Analyzing primes and SHA-256

Answers about primes

A prime is an integer at least 2 whose only positive divisors are 1 and itself. The number 1 is neither prime nor composite. Testing primality, factoring a composite, and studying the distribution of primes are different questions. AKS proves that deterministic primality testing is possible in polynomial time in the input’s bit length; it does not establish an equally fast general factoring method. AKS — PRIMES is in P

A provable rule: 6k ± 1

Every prime greater than 3 has the form 6k−1 or 6k+1. Remainders 0, 2, and 4 modulo 6 identify multiples of 2; remainder 3 identifies multiples of 3. Only 1 and 5 remain. The converse is false: 25 = 6×4+1 = 5×5 and 35 = 6×6−1 = 5×7 are composite. The rule filters candidates; it does not decide primality.

Why checking through √n is enough

If n = ab with a,b > 1, both factors cannot exceed √n: their product would exceed n. A composite therefore has a factor at most √n, which itself has a prime factor. If no prime at most √n divides n, n is prime. This trial-division method explains small examples; it is not presented as the preferred method for huge inputs.

97 — prime: Primes tested: 2, 3, 5, 7. None divides it.
91 — composite: Primes tested: 2, 3, 5, 7. 91 = 7 × 13

Sieving 1–100 leaves 25 primes, marked in bold with an underline.

A law for the count, and an open question

Let π(x) count the primes at most x. The prime number theorem states that π(x)/(x/ln x) tends to 1 as x grows, with ln denoting the natural logarithm. This describes the large-scale count, not the primality of an individual number. Clay — Riemann’s 1859 Manuscript

x = 100: π(x) = 25; x/ln x ≈ 21.7
x = 1,000: π(x) = 168; x/ln x ≈ 144.8
x = 10,000: π(x) = 1,229; x/ln x ≈ 1085.7

These finite calculations illustrate the theorem; they do not prove it. The Riemann hypothesis, with deep implications for the error in distribution estimates, remains unsolved as of the verification date. This page does not offer a proof. Clay — Riemann Hypothesis

The SHA-256 calculation

SHA-256 pads the input with a 1-bit delimiter, zeros, and the original bit length, then processes 512-bit blocks. Each block undergoes 64 rounds on 32-bit words. The final digest has 256 bits. The procedure combines rotations, shifts, logical operations, and addition modulo 2³². NIST — FIPS 180-4, §§4.2.2, 5, 6.2

Where primes become constants

The eight initial words take the first 32 fractional bits of square roots of the first eight primes. The 64 round constants do the same with cube roots of the first 64 primes. For the first prime, 2, the results are below. Here frac means fractional part, and floor rounds down. NIST — FIPS 180-4, §§4.2.2, 5, 6.2

H₀ = floor(2³² × frac(√2))0x6a09e667

K₀ = floor(2³² × frac(∛2))0x428a2f98

These are public fixed values, not secret keys. SHA-256 computation is not an integer-factorization problem. Understanding the origin of the constants is different from finding an input for an output.

A concrete answer: SHA-256("abc")

The input is abc without quotation marks or a newline: three UTF-8 bytes, or 24 bits. The values below are computed at build time by this site’s educational implementation.

Digest (256 bits / 64 hexadecimal digits)

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

1. Input and padding
The input bytes are 616263. W[0] is 61626380; W[15] is 00000018. The 80 contains the delimiter bit followed by zeros; hexadecimal 18 represents the original length, 24. NIST — SHA-256 intermediate example
2. Expand 16 words to 64, then run 64 rounds
Each round updates eight working variables a–h using a scheduled message word W[t] and a constant K[t]. The details below show the state immediately after each round.
3. Add the initial state back in
Add the eight initial words to the final eight working words, modulo 2³², then concatenate the results to obtain the digest. The digest is not simply the final working variables joined together.

Open the padding, constants, and all 64 rounds

Padded 512-bit block

61626380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018

Initial words H[0]–H[7]

6a09e667 bb67ae85 3c6ef372 a54ff53a 510e527f 9b05688c 1f83d9ab 5be0cd19

t follows the specification’s 0–63 indexing. Each row lists a–h after the update.

