id: H16 title: Statistically detectable input–output correlations vanish after a small number of steps axis: C kind: sha256 statement: With N = 20 000 samples, the number of (input bit, output bit) pairs with |corr| > 4/√N is large for s ≤ 4 and zero for s ≥ s** (to be measured), identical to the random-oracle control; output-byte chi-square tests are uniform beyond s**. motivation: C1/C3. assumptions: Single-block random messages. expected_contribution: Bias figure. related_work:

• nist2015fips180 possible_counterexamples: Residual correlations at 64 steps. verification_strategy: experiments/reduced_round_sha256/bias_test.py computational_budget: minutes status: evaluated classification: empirical_observation evidence:
• results/reduced_round_sha256/summary.json
• results/reduced_round_sha256/bias_seed1.json verdict: 'N = 20 000 × 3 seeds: r ≤ 3 trivially biased (untouched IV registers); r = 4 bias/χ² at noise but 6–13 |corr| = 1 pairs (LSB of e_1 affine in LSB of W_0); from r = 5 all statistics at the random-oracle floor through r = 64 (two isolated 4.1σ bits in 10 752 tests, as expected by chance).'

# H16 — Statistically detectable input–output correlations vanish after a small number of steps

With N = 20 000 samples, the number of (input bit, output bit) pairs with |corr| > 4/√N is large for s ≤ 4 and zero for s ≥ s** (to be measured), identical to the random-oracle control; output-byte chi-square tests are uniform beyond s**.