The Quantum Peacock and the Hash Function
How AI speculation, quantum marketing, and elementary category errors learned to dress themselves as cryptanalysis.
The modern technology argument has developed a marvellous new economy: where evidence is expensive, adjectives may now be substituted. One begins with an entirely respectable proposition—artificial intelligence may help mathematicians discover things that mathematicians have not yet discovered—and then, by the alchemy peculiar to LinkedIn, one arrives several paragraphs later at the suggestion that SHA-256, Bitcoin mining, and quantum computing are all trembling before the same approaching revelation. The transformation is elegant because the intermediate steps need never be demonstrated. “Could” performs the work of a proof, “AI” performs the work of a mechanism, and “quantum” performs the work of an audience that has already stopped asking what operation is actually being computed. Cryptography, unfortunately, was designed by people with the tiresome habit of distinguishing one mathematical problem from another, so the entire performance collapses the moment the nouns are required to retain their definitions.
The central issue is therefore not whether future researchers, human or artificial, may discover a weakness in SHA-256; of course they may, because science does not issue certificates guaranteeing that tomorrow will contain no surprises. The issue is whether a present argument has identified such a weakness, or even identified the correct mathematical object that would have to be weakened. NIST defines collision resistance, preimage resistance, and second-preimage resistance as distinct properties, and Bitcoin’s proof-of-work imposes yet another operational condition: a block-header hash must fall at or below a target threshold. Those are not stylistic variations on the word “hash.” They are different problems with different success conditions, different generic bounds, and different implications. Once those distinctions are restored, the claim that AI or quantum computing has somehow made “hashing” generically vulnerable begins to look less like cryptanalysis and more like a dinner guest who has confused the wine list with the fire regulations.
1. A hash function is not a mystical black box; it is a precisely specified map
The first point, which ought to be embarrassingly elementary but has become oddly necessary, is that SHA-256 produces a fixed 256-bit output and therefore has exactly 2256 possible digest values. NIST’s Secure Hash Standard specifies the SHA-2 family, while NIST’s hash-function guidance separately describes the security properties expected of approved hash functions: collision resistance means that finding two distinct inputs with the same digest should be computationally infeasible; preimage resistance means that, given a digest, finding an input that maps to it should be infeasible; second-preimage resistance means that, given one input, finding a different input with the same digest should be infeasible. For SHA-256, NIST lists the expected classical security strength as 128 bits for collision resistance and 256 bits for preimage resistance. The distinction is not a matter of taste but of combinatorics: generic collision search is governed by the birthday phenomenon, whereas generic preimage search is not. Anyone discussing “breaking the hash” without naming the property is therefore not simplifying the argument; he is removing the part that tells us what the argument means.
Collisions themselves are not evidence of a defect, because a fixed output space necessarily forces many inputs into the same output values. The standardized SHA-256 domain is finite because FIPS 180-4 places a maximum message length on the algorithm, so one should not carelessly say that the formal standardized domain contains literally infinitely many inputs; nevertheless, that domain is fantastically larger than the 2256 possible outputs, which guarantees an immense number of collisions. In the abstract cryptographic model, where one often speaks of arbitrary-length bit strings mapped into a fixed digest space, the pigeonhole principle makes the same point even more starkly. None of this constitutes an attack. An attack is an efficient method for finding the relevant object—collision, preimage, second preimage, or something else—at a cost materially below the security level the construction is intended to provide. Discovering that collisions must exist is no more a cryptanalytic breakthrough than discovering that two hotel guests may eventually share a room number when the hotel has fewer rooms than potential guests.
2. Bitcoin mining is not collision hunting, and calling everything “hashing” does not make the problems identical
Bitcoin proof-of-work is especially useful for exposing the confusion because its success condition is explicit. The Bitcoin protocol hashes an 80-byte block header using double SHA-256, and the resulting 256-bit value must be equal to or below the target encoded by the network difficulty. The Bitcoin developer documentation states the condition directly, and Nakamoto’s original paper describes proof-of-work as scanning for a value whose hash has the required leading-zero property, with the average work increasing exponentially as the target becomes more demanding. The miner is therefore not searching for two distinct headers that collide, nor is the protocol asking for a preimage of one particular digest selected in advance. It is searching through candidate headers until one lands inside an accepted numerical region. That distinction is not pedantry; it determines what sort of alleged mathematical weakness would actually matter to mining.