t = 0
K = 428a2f98 / W = 61626380
5d6aebcd 6a09e667 bb67ae85 3c6ef372 fa2a4622 510e527f 9b05688c 1f83d9ab
t = 1
K = 71374491 / W = 00000000
5a6ad9ad 5d6aebcd 6a09e667 bb67ae85 78ce7989 fa2a4622 510e527f 9b05688c
t = 2
K = b5c0fbcf / W = 00000000
c8c347a7 5a6ad9ad 5d6aebcd 6a09e667 f92939eb 78ce7989 fa2a4622 510e527f
t = 3
K = e9b5dba5 / W = 00000000
d550f666 c8c347a7 5a6ad9ad 5d6aebcd 24e00850 f92939eb 78ce7989 fa2a4622
t = 4
K = 3956c25b / W = 00000000
04409a6a d550f666 c8c347a7 5a6ad9ad 43ada245 24e00850 f92939eb 78ce7989
t = 5
K = 59f111f1 / W = 00000000
2b4209f5 04409a6a d550f666 c8c347a7 714260ad 43ada245 24e00850 f92939eb
t = 6
K = 923f82a4 / W = 00000000
e5030380 2b4209f5 04409a6a d550f666 9b27a401 714260ad 43ada245 24e00850
t = 7
K = ab1c5ed5 / W = 00000000
85a07b5f e5030380 2b4209f5 04409a6a 0c657a79 9b27a401 714260ad 43ada245
t = 8
K = d807aa98 / W = 00000000
8e04ecb9 85a07b5f e5030380 2b4209f5 32ca2d8c 0c657a79 9b27a401 714260ad
t = 9
K = 12835b01 / W = 00000000
8c87346b 8e04ecb9 85a07b5f e5030380 1cc92596 32ca2d8c 0c657a79 9b27a401
t = 10
K = 243185be / W = 00000000
4798a3f4 8c87346b 8e04ecb9 85a07b5f 436b23e8 1cc92596 32ca2d8c 0c657a79
t = 11
K = 550c7dc3 / W = 00000000
f71fc5a9 4798a3f4 8c87346b 8e04ecb9 816fd6e9 436b23e8 1cc92596 32ca2d8c
t = 12
K = 72be5d74 / W = 00000000
87912990 f71fc5a9 4798a3f4 8c87346b 1e578218 816fd6e9 436b23e8 1cc92596
t = 13
K = 80deb1fe / W = 00000000
d932eb16 87912990 f71fc5a9 4798a3f4 745a48de 1e578218 816fd6e9 436b23e8
t = 14
K = 9bdc06a7 / W = 00000000
c0645fde d932eb16 87912990 f71fc5a9 0b92f20c 745a48de 1e578218 816fd6e9
t = 15
K = c19bf174 / W = 00000018
b0fa238e c0645fde d932eb16 87912990 07590dcd 0b92f20c 745a48de 1e578218
t = 16
K = e49b69c1 / W = 61626380
21da9a9b b0fa238e c0645fde d932eb16 8034229c 07590dcd 0b92f20c 745a48de
t = 17
K = efbe4786 / W = 000f0000
c2fbd9d1 21da9a9b b0fa238e c0645fde 846ee454 8034229c 07590dcd 0b92f20c
t = 18
K = 0fc19dc6 / W = 7da86405
fe777bbf c2fbd9d1 21da9a9b b0fa238e cc899961 846ee454 8034229c 07590dcd
t = 19
K = 240ca1cc / W = 600003c6
e1f20c33 fe777bbf c2fbd9d1 21da9a9b b0638179 cc899961 846ee454 8034229c
t = 20
K = 2de92c6f / W = 3e9d7b78
9dc68b63 e1f20c33 fe777bbf c2fbd9d1 8ada8930 b0638179 cc899961 846ee454
t = 21
K = 4a7484aa / W = 0183fc00
c2606d6d 9dc68b63 e1f20c33 fe777bbf e1257970 8ada8930 b0638179 cc899961
t = 22
K = 5cb0a9dc / W = 12dcbfdb
a7a3623f c2606d6d 9dc68b63 e1f20c33 49f5114a e1257970 8ada8930 b0638179
t = 23
K = 76f988da / W = e2e2c38e
c5d53d8d a7a3623f c2606d6d 9dc68b63 aa47c347 49f5114a e1257970 8ada8930
t = 24
K = 983e5152 / W = c8215c1a
1c2c2838 c5d53d8d a7a3623f c2606d6d 2823ef91 aa47c347 49f5114a e1257970
t = 25
K = a831c66d / W = b73679a2
cde8037d 1c2c2838 c5d53d8d a7a3623f 14383d8e 2823ef91 aa47c347 49f5114a
t = 26
K = b00327c8 / W = e5bc3909
b62ec4bc cde8037d 1c2c2838 c5d53d8d c74c6516 14383d8e 2823ef91 aa47c347
t = 27
K = bf597fc7 / W = 32663c5b
77d37528 b62ec4bc cde8037d 1c2c2838 edffbff8 c74c6516 14383d8e 2823ef91
t = 28
K = c6e00bf3 / W = 9d209d67
363482c9 77d37528 b62ec4bc cde8037d 6112a3b7 edffbff8 c74c6516 14383d8e
t = 29
K = d5a79147 / W = ec8726cb
a0060b30 363482c9 77d37528 b62ec4bc ade79437 6112a3b7 edffbff8 c74c6516
t = 30
K = 06ca6351 / W = 702138a4
ea992a22 a0060b30 363482c9 77d37528 0109ab3a ade79437 6112a3b7 edffbff8
t = 31
K = 14292967 / W = d3b7973b
73b33bf5 ea992a22 a0060b30 363482c9 ba591112 0109ab3a ade79437 6112a3b7
t = 32
