Consider the transformation described in section 6.2 of RFC4634 ("US Secure Hash Algorithms (SHA and HMAC-SHA)"). Given the message block
M(i), and hence the message schedule
W, as well as the output of the block function
H(i), how hard should I expect computing
H(i-1) to be?
Interestingly, the 64 "rounds" are easily reversible for this set of knowns and unknowns, but the final addition makes using this fact not trivial.