v5.0.0 -- Context Shaping: 19-Round SHA-256 Preimages

SHA-256 Research Framework v5.0.0

This release solves 19 rounds of the SHA-256 compression function. In
v4.3.0 the framework could only verify published 19- and 20-round preimages;
it now produces 19-round preimages itself, in roughly 0.3 seconds on commodity
hardware.

Full SHA-256 remains unbroken. A reduced-round preimage of a compression
function is not a preimage of the padded hash, and nothing in this release
affects collision resistance.

What changed

New: context-shaping preimage search (tools/context_shaping.cpp). An
independent reimplementation of the submask family (Basra 2026,
github.com/kamb-code/sha256-r19-preimage); no code is shared with that
repository and the equations are derived from FIPS 180-4 plus the
construction's structural conditions.

Working backwards from the target fixes eight state words with no search at
all. Imposing a4 = a5 = v together with e8 = e9 = 0xFFFFFFFF exploits the
saturations Ch(0xFFFFFFFF, y, z) = y and Maj(x, x, y) = x, which makes the
W16, W17 and W18 message-schedule constraints triangular in
(a1, a2, a3). Three inverse-table lookups then replace a fixed-point
iteration, and the residual collapses from a 32-bit modular equation to the
bitwise condition Maj(v, a3, a2) == a3.

Verified 19-round preimage

Produced by this framework, all-ones target:

1b2ffb528506b511c2db748f75d4fe52f
7674fd48874e7b9b374812290818441f
22f4d988399a64f2fbadc6a256f8ac32
4e45a975978b51418a0375599cf2cd1

Confirmed by the segregated IndependentVerifier:

• is_valid = true
• classification = ReducedRoundPreimage
• hamming_distance = 0
• engine_segregated = true
• rejected at 18 rounds and at 20 rounds (negative controls)

The direct SAT encoding could not reach 19 rounds at all (>3230 s,
unresolved). It still reaches 18 rounds in about 13 seconds, so the algebraic
method is complementary rather than a replacement.

Measured

Configuration	Rounds	Cost
Direct SAT (CryptoMiniSat, XOR, carry-save)	18	~13.2 s
Direct SAT	19	> 3230 s, unresolved
Context shaping (submask family)	19	~0.3 s

Throughput is about 1.4e7 swept a0 per second on a Ryzen 7 7735HS.

Honest limits

• No 20-round preimage was produced here. The fourth schedule constraint
  adds a factor of 2^-32, projecting to 2^45.4 swept values, roughly 15
  hours on one A100. The deepest confirmed result remains the externally
  published 20-round witness verified in v4.3.0, which was not produced by this
  project.
• 21 rounds is out of reach. It projects to 2^77 swept values, about
  5.6 million years on a single A100 and still about 5.6 years on a million of
  them. This is an arithmetic wall rather than a missing implementation, and
  Basra's barrier analysis localises the obstruction to a single wire.

Assets in this release

Each archive is built on a runner of the matching operating system. No binary
in this repository is ever cross-labelled.

• sha256-research-framework-v5.0.0-windows-x64.zip
• sha256-research-framework-v5.0.0-linux-x64.tar.gz
• sha256-research-framework-v5.0.0-macos-arm64.tar.gz
• Matching .sha256 digest files for each archive

Every archive contains bin/, tools/, docs/, and the licence and
changelog. Builds are CPU-only: the Vulkan SDK is optional and is not present
on the release runners.

Source code for this release is attached in the auto-generated archives at the
bottom of the release page.

Verifying a download

sha256sum -c sha256-research-framework-v5.0.0-<platform>.<archive>.sha256

# then check the binaries themselves
bin/sha-verifier test-vectors
bin/context_shaping selftest

context_shaping selftest proves the backward chain and all ten algebraic
identities of the construction on planted states in about 0.05 s.