K = 27b70a85 / W = 93f5997f
98e12507 73b33bf5 ea992a22 a0060b30 9cd9f5f6 ba591112 0109ab3a ade79437
t = 33
K = 2e1b2138 / W = 3b68ba73
fe604df5 98e12507 73b33bf5 ea992a22 59249dd3 9cd9f5f6 ba591112 0109ab3a
t = 34
K = 4d2c6dfc / W = aff4ffc1
a9a7738c fe604df5 98e12507 73b33bf5 085f3833 59249dd3 9cd9f5f6 ba591112
t = 35
K = 53380d13 / W = f10a5c62
65a0cfe4 a9a7738c fe604df5 98e12507 f4b002d6 085f3833 59249dd3 9cd9f5f6
t = 36
K = 650a7354 / W = 0a8b3996
41a65cb1 65a0cfe4 a9a7738c fe604df5 0772a26b f4b002d6 085f3833 59249dd3
t = 37
K = 766a0abb / W = 72af830a
34df1604 41a65cb1 65a0cfe4 a9a7738c a507a53d 0772a26b f4b002d6 085f3833
t = 38
K = 81c2c92e / W = 9409e33e
6dc57a8a 34df1604 41a65cb1 65a0cfe4 f0781bc8 a507a53d 0772a26b f4b002d6
t = 39
K = 92722c85 / W = 24641522
79ea687a 6dc57a8a 34df1604 41a65cb1 1efbc0a0 f0781bc8 a507a53d 0772a26b
t = 40
K = a2bfe8a1 / W = 9f47bf94
d6670766 79ea687a 6dc57a8a 34df1604 26352d63 1efbc0a0 f0781bc8 a507a53d
t = 41
K = a81a664b / W = f0a64f5a
df46652f d6670766 79ea687a 6dc57a8a 838b2711 26352d63 1efbc0a0 f0781bc8
t = 42
K = c24b8b70 / W = 3e246a79
17aa0dfe df46652f d6670766 79ea687a decd4715 838b2711 26352d63 1efbc0a0
t = 43
K = c76c51a3 / W = 27333ba3
9d4baf93 17aa0dfe df46652f d6670766 fda24c2e decd4715 838b2711 26352d63
t = 44
K = d192e819 / W = 0c4763f2
26628815 9d4baf93 17aa0dfe df46652f a80f11f0 fda24c2e decd4715 838b2711
t = 45
K = d6990624 / W = 840abf27
72ab4b91 26628815 9d4baf93 17aa0dfe b7755da1 a80f11f0 fda24c2e decd4715
t = 46
K = f40e3585 / W = 7a290d5d
a14c14b0 72ab4b91 26628815 9d4baf93 d57b94a9 b7755da1 a80f11f0 fda24c2e
t = 47
K = 106aa070 / W = 065c43da
4172328d a14c14b0 72ab4b91 26628815 fecf0bc6 d57b94a9 b7755da1 a80f11f0
t = 48
K = 19a4c116 / W = fb3e89cb
05757ceb 4172328d a14c14b0 72ab4b91 bd714038 fecf0bc6 d57b94a9 b7755da1
t = 49
K = 1e376c08 / W = cc7617db
f11bfaa8 05757ceb 4172328d a14c14b0 6e5c390c bd714038 fecf0bc6 d57b94a9
t = 50
K = 2748774c / W = b9e66c34
7a0508a1 f11bfaa8 05757ceb 4172328d 52f1ccf7 6e5c390c bd714038 fecf0bc6
t = 51
K = 34b0bcb5 / W = a9993667
886e7a22 7a0508a1 f11bfaa8 05757ceb 49231c1e 52f1ccf7 6e5c390c bd714038
t = 52
K = 391c0cb3 / W = 84badedd
101fd28f 886e7a22 7a0508a1 f11bfaa8 529e7d00 49231c1e 52f1ccf7 6e5c390c
t = 53
K = 4ed8aa4a / W = c21462bc
f5702fdb 101fd28f 886e7a22 7a0508a1 9f4787c3 529e7d00 49231c1e 52f1ccf7
t = 54
K = 5b9cca4f / W = 1487472c
3ec45cdb f5702fdb 101fd28f 886e7a22 e50e1b4f 9f4787c3 529e7d00 49231c1e
t = 55
K = 682e6ff3 / W = b20f7a99
38cc9913 3ec45cdb f5702fdb 101fd28f 54cb266b e50e1b4f 9f4787c3 529e7d00
t = 56
K = 748f82ee / W = ef57b9cd
fcd1887b 38cc9913 3ec45cdb f5702fdb 9b5e906c 54cb266b e50e1b4f 9f4787c3
t = 57
K = 78a5636f / W = ebe6b238
c062d46f fcd1887b 38cc9913 3ec45cdb 7e44008e 9b5e906c 54cb266b e50e1b4f
t = 58
K = 84c87814 / W = 9fe3095e
ffb70472 c062d46f fcd1887b 38cc9913 6d83bfc6 7e44008e 9b5e906c 54cb266b
t = 59
K = 8cc70208 / W = 78bc8d4b
b6ae8fff ffb70472 c062d46f fcd1887b b21bad3d 6d83bfc6 7e44008e 9b5e906c
t = 60
K = 90befffa / W = a43fcf15
b85e2ce9 b6ae8fff ffb70472 c062d46f 961f4894 b21bad3d 6d83bfc6 7e44008e
t = 61
K = a4506ceb / W = 668b2ff8
04d24d6c b85e2ce9 b6ae8fff ffb70472 948d25b6 961f4894 b21bad3d 6d83bfc6
t = 62
K = bef9a3f7 / W = eeaba2cc
d39a2165 04d24d6c b85e2ce9 b6ae8fff fb121210 948d25b6 961f4894 b21bad3d
t = 63
K = c67178f2 / W = 12b1edeb
506e3058 d39a2165 04d24d6c b85e2ce9 5ef50f24 fb121210 948d25b6 961f4894