If someone claims that AI has found a shortcut relevant to Bitcoin mining, the claim must therefore identify a property of the SHA-256d computation that changes the expected cost of reaching the target. A faster chip does not constitute such a break, because improving implementation speed leaves the mathematical security assumptions untouched. Better power efficiency does not constitute such a break, because it changes economics rather than the underlying mapping. A collision attack does not automatically constitute such a break, because collision finding asks for two inputs with equal outputs rather than an output below a threshold. Even an elegant theoretical result against some restricted or reduced form of SHA-256 would not automatically constitute such a break unless the result transfers to the full computation and changes the relevant target-search problem. The burden is wonderfully unfashionable: name the structure, specify the algorithm, state the complexity, and demonstrate that it applies to the object being discussed.
This is why the practical question is usefully binary even though academic cryptanalysis contains many intermediate results. Researchers can and do publish reduced-round attacks, distinguishers, differential trails, meet-in-the-middle improvements, semi-free-start collisions, and complexity reductions that are mathematically important without being remotely deployable. Those results are genuine science because their scope is stated rather than smuggled past the reader. But if the public claim is that deployed full SHA-256 has been “broken” in a way relevant to Bitcoin mining, then the operational burden is much less poetic: either a reproducible method violates the relevant full-round security expectation at meaningful cost, or it does not. There is no useful category called “AI has made SHA-256 a little bit broken” merely because a model can propose hypotheses faster than a graduate student can drink coffee.
3. Real cryptanalysis has the vulgar habit of stating exactly what was attacked
Current SHA-256 research illustrates the difference between cryptanalysis and technological fortune-telling rather beautifully. At EUROCRYPT 2026, Zhang, Li, Gao, and Wang presented collision attacks on SHA-256 up to 37 steps with improved trail search. Full SHA-256 has 64 steps, and the paper says what has been attacked, how far the result extends, and what method is used. That is what a serious result looks like: not “SHA-256 may contain hidden structure,” but a bounded claim concerning a defined reduced-round target, an explicit attack strategy, and a result that other cryptographers can examine. The fact that excellent researchers can push reduced-round analysis further is evidence that the field is alive; it is not evidence that the full deployed function has thereby been broken. The distinction is precisely the intellectual furniture that disappears when an argument substitutes “AI might discover a shortcut” for an actual cryptanalytic statement.
The importance of reduced-round work is itself a lesson in how to speak carefully. A construction is often analysed by removing rounds or changing boundary conditions because doing so reveals structure and permits techniques that may later extend further. Progress from 31 steps to 37 steps can be substantial even when the full design remains beyond the attack. Cryptographers do not regard this as embarrassing; they regard it as the ordinary accumulation of knowledge. What would be embarrassing is presenting such a result as though six additional steps of progress had somehow converted into a practical full-round break by rhetorical compounding. A technically literate discussion should therefore become more precise as the evidence becomes more interesting, not less precise because the headline has become more exciting.
4. AI-assisted cryptanalysis is a serious research development; it is not a transferable certificate of weakness
Artificial intelligence does deserve a place in this discussion, but only after the marketing costume has been removed. Fluri and colleagues’ 2026 CryptanalysisBench is important because it tests whether frontier language models can actually perform cryptanalytic work against formally specified schemes rather than merely write persuasive prose about cryptography. The benchmark contains 191 tasks across six families of primitives and includes schemes with known breaks, scaled variants, full-strength schemes, and a challenge set. The authors report that frontier models can reproduce many known attacks and, more interestingly, can sometimes produce apparently novel cryptanalysis, including a key-recovery attack exploiting a design flaw in the SpoC authenticated-encryption construction and an error in KINDI’s published CCA-security proof. That is evidence of emerging capability, and it is considerably more interesting than another conference panel announcing that AI will “transform security.”
What the benchmark does not do is grant every other primitive a transferable presumption of vulnerability. An AI system finding a design flaw in SpoC is evidence that AI may be useful at finding design flaws; it is not evidence that SHA-256 contains one. The inference would be no better if the researcher were human: a mathematician who finds a new attack on one cipher does not thereby weaken every hash function by professional association. The relevant evidentiary bridge remains missing until the model produces something that applies to SHA-256 itself. This is why the proper conclusion from AI-assisted cryptanalysis is simultaneously more modest and more important than the sensational version: serious cryptographic designs should be subjected to more automated attack generation and verification because the attack surface may now be explored more aggressively, but claims about a particular primitive still require a particular attack.
