# Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?

Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256?

I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally imagine that a bitcoin miner randomed onto one.

• If anything, it would have been nice if SHA-256 output was arbitrarily xor'ed with e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 to create a "true" output, so the empty string had a hash of all zeros. – Nick T Mar 9 at 19:14

Would possessing a string with the sha-256 hash of all zero bits lead to an attack on sha-256?

No, it would not lead to any useful attack on SHA-256. You’ld only have an input string that hashes to 256 zero-bit output. It may be nice to know and look at, but it doesn’t buy you anything useful to attack SHA-256. All in all, it’s no different from any other hash value produced by hashing some value to another specific SHA-256 output. Just because your input renders an SHA-256 output of 256 zero-bits doesn’t mean, nor indicate that SHA-256 is broken and it certainly doesn’t open an attack vector on SHA-256.

I could easily imagine that a specialized attack leaked knowledge of how to do it,

At the time of writing this, no such attack is known. Remember that SHA-256 has been around for a few years. The algorithm has been tested, analysed, attacked, and verified by governmental agencies as well as independant people worldwide. If there would be any weakness/shortcut in the algorithm which would enable someone to produce a 256 zero-bit hash, it would have been found. But no such findings have been made… which is why we all SHA-256 a “well vetted, cryptographically secure hash”.

Besides, being able to say “I have this set of bytes that, when I feed it to SHA-256, outputs an all-zero hash” doesn’t open any door to a cryptographical attack. It’s no different from knowing that “hello world” hashes to “b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9”.

Having knowledge of something like that doesn’t point at a weakness or attack vector. It’s what SHA-256 does: hash a specific input into a specific output. If that output happens to be 000…000 then so be it. It may be nice for some people to know how to produce a 256 zero-bit output, but it doesn‘t have any impact whatsoever on the security claims of SHA-256.

Things would be different if some weakness in the algorithm was found which would enable us to produce any specific, chosen output we like… eg: 256 one-bits (FFF…FFF) or another series of 256 output bits (123…321). Even more interesting would be finding a way to produce collisions for SHA-256 (where two different inputs produce the same output), which would be disasterous. But all that isn’t the case. No such weaknesses have been found over the years.

but I could equally imagine that a bitcoin miner randomed onto one.

I honestly doubt that any bitcoin miner will produce anything that has any influence on SHA-256 just by hunting down the next Bitcoin block. Even if a Bitcoin miner would happen to find a 256 zero-bit output, it wouldn’t gain you anything as it’s still like the “hello world” hash example I mentioned above. Knowing which input bytes produce an SHA-256 output of 256 zero-bit hash doesn’t buy you anything which could be used as an attack… not even a coffee.

Some distantly related Q&As which might (or might not) be interesting for further reading:

• It needs to be mentioned that there might be dangerous states which leads to a loop producing subsets of states when the compression functions are iterated. This is a general situation which needs to be avoided when designing Hashes. There is however no indication that all-zero state or all-zero output is particular suspicious to that (and no indication that SHA1 has one) – eckes Nov 16 '17 at 6:43
• OK, I agree with most of what you said here. However, if you could show me a SHA-256 hash that is all zeros then I would immediately assume that something has broken; the chances of finding one by accident are so small that finding an issue with the hash is almost infinitely more likely (but, hopefully for the immediate future, still not so likely that we will actually find one). – Maarten Bodewes Nov 16 '17 at 10:17
• @MaartenBodewes I’m sure that – when the Holy Grail of Bitcoin mining is found – we’ll hear about it. ;) Until that day, my worries are rather limited. – e-sushi Nov 16 '17 at 14:21

It doesn't in principle imply an attack on SHA-256 any more than a preimage under 963e35c37ea59f3f6fa35d72fb0ba47e1e1523fae867eeeb7ead64b55ff22b77 does, but it might have some consequences for cryptosystems that use SHA-256: for example, it leads to an existential forgery under any public key in (EC)DSA. (For EdDSA, the preimage would have to have a particular prefix for each public key, so it's an even remoter possibility that this would be relevant.)

However, on a sociotechnical level, we might infer that you must have learned something very interesting about SHA-256 in order to find such a preimage! It's not going to happen by a lucky guess stumbling upon an input that a random 256-bit function sends to zero.

It might not lead to an attack but it would be interesting, so you should tell everyone what the message was and how you found it. The following challenges have the same difficulty as far as I understand it today:

Finding a message that gives the digest 0000000000000000000000000000000000000000000000000000000000000000

Finding a message other than "hello world" that gives the digest b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

Picking a number at random, then finding a message that would give a digest for that random number.

Picking a sort of random number by generating a digest, then finding another message that gives the same digest.

Actually, AFAIK finding a message that gives the digest 0000000000000000000000000000000000000000000000000000000000000000

is just equally hard (or easy) as finding a message that gives the digest b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcdea (which the digest of "hello world" plus one)

Actually, FIRST choose any randome number, and THEN ask people to find a message that gives the digest in the form of that particular random number, is of the same difficulty as asking people to find a message that gives the digest in the form of all zeros, which is impossibly difficult.

• I don't think this answer adds anything, so I'm just going to leave it where it is. :( Nice try though. – Joshua Apr 4 '18 at 15:24