# Is there any neutral element for the cryptographic hash function SHA256? (or its variants)

My question is Is is possible to compute a string given that after applying a SHA256 function the result is the same string?

• Can you clarify: do you mean two inputs having the same SHA256 output? That would be a SHA256 collision. I didn't think any were yet found for SHA256, but maybe the crypto exchange would have the latest news. Aug 20 '20 at 21:08
• @C8H10N4O2 I think OP is asking for a fixed point of SHA256.
– orlp
Aug 21 '20 at 1:36
• There is an infinite number of strings and a finite number of SHA256 outputs. Aug 21 '20 at 4:32
• @greybeard That does not automatically mean there is a fixed point.
– orlp
Aug 21 '20 at 13:40
• If looking for fixed point computation, see the crypoo exchange. Here is one such thread: crypto.stackexchange.com/questions/48580/… Aug 21 '20 at 14:54

No one knows. It is believed to be computationally infeasible to find such a string, if one exists. No one knows whether such a string exists.

By standard heuristics (modelling SHA256 as a random function), there is approximately a $$1/e\approx 0.368$$ chance that no such input exists, and approximately a $$0.632$$ chance that such an input exists, so if I were forced to bet, I would bet that it's more likely there exists such an input than that there doesn't, but no one knows. Don't interpret this chance too seriously: for the specific SHA256 function, either such an input exists or it doesn't. We don't know which is the case.

If such an input is found, it is believed that it would take about $$2^{256}$$ steps of computation to find it, which is completely infeasible.

• Can you expand a bit on the heuristic used? If SHA256 is a random function, then it has an infinite domain and a finite codomain, so shouldn't a fixed-point (actually, infinitely many fixed points) exist almost-surely? Feb 13 at 23:20
• @Steven, no. It might cycle with period length > 1. The heuristic is: $\Pr[f(x) \ne x] = 1 - 1/2^{256}$; so $\Pr[\forall x . f(x) \ne x] \approx \prod_x \Pr[f(x) \ne x] = (1 - 1/2^{256})^{2^{256}} \approx 1/e$.
– D.W.
Feb 13 at 23:23
• sorry if I'm missing something stupid. Are you assuming that SHA256 will cycle with a period of at most $2^{256}$? Feb 13 at 23:30
• @Steven, I wouldn't say I'm assuming it, but it is true. If you are iteratively applying SHA256, all that matters is its behavior on $\{0,1\}^{256}$ (after the first iteration, you're only working with 256-bit values, because the output of SHA256 has 256 bits).
– D.W.
Feb 13 at 23:47
• @Steven, $f(x) \in [0 : 2^{256})$. For $x = f(x)$, we must also have $x \in [0 : 2^{256})$, so we don't care about other strings.
– user114966
Feb 13 at 23:48