Indeed, the benchmark’s formal-verification orientation makes the distinction especially sharp. An agent does not “win” because its prose sounds ingenious; it wins because its attack script satisfies the security game against fresh randomness. That is precisely the standard that should be carried into public discussion. If an AI claims a structural shortcut in SHA-256, then the interesting object is not the sentence describing the shortcut but the executable or mathematical procedure that survives independent checking. The research frontier therefore strengthens the case for evidential discipline rather than weakening it: the more capable AI becomes at generating candidate attacks, the more essential it becomes to separate verified breaks from attractive hallucinations. Otherwise the future of cryptanalysis will consist of millions of brilliant-sounding vulnerabilities, each awaiting the tedious discovery that mathematics has declined to cooperate.
5. Quantum computing has been allowed to enter the discussion under several different names and only one evening jacket
The quantum portion of the argument becomes muddled because several distinct propositions are routinely collapsed into the phrase “quantum breaks cryptography.” Shor’s algorithm concerns integer factorisation and discrete logarithms; those problems are structurally relevant to RSA and to elliptic-curve cryptography, including the discrete-logarithm assumptions underlying traditional Bitcoin signatures. SHA-256 is not an integer-factorisation problem and is not an elliptic-curve discrete-logarithm problem, so invoking Shor in a discussion of the internal security of SHA-256 is a category error before it becomes anything more impressive. One may discuss a hypothetical fault-tolerant machine attacking public-key signature systems, and one may separately discuss hashing, but the word “quantum” does not merge the mathematics merely because both topics fit comfortably beneath the same conference banner.
Grover’s algorithm raises a different issue and should be described accurately rather than mythologised in either direction. In the black-box query model, Grover gives a quadratic improvement for unstructured search, reducing the number of ideal oracle queries from order N to order √N. Brassard, Høyer, and Tapp likewise gave a theoretical quantum algorithm for finding collisions in an appropriate black-box setting with different asymptotic query complexity. These are real mathematical results, and pretending they do not exist would merely replace one kind of technological theatre with another. What they do not provide is a discovered structural flaw in SHA-256, because a generic query-complexity improvement and a cryptanalytic weakness in the compression function are different claims. The precise criticism is therefore much stronger than saying “quantum is nonsense”: a generic quantum search theorem does not, by itself, establish that SHA-256 is structurally broken or that Bitcoin mining has a practical quantum vulnerability.
NIST itself makes this distinction in its post-quantum guidance. Its current FAQ notes that generic techniques such as Grover’s algorithm may change abstract attack costs, while also emphasising practical limitations, including the difficulty of parallelising Grover’s full quadratic advantage and the cost of quantum hardware. NIST continues to recommend strong symmetric primitives and hash functions in post-quantum contexts, and its post-quantum standardisation effort explicitly includes constructions based on hash functions. The important point is not that quantum theory has no statements whatsoever about search complexity; it is that the security consequences are narrower than public rhetoric suggests and must be expressed in the appropriate model. “A theorem exists that changes an ideal query count” and “SHA-256 has been broken” are sentences separated by rather more than enthusiasm.
6. A theorem is not a machine, and a machine is not an economic attack
The most persistent abuse in quantum-computing rhetoric is the quiet substitution of mathematical asymptotics for engineering performance. A theoretical quantum algorithm specifies what could be achieved under a computational model with certain operations available at certain costs. A practical cryptographic attack requires a physical system with sufficiently reliable logical operations, error correction, runtime, memory, control, and total resource cost to outperform relevant classical systems on the actual task. Bitcoin mining adds another layer because the classical comparator is not a graduate student’s laptop but highly specialised ASIC infrastructure designed to compute SHA-256 at extraordinary throughput and energy efficiency. It is therefore intellectually dishonest to move from “Grover offers a quadratic query reduction in an ideal model” to “quantum computing speeds up Bitcoin mining” without supplying the architecture, logical-gate counts, error rates, wall-clock time, parallelism assumptions, and economic comparison that make the statement operationally meaningful.
