id: H15 title: A single-bit message difference reaches full avalanche within a small number of steps axis: C kind: sha256 statement: The mean fraction of flipped state bits after s steps reaches 0.49 within s* steps of the compression function for a single-bit difference in W_0 (s* to be measured) and the random-oracle control is at 0.5 from step 1. motivation: Research question C1 (regularities of reduced rounds). assumptions: 2000 random messages per configuration. expected_contribution: Diffusion heatmap and s*. related_work:

• nist2015fips180
• gilbert2003security possible_counterexamples: Flip ratio plateauing below 0.5 (would indicate a structural weakness). verification_strategy: experiments/reduced_round_sha256/diffusion.py computational_budget: minutes status: evaluated classification: known_reproduced evidence:
• results/reduced_round_sha256/summary.json
• results/reduced_round_sha256/diffusion_seed1.json verdict: Full diffusion (mean flip ratio ≥ 0.49) at step 6 for a W_0 bit, 11 for W_5, 21 for W_15 (6 steps after entry), 8 for an IV bit; identical over 3 seeds × 2000 messages; after 64 steps Hamming weight 128.0 ± 8.1 = random-oracle control.

# H15 — A single-bit message difference reaches full avalanche within a small number of steps

The mean fraction of flipped state bits after s steps reaches 0.49 within s* steps of the compression function for a single-bit difference in W_0 (s* to be measured) and the random-oracle control is at 0.5 from step 1.