Generic exact inverse round
A complete SHA-256 round is a point-state bijection when the schedule word and round constant are fixed, allowing exact inversion and restart from the recovered predecessor.
Diagnostic work, exact algebra and local capabilities are not treated as end-to-end mining advantage.
What was tested?
A complete SHA-256 round is a point-state bijection when the schedule word and round constant are fixed, allowing exact inversion and restart from the recovered predecessor.
Why the test is meaningful
The round shift reveals seven predecessor words directly. T2 is computable from the recovered a,b,c; T1 follows from next-a−T2, and the remaining predecessor d follows from next-e−T1. All arithmetic is modulo 2³².
T2_t=Σ0(a_t)+Maj(a_t,b_t,c_t)T1_t=a_{t+1}−T2_t (mod 2³²)d_t=e_{t+1}−T1_t (mod 2³²)How it was tested
Implement generic inverse equations, forward-restart every recovered state, test reachable rounds and an anchored R58 route, and repeat with 3,000 records in each ACCEPT/DEFER/REJECT stratum.
What happened
Generic inverse, generic restart, reachable inverse/restart and all anchored word5, B64, action and safety checks had zero errors in both replicates. Each replicate audited 9,000 balanced anchored records.
Exactness and statistical controls
Forward-after-inverse equality supplies a bijection test. Generic random states, reachable states and target-anchored strata guard against a formula that works only on one distribution.
What the result means
A SHA-256 round can be inverted exactly at the point-state level. This does not mean a large implicit set of target-compatible states can be represented or traversed cheaply.
Limitations
- The theorem concerns individual states, not set-valued preimages.
- Schedule word and constant must be known.
- No inverse mining algorithm or economic benefit follows automatically.
Evidence trail
Recover the predecessor using modular subtraction, rerun the forward round and require exact equality across generic, reachable and balanced anchored cohorts in two replicates.
Canonical variants
SUBENGINE-V54ASUBENGINE-V54BSUBENGINE-V54CSource: internally audited canonical reports. Local filesystem structure, private headers and operational identifiers are excluded from publication.