Experimental quantum computing has nevertheless made real progress, and accuracy requires acknowledging it rather than pretending that nothing has happened. Google Quantum AI’s surface-code work reported below-threshold error correction and a logical memory with a lifetime exceeding that of its best physical constituent qubit, while 2026 work in Nature Physics demonstrated error correction of a logical qubit encoded in a single atomic ion. These are legitimate laboratory achievements, and claiming that “no logical qubit exists” is no longer defensible. But neither result is a cryptographically relevant fault-tolerant computer, still less a demonstrated machine that can attack SHA-256 or outperform industrial Bitcoin miners. The correct scepticism is therefore not denial of experimental physics; it is refusal to let a laboratory milestone masquerade as completion of the many orders of magnitude that separate a logical-qubit demonstration from a useful large-scale cryptanalytic engine.
That distinction matters because marketing survives by treating “possible in principle,” “demonstrated in a component,” “scalable in theory,” and “economically useful in deployment” as though they were stations on the same platform rather than different countries. A researcher may truthfully report a below-threshold code and a corporate press office may truthfully call it progress toward fault tolerance; the distortion arrives when a secondary commentator converts “progress toward” into an implication that cryptographic systems are now materially threatened. Good technical writing should move in the opposite direction: the closer a claim comes to practical consequence, the more explicit its resource assumptions should become. Otherwise one merely performs a confidence trick with units, replacing gate counts by adjectives and runtime by applause.
7. The word “break” should be reserved for something with an object, a model, and a result
Cryptographic language becomes useful again once the word “break” is attached to a clearly identified security property. A full collision break would require an attack on full SHA-256 that finds collisions at a cost meaningfully below the expected security strength; a preimage break would require a method that beats the relevant preimage expectation; a Bitcoin-mining shortcut would require a method that changes the cost of obtaining target-satisfying block headers under the actual double-SHA-256 construction. These are not the same achievement, and one does not inherit the consequences of another by analogy. The insistence on naming the property may sound pedantic only to people who prefer conclusions before definitions. In cryptography, the definition is what tells us whether the conclusion has occurred.
The academic literature also reminds us that “broken” can have narrower meanings in research settings, which is why context must be stated. Reduced-round collisions, related-key attacks, distinguishers, or attacks under artificial boundary conditions can all be academically valuable even when the deployed primitive remains safe for its intended use. A researcher may say that a reduced-round variant is broken while making no claim about the full standard. Public commentary, however, routinely strips away precisely those qualifiers and leaves behind the dramatic noun. The remedy is not to pretend that cryptanalysis contains no intermediate states, but to insist that the operational claim about deployed SHA-256 remains tied to full-round evidence. The rhetorical appetite for binary catastrophe does not relieve anyone of the obligation to disclose the experimental diet on which the catastrophe was raised.
This is also why “AI may discover a better attack” is properly treated as a research programme rather than a finding. The sentence identifies neither the security property nor the attack mechanism, supplies no computational model, states no complexity, and provides no reproducibility evidence. It may be an excellent motivation for funding a laboratory, constructing a benchmark, or assigning graduate students to an unpleasant summer. It is not yet evidence against SHA-256. One might as well announce that a future mathematician could discover a faster factoring algorithm and then demand that the banking system treat the possibility as though the paper had already passed peer review.
8. The argument from “you cannot prove no future attack exists” is philosophy pretending to be cryptanalysis
A particularly slippery defence of speculative claims is the observation that nobody can prove that every conceivable future attack on SHA-256 is impossible. This is true, but it proves considerably less than its admirers imagine. Scientific claims are not evaluated by asking whether the negation has been proved for all possible futures; they are evaluated by evidence for the proposition actually being asserted. The absence of a proof that no future AI will ever discover a SHA-256 weakness does not provide evidence that one is likely, imminent, quantum-assisted, economically relevant, or connected to Bitcoin mining. It merely preserves logical possibility, which is the cheapest commodity in intellectual life because nearly every sufficiently vague proposition can afford it.
The same mistake appears when possibility is smuggled into probability by repetition. First one says that AI could discover hidden structure; then that such discoveries are becoming more plausible because AI has attacked other schemes; then that quantum computing may amplify the consequences; then that Bitcoin therefore faces a novel risk. Each step sounds modest when examined alone, but the chain has quietly converted unrelated evidence into a conclusion no individual premise actually supports. The proper Bayesian response is not to assign zero probability to future breakthroughs; it is to refuse to treat evidence about one primitive, one computational model, or one hardware regime as though it were direct evidence about another. Otherwise the word “could” becomes an intellectual laundromat in which every conjecture emerges wearing the white shirt of established fact.
