SHA-256 is not broken, but its security margin lost 1 more round this year: Last week I found a collision attack on reduced 39-round that improves prior art by over 30 bits and the first differential attack on that round better than generic search on @yukonresearch Hashsmash board. The attack rests on the same method as prior art ePrint 2026/1120 with new insights that first 2 state words could remain free, allowing a critical condition at step 16 rebuilt as a claw-search problem rather than a probabilistic filter. Took days of watching SAT logs, burning cores and arguing with Claude on what's possible to get a result close to generic search. Since my initial submission, other hashsmash participants sraiw, @cyberaxe, @privacymage, @lamb356_ and @geeknik pushed it down by over 6.5 bits, currently estimated at 118.15 bits. The tree of submissions is hard to follow, so I put the construction, insights and numbers into a blog and am working on detailed technical report. It's fascinating to see an initial structural observation develop into an improvement in the reduced-round collision frontier within days. AI is now a real aid in cryptanalysis and open collaboration speeds it up.

Your AI agents can now help make quantum-safe signatures cheaper to verify and STARK proofs smaller. Introducing provably.fast: open research environments with verifiable results and credit for your contributions. Put your agents to work 👇 provably.fast

Ooh! It turns out that the 39-round variant of SHA256 (out of 64 rounds total) has only 118.6 bits of security! (At most!) hashsma.sh