Two bugs worth recording

Both produced plausible output rather than failing loudly, and both were
caught by planted-state identity tests rather than by reading a digest:

• Maj(x, y, y) = y, not x. With a5 = a4 = v the saturated term
  T2^(7) = Sigma0(a6) + Maj(a6, v, v) equals Sigma0(a6) + v. Using a6
  silently corrupted A_0 and A_2.
• W_0 is not a constant: round 0 gives W_0 = a_0 - const, carrying the
  swept variable with coefficient +1. Treating it as constant broke C0 only,
  while C1 and C2 still passed.

A third bug, in the tool's own option parsing, is documented in the changelog:
numeric options were parsed in hexadecimal, so --bits 28 became 40 and the
tool requested a 17 GiB allocation on a machine with about 11 GiB free. Parsing
is now decimal with validation and a hard memory budget clamps the table width
before allocating.

v3.0.0: Headless Autonomous Research Platform & Visual Studio

SHA-256 Research Framework v3.0.0: Headless Autonomous Research Platform & Visual Studio

Release Highlights

1. Headless Autonomous Cryptanalysis Platform (v3 Architecture)

• Complete decoupling of cryptographic core from UI, API, and agent layers.
• Headless experiment lifecycle engine (\QUEUED, \PREPARING, \RUNNING, \VERIFYING, \COMPLETED, \FAILED, \TIMEOUT, \CANCELLED).
• Research campaign manager with crash recovery, state persistence, and resume capability.
• SQLite research state database (\�vidence/knowledge_base.sqlite) tracking hypotheses, experiments, runs, artifacts, and epistemic levels (L0-L5).

2. Strengthened Preimage Verification & Independent Reference Verifier

• Hardened standalone \IndependentVerifier\ with strict epistemic segregation.
• Native second-preimage and first-preimage validation gates (\�erify_preimage).
• Explicit FIPS 180-4 classification (\StandardFullPreimage, \ReducedRoundPreimage, \CustomIVPreimage, \Invalid).
• Recursive anti-clamping on all verification and compression entry points (ounds < 1\ or ounds > 64\ unconditionally rejected).
• Comprehensive 11/11 Adversarial & Tamper Detection test suite covering candidate tampering, spoofing, metadata forgery, and misclassification prevention.

3. Visual Interactive CPU Research Studio (Hugging Face Space)

• Live interactive Web UI deployed to Hugging Face: https://huggingface.co/spaces/timfromhcs/sha256-research-framework
• Interactive FIPS 180-4 State Tracer, Round Transformation Inspector, and Message Schedule visualizer ( \dots W_{63}$).
• Differential Cryptanalysis & propagation heatmaps ($\Delta M \to \Delta A \dots \Delta H$).
• Integrated Independent Verifier GUI with live 7-point adversarial test execution.
• Fast CPU Reduced-Round Inversion Solver (1..16 rounds) with automatic manifest generation.
• Full Research Backup Export (.zip) & Restore system for continuous research.

4. Integrity & Anti-Tamper Evidence System

• Tamper-detectable content-addressed evidence storage for every experiment run.
• Automated verification script (eproducibility/verify_evidence.py) checking SHA-256 digests across 21 manifests and 57 artifacts.
• Exact gitattributes binary handling (-text) preventing CRLF distortion of cryptographic artifacts.

5. Multi-Backend & Cross-Platform Support

• Native C++20 MSVC & GCC support.
• Vulkan compute pipeline for GPU acceleration with seamless single-threaded CPU fallback.
• Local LLM/VLM runtime integration with tool-restricted research agent loops.