9. Ad hominem is not Latin for “someone criticised my technical competence”
There is also a curious social ritual in technical debates whereby a person makes a series of category errors, is told that those errors suggest a lack of understanding, and then announces that an ad hominem has occurred. The classical fallacy is not simply any unflattering statement about a person; it is an attempt to dismiss an argument by attacking an irrelevant characteristic of the person rather than addressing the substance of the argument. Saying that a researcher’s nationality, clothing, temperament, or haircut makes his cryptographic claim false would be irrelevant. Saying that repeated confusion between collision resistance, preimage search, proof-of-work target search, and Shor’s algorithm indicates a misunderstanding of the underlying cryptography is a conclusion about the demonstrated reasoning itself. It may be impolite, and it may be wrong, but it is not transformed into a logical fallacy merely because the conclusion bruises the speaker more than the mathematics.
The distinction matters because professionalism cannot be allowed to become a refuge from correction. An argument deserves professional treatment when it supplies professional content: definitions, assumptions, evidence, calculations, and a conclusion that follows from them. Civility is desirable, but civility does not require pretending that every technical statement is equally informed. If someone invokes quantum computing as though Shor were a general-purpose solvent poured over all cryptography, or treats the existence of hash collisions as evidence of a weakness, the appropriate response is to identify the error plainly. The alternative is a wonderfully polite literature in which everyone congratulates everyone else while the definitions quietly leave the room.
10. What would count as an academically serious claim?
An academically serious claim about AI, SHA-256, and Bitcoin would begin by identifying the precise object under attack. If the claim concerns collisions, it should state whether the attack applies to full SHA-256, reduced rounds, a variant, or some special-start condition. If it concerns preimages, it should state the target model and expected complexity. If it concerns Bitcoin mining, it should explain why the discovered structure changes the probability or cost of producing a double-SHA-256 block-header hash below the network target. If quantum computation is invoked, it should state whether the result is merely a black-box query-complexity theorem or an explicit fault-tolerant circuit/resource estimate. That is not bureaucratic obstruction; it is the minimum information required to know whether two people are even discussing the same mathematical problem.
The next requirement is evidence that can survive outside the prose that introduced it. A credible attack should have a mathematical derivation, executable implementation, formal proof, empirical demonstration, or some combination sufficient for independent verification. AI-generated cryptanalysis is particularly well suited to this demand because candidate attacks can often be tested automatically in formal security games, which is precisely one of the strengths of the CryptanalysisBench approach. A model that produces a dazzling explanation but fails the verifier has not broken the scheme; it has written fan fiction about breaking the scheme. The standard is refreshingly democratic because it does not care whether the attack was discovered by a famous professor, an anonymous engineer, or a language model running at three in the morning: the attack either works under the stated model or it does not.
Finally, an operational claim must include an operational comparison. If someone says a method threatens Bitcoin mining, the relevant question is not whether its asymptotic notation looks attractive on a slide but whether the end-to-end system can compete with actual mining hardware under realistic costs. If someone says a quantum algorithm reduces the effective security of a hash property, the analysis must distinguish ideal query complexity from physical logical operations and from the economics of large-scale fault tolerance. If someone says AI has materially changed SHA-256’s status, the analysis must show a SHA-256 result rather than cite impressive work on unrelated constructions. This is the point at which technology commentary usually becomes less entertaining, because units, caveats, and reproducibility have a notorious tendency to murder the metaphor before dessert.
11. The evidence ladder is the part that fashionable arguments prefer to skip
The cleanest way to organise the entire discussion is to separate five evidentiary levels that are too often collapsed. At the first level is possibility: “AI might discover something.” At the second is a theoretical model: a generic algorithm changes an abstract complexity bound. At the third is a restricted cryptanalytic result: perhaps an attack works on reduced rounds or under special assumptions. At the fourth is a full-primitive attack: the intended property of the complete construction is violated at a specified complexity. At the fifth is a practical break: the attack is sufficiently feasible to matter in the operational environment. Each higher level requires more evidence than the one beneath it, and nothing about the glamour of the technology permits the argument to jump directly from the first rung to the fifth.
Much of the popular quantum narrative is a particularly pure example of such jumping. A theorem about an idealised quantum search is treated as a machine, the machine is treated as fault tolerant, fault tolerance is treated as economically competitive, generic search is treated as a structural cryptanalytic weakness, and the resulting fantasy is finally applied to Bitcoin as though no distinction existed between public-key signatures and proof-of-work hashing. AI narratives perform a similar acrobatic routine: models have found attacks on some schemes; therefore models may find unknown structure in others; therefore SHA-256 may be vulnerable; therefore mining may be affected. Every sentence contains a possibility that can be defended in isolation, while the conclusion inherits none of the missing evidence. It is difficult not to admire the efficiency: entire research programmes are compressed into punctuation.
