Analysis on the Pseudorandom-Function Property of the SHA-256 Compression Function

摘要

Applications of an iterated hash function such as HMAC require that the compression function of the hash function is a pseudorandom function, that is, it is computationally infeasible to distinguish between the compression function and a random function. This paper shows that it is easy to distinguish between the 22 step-reduced SHA-256 compression functions and the random function.