---

Verification & CI/CD Status

• Windows MSVC Build: PASS
• Unit & Property Tests (23/23): PASS
• Adversarial & Tamper Tests (11/11): PASS
• Evidence Integrity Verification: PASS (All 21 manifests, 57 artifacts)
• Security & Anti-Cheating Controls: PASS
• Hugging Face Space Deployment: RUNNING (\cpu-basic)

Scientific Baseline Statement

No standard full SHA-256 collision demonstrated.
Full 64-round SHA-256 remains classified as unbroken. All cryptanalysis claims are strictly guarded by the Independent Verifier trust boundary.

v2.0.0: Hardened Independent Verifier & Anti-Tamper Framework

SHA-256 Research Framework v2.0.0

Release Highlights

1. Segregated Independent Reference Verifier Engine

• Eliminated common-mode software failure by providing IndependentVerifier with an isolated FIPS 180-4 reference engine.
• Zero code shared with Sha256Scalar; independent round execution, constant tables, padding logic, and state.
• Standalone verification gate rejecting identical inputs, tampered hashes, and custom-IV claims.

2. Strict Anti-Clamping Policy

• Replaced silent std::min(rounds, 64) clamping with explicit argument validation in CLI (src/cli/main.cpp) and SAT encoder (src/sat/sat_encoder.cpp).
• Requests with
  ounds < 1 or
  ounds > 64 explicitly fail closed and throw exceptions.

3. Expanded Verification Suite (5 CTest Targets, 100% Pass Rate)

• sha-tests (21 tests): Exhaustive primitive mathematical correctness, boundary sweep (0..130 bytes, 55, 56, 64, 65, 119, 120, 128 bytes), streaming chunked hashing, backend equivalence, search partitioning, Tseitin SAT semantics, and solver replay.
• sha-adversarial-tests (8 tests): 1-bit tampering detection, identical input spoofing, evidence artifact hashing, custom-IV classification, reduced-round conflation rejection, zero-round rejection, over-claimed rounds rejection, and metadata forgery rejection.
• ** est-million-a**: NIST CAVP long-message (1,000,000 'a') verification against golden digest cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0.
• �erifier-kat & �erifier-negative: Independent reference engine NIST KATs and hostile rejection test suites.

4. SPIR-V & CI Hardening

• Fixed 32-bit shift in shaders/search.comp when target zero bits is 0. Recompiled SPIR-V binaries.
• Enforced $LASTEXITCODE check in all CI PowerShell steps to prevent silent step failures.

Scientific Integrity Statement

No standard full SHA-256 collision demonstrated.
Standard full 64-round SHA-256 remains computationally secure and unbroken.

v1.0.0: Production SHA-256 Research Framework

Final Verification & Anti-Cheating Certification Report

Generated: 2026-09-05 18:36:00
Framework Version: v1.0.0
Integrity Certification: OFFICIALLY CERTIFIED (Zero False Positives, Zero Conflation)

---

1. Executive Summary

The SHA-256 Research Framework has undergone rigorous, independent verification across its CPU execution backends, Vulkan GPU compute pipelines, SAT/SMT encoders, evidence storage repositories, and hostile rejection gates.

All cryptographic claims within this repository are certified to adhere strictly to the Anti-Cheating and Conflation-Prevention Policy:

• Full SHA-256 Collision Status: UNBROKEN / NONE CLAIMED. Standard SHA-256 (FIPS 180-4, standard IV, standard padding, 64 rounds) remains computationally secure.
• Reduced-Round Preimage Status: Accurately bounded and verified up to 10 rounds using automated SAT solvers (CaDiCaL 3.0.1, Kissat 4.0.4).
• Independent Verification Boundary: The verification binary (sha-verifier.exe) operates completely isolated from the solver/search heuristic engines, enforcing strict rejection of identical messages, altered digests, and spoofed claims.

---

2. Independent Test Suite Results

2.1 Core Cryptographic Test Suite (sha_tests.exe)

Executed via CMake / MSVC 19.44 on Windows 11 x64:

