1---2id: H153title: A single-bit message difference reaches full avalanche within a small number of steps4axis: C5kind: sha2566statement: The mean fraction of flipped state bits after s steps reaches 0.49 within s* steps of the compression function7 for a single-bit difference in W_0 (s* to be measured) and the random-oracle control is at 0.5 from step 1.8motivation: Research question C1 (regularities of reduced rounds).9assumptions: 2000 random messages per configuration.10expected_contribution: Diffusion heatmap and s*.11related_work:12- nist2015fips18013- gilbert2003security14possible_counterexamples: Flip ratio plateauing below 0.5 (would indicate a structural weakness).15verification_strategy: experiments/reduced_round_sha256/diffusion.py16computational_budget: minutes17status: evaluated18classification: known_reproduced19evidence:20- results/reduced_round_sha256/summary.json21- results/reduced_round_sha256/diffusion_seed1.json22verdict: Full diffusion (mean flip ratio ≥ 0.49) at step 6 for a W_0 bit, 11 for W_5, 21 for W_15 (6 steps after entry), 823 for an IV bit; identical over 3 seeds × 2000 messages; after 64 steps Hamming weight 128.0 ± 8.1 = random-oracle control.24---2526# H15 — A single-bit message difference reaches full avalanche within a small number of steps2728The mean fraction of flipped state bits after s steps reaches 0.49 within s* steps of the compression function for a single-bit difference in W_0 (s* to be measured) and the random-oracle control is at 0.5 from step 1.29