You are mixing the attacks on the hash functions. The formal definition of generic attacks on cryptographic hash functions can be found at Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance by P. Rogaway and T. Shrimpton. Simply can be given as;
The Pre-image attack: given a hash value
h, find a message m such that
h=Hash(m). Consider storing the hashes of passwords on the server. E.g. an attacker will try to find a valid password to your account.
The Second Pre-image attack (also called weak-collision): given a message
m1, find another message
m2 such that
Hash(m1)=Hash(m2). An example is producing a forgery of a given message.
The Collision attack (also called strong-collision): Find two inputs that hash to the same output:
b such that
SHA-256 is not broken for any of these generic attacks, yet. See: What makes SHA-256 secure? on crypto.stackexchange.
if we could take the algorithm and just reverse engineer it to generate a string like
8GN492MD that would also output
If we only consider this it is pre-image attack and the cost is
O(2^256) for SHA-256. Note that the aim of the pre-image attack is not finding the original input, it is rather finding an input that has the same hash value. If there is no external test for the input, one cannot decide that the found pre-image is the pre-image. And, the actual search space for the pre-image can be much larger than the pre-image attack handles.
There is a variant of pre-image attack, that occurs when the message space is short, like hashing the phone numbers. In this case, it may very easy to find the pre-image.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that would also output
dug84nd8, wouldn't it say that
(s2("Hello") = s2("8GN492MD")) == true), and let a hacker in?
- If we consider above in more simple terms; given
dug84nd8=SHA256(Hello) and find another message with the same hash value as you requested then this is the Second Pre-image attack and the cost is
O(2^256) for SHA256.
The Second Pre-image is what you are looking for. That is infeasible and not only SHA-256 but also none of the cryptographic hash functions are broken in this way.
- The collision attack cost of SHA-256 is
O(2^128) due to the birthday-attack with a 50% probability. In the collision attack, the attackers are free two choose the
b. This is not your case since you start with a fixed message.
The conclusion, any of these attacks are not feasible for SHA-256 as of 2020.
The errors in the topmost answer
The range is 2^256 (possible output states) and the size of the input space is infinite (technically 2^(2^64) apparently, but much larger than 2^256). And that's precisely what permits the collisions (by the pigeon hole principle, there must be more than one possible input for each output - at least for one of the inputs).
SHA256 input space is limited due to the padding standard of NIST. One can hash at most 2^64 bits therefore there are at most 2^(2^64) different messages since the size of the message is encoded at the end of the padding in 64 bits.
The pigeonhole principle only says that there is at least one pigeonhole that has more than one pigeon. It doesn't talk about others that can be empty or not. With this, we can say that at least there must be one collision. Interestingly, we don't know that a SHA256 restricted to 64 bits attains all 64-bit values. What we expect from SHA256 is it is indistinguishable from uniformly random.
You can easily tell it's not an invertible function because the size of the domain (possible number of inputs) is greater than the size of the range (possible number of outputs).
That is not correct, too. Take modulo 2^256 as hash then it is non-invertible. One, however, given a hash value can calculate a pre-images easily, given
x+k 2^265 are pre-images. In other words, we inverted the map. The correct definition is a function which is computationally infeasible to invert