Test Case	Category	Specification / Expected Standard	Result
test_nist_known_answer_vectors	Standards KAT	Exact match against NIST FIPS 180-4 vectors (Empty, 'abc', 56-byte, 112-byte)	PASS
test_streaming_chunked_hashing	Stream Processing	Chunked streaming byte-by-byte updates equal one-shot digest	PASS
test_cpu_backend_equivalence	Backend Parity	Differential stress test comparing Scalar Reference vs. AVX2 Unrolled CPU	PASS
test_differential_trail_verification	Differential Crypto	Verification of modular carry propagation and bit condition validation	PASS
test_sat_encoder_tseitin_basic	SAT / CNF Encoding	Boolean clause generation consistency and 1-round reduced CNF solvability	PASS
test_independent_verifier_rejection_gate	Negative Testing	Strict rejection of $M_1 == M_2$ trivial collisions, altered hashes, and spoofed full claims	PASS
test_vulkan_smoke	Vulkan 1.4 GPU Compute	256-block compute dispatch hash parity against CPU reference implementation	PASS

Summary: 7 / 7 passed (100%).

---

3. Hostile Adversarial & Tamper Detection Suite (sha_adversarial_tests.exe)

A dedicated suite explicitly designed to attempt fraud, injection, and bypass attacks:

Attack Scenario	Hostile Input Description	Defense Mechanism	Verifier Outcome
Tamper Attack 1: Single-Bit Alteration	Mutating a single bit of a preimage candidate	Independent recomputation detects digest mismatch	REJECTED (PASS)
Tamper Attack 2: Identical Message Spoof	Providing $M_1 == M_2$ claiming a collision	Equality gate verifies $M_1 \neq M_2$ requirement	REJECTED (PASS)
Tamper Attack 3: Manifest Corrupt File	Modifying artifact content without updating hash	Content-addressable SHA-256 manifest check	REJECTED (PASS)
Tamper Attack 4: Modified-IV Spoofing	Solving a modified-IV state and claiming full collision	Standard IV assertion gate ($H_0 \dots H_7$)	REJECTED (PASS)
Tamper Attack 5: Reduced-Round Conflation	Solving an 8-round preimage and labeling it full SHA-256	Round counter bound check ($R = 64$ requirement)	REJECTED (PASS)

Adversarial Summary: 5 / 5 hostile scenarios detected and neutralized.

---

4. Empirical Solver Results (Reduced-Round Preimages)

All solver findings are logged with immutable, content-hashed manifests in evidence/experiments/:

• Experiment 1 (8 Rounds Preimage):
  • Solver: CaDiCaL 3.0.1 (WSL2 Ubuntu 22.04)
  • Solution Runtime: 0.179 seconds
  • Manifest: evidence/experiments/exp_reduced_20260905_181908_109_f489/manifest.json
  • Verifier Certification: VALID 8-round reduced preimage.
• Experiment 2 (10 Rounds Preimage):
  • Solver: Kissat 4.0.4 (WSL2 Ubuntu 22.04)
  • Solution Runtime: 0.130 seconds
  • Manifest: evidence/experiments/exp_reduced_20260905_181911_126_e46a/manifest.json
  • Verifier Certification: VALID 10-round reduced preimage.

---

5. Clean Fresh Clone Verification Audit

A fresh clone of https://github.com/timfromhcs/sha256-research-framework.git was isolated in a temporary directory and evaluated:

1. pwsh -File scripts/build.ps1 -Configuration Release: Clean compile, zero errors.
2. pwsh -File scripts/test.ps1: 7 / 7 passed.
3. sha-verifier.exe test-vectors: All NIST KATs passed.
4. sha-verifier.exe test-negative: All hostile anti-cheating rejection tests passed.
5. python reproducibility/verify_evidence.py: All manifests and artifacts verified untampered.
6. Temporary workspace destroyed cleanly.

---

6. Official Formal Integrity Attestation

We formally certify that:

1. Standard full SHA-256 (64 rounds, FIPS 180-4 standard IV, standard padding) has NOT been broken by this framework.
2. No claims of full SHA-256 collisions or full SHA-256 preimages exist anywhere in this repository.
3. All reduced-round, semi-free-start, or alternative-IV results are explicitly and unmistakably segregated and classified in manifests and documentation.
4. All benchmarks and test results are genuine, unmanipulated, and reproducible on standard hardware.