12. The academically defensible conclusion is less dramatic and far more useful
The evidence supports a conclusion that is both stronger and less theatrical than the one usually advertised. AI-assisted cryptanalysis is now credible enough to deserve serious integration into security evaluation, because current systems can reproduce known attacks and in some cases appear to discover new ones. SHA-256 continues to receive active cryptanalytic scrutiny, including significant reduced-round advances, yet those results do not amount to a publicly demonstrated practical break of the full function. Bitcoin proof-of-work remains a target-search problem over double-SHA-256 block headers rather than a collision hunt. Quantum algorithms such as Grover’s and the Brassard-Høyer-Tapp collision method alter idealised query complexities, while Shor addresses entirely different mathematical structures; none of those facts, by themselves, constitutes a structural SHA-256 break or a demonstrated practical Bitcoin-mining advantage.
That conclusion should satisfy anyone genuinely interested in research because it leaves the important questions open without pretending they have already been answered. AI may well produce cryptanalytic discoveries that surprise us. Quantum hardware may eventually become far more capable than today’s systems. Reduced-round attacks may continue to advance toward fuller constructions. Any of those developments would be worth studying, and no serious person should rule them out merely because the present evidence is incomplete. But intellectual openness is not the same as evidentiary promiscuity. The fact that tomorrow may contain a discovery does not allow today’s argument to spend it in advance.
So the challenge remains admirably simple: if there is a weakness in SHA-256, show it. If AI has discovered an attack, publish the attack. If a quantum machine provides a practical Bitcoin-mining advantage, specify the machine, the logical resources, the runtime, the error correction, the classical comparator, and the measured advantage. If the only evidence is that these things may happen, then the claim has not reached cryptanalysis; it is still waiting in the lobby with marketing. Oscar Wilde observed that fashion is a form of ugliness so intolerable that we have to alter it every six months. Technology has improved the arrangement: we now alter the vocabulary every quarter, while the burden of proof remains stubbornly out of season.
References
Bitcoin Developer Reference. (n.d.). Block chain: Block headers and target nBits. https://developer.bitcoin.org/reference/block_chain.html
Brassard, G., Høyer, P., & Tapp, A. (1997). Quantum algorithm for the collision problem. arXiv. https://arxiv.org/abs/quant-ph/9705002
DeBry, K., Meister, N., Valdes Martinez, A., Bruzewicz, C. D., Shi, X., Reens, D., McConnell, R., Chuang, I. L., & Chiaverini, J. (2026). Error correction of a logical qubit encoded in a single atomic ion. Nature Physics, 22, 1446–1452. https://doi.org/10.1038/s41567-026-03315-2
Fluri, L., Shafran, A., Carlini, N., Jagielski, M., Nasr, M., Dunkelman, O., Ronen, E., & Tramèr, F. (2026). CryptanalysisBench: Can LLMs do cryptanalysis? arXiv. https://doi.org/10.48550/arXiv.2607.18538
Google Quantum AI and Collaborators. (2025). Quantum error correction below the surface code threshold. Nature, 638, 920–926. https://doi.org/10.1038/s41586-024-08449-y
Grover, L. K. (1996). A fast quantum mechanical algorithm for database search. In Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing (pp. 212–219). ACM. https://doi.org/10.1145/237814.237866
Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf
National Institute of Standards and Technology. (2015). Secure Hash Standard (SHS) (FIPS PUB 180-4). https://doi.org/10.6028/NIST.FIPS.180-4
National Institute of Standards and Technology. (2024). Hash functions: Security strengths of approved hash functions. https://csrc.nist.gov/projects/hash-functions
National Institute of Standards and Technology. (2026). Post-Quantum Cryptography FAQ. https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/faqs
Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5), 1484–1509. https://doi.org/10.1137/S0097539795293172
Zhang, Z., Li, M., Gao, L., & Wang, M. (2026). Collision attacks on SHA-256 up to 37 steps with improved trail search. In J. Daemen & E. Thomé (Eds.), Advances in Cryptology – EUROCRYPT 2026, Part VI (pp. 91–120). Springer. https://doi.org/10.1007/978-3-032-25333-0_4