1---2id: H163title: Statistically detectable input–output correlations vanish after a small number of steps4axis: C5kind: sha2566statement: With N = 20 000 samples, the number of (input bit, output bit) pairs with |corr| > 4/√N is large for s ≤ 4 and7 zero for s ≥ s** (to be measured), identical to the random-oracle control; output-byte chi-square tests are uniform beyond8 s**.9motivation: C1/C3.10assumptions: Single-block random messages.11expected_contribution: Bias figure.12related_work:13- nist2015fips18014possible_counterexamples: Residual correlations at 64 steps.15verification_strategy: experiments/reduced_round_sha256/bias_test.py16computational_budget: minutes17status: evaluated18classification: empirical_observation19evidence:20- results/reduced_round_sha256/summary.json21- results/reduced_round_sha256/bias_seed1.json22verdict: 'N = 20 000 × 3 seeds: r ≤ 3 trivially biased (untouched IV registers); r = 4 bias/χ² at noise but 6–13 |corr| =23 1 pairs (LSB of e_1 affine in LSB of W_0); from r = 5 all statistics at the random-oracle floor through r = 64 (two isolated24 4.1σ bits in 10 752 tests, as expected by chance).'25---2627# H16 — Statistically detectable input–output correlations vanish after a small number of steps2829With N = 20 000 samples, the number of (input bit, output bit) pairs with |corr| > 4/√N is large for s ≤ 4 and zero for s ≥ s** (to be measured), identical to the random-oracle control; output-byte chi-square tests are uniform beyond s**.30