Consider the transformation described in section 6.2 of RFC4634 ("US Secure Hash Algorithms (SHA and HMAC-SHA)"). Given the message block M(i)
, and hence the message schedule W
, as well as the output of the block function H(i)
, how hard should I expect computing H(i-1)
to be?
Interestingly, the 64 "rounds" are easily reversible for this set of knowns and unknowns, but the final addition makes using this fact not trivial.