a number at random, then finding a message that would give a digest for that random number.
Picking a sort of random number by generating a digest, then finding another message that gives the same digest.
Actually, AFAIK finding a message that gives the digest 0000000000000000000000000000000000000000000000000000000000000000
is just equally hard (or easy) as finding a message that gives the digest b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcdea (which the digest of "hello world" plus one)
Actually, FIRST choose any randome number, and THEN ask people to find a message that gives the digest in the form of that particular random number, is of the same difficulty as asking people to find a message that gives the digest in the form of all zeros, which is impossibly difficult.