You can compare this trace with NIST’s intermediate example. This single-block teaching implementation is not a production cryptographic library or a NIST-validated implementation. The interactive lab continues to use the browser’s Web Crypto implementation. NIST — SHA-256 intermediate example

Try SHA-256 with your own text

Limits of the analysis

Hashing is not encryption and has no decryption key. Collision search seeks any two distinct inputs with the same digest. Preimage search seeks an input for a target digest. Second-preimage search starts from a specified input and seeks another input with its digest.

In an idealized classical model, generic collision search takes work on the order of 2¹²⁸ and preimage search 2²⁵⁶. These are benchmarks, not proven minimum costs for every input or attack. Second-preimage strength also depends on the original message length. NIST — Hash Functions / Security Strengths

Published research and this page’s boundary

Research reported in 2026 describes a practical collision attack on 35-round SHA-256. A separate preprint reports a theoretical attack on 38 rounds. The latter’s title refers to a 39-round result for SHA-512, not a successful 39-round SHA-256 attack. IACR 2026/1080 — Pushing the Limit of Memory-efficient Collision Attack Framework for SHA-2 IACR 2026/1120 — Pushing Collision Attacks on SHA-2 to 39 Steps (preprint)

Neither result demonstrates a practical break of the standard 64-round construction. The sources reviewed here do not establish practical preimage recovery or collision generation for full SHA-256. This is a dated report of the sources examined, not a proof that future attacks are impossible.

Our editorial interpretation

The following is an explanatory perspective, not a new theorem or a security proof.

See primes as what survives overlapping exclusions

Excluding multiples of 2, 3, 5, and so on uses regular rules. A sieve retains each prime itself while removing its larger multiples. Each exclusion is periodic, but the surviving gaps are not uniform. Separating “follows rules” from “has evenly spaced results” helps us understand regularity and irregularity together.

Separate a public recipe from the difficulty of searching

Prime-derived constants are a recipe anyone can reproduce. Knowing that recipe and finding an input for a target output are separate achievements. If the input is known to come from 1,000 candidates, hashing up to 1,000 candidates can find a match. A match establishes that a candidate has the target digest—not uniqueness outside that search space or a general inversion method.

Our conclusion: knowing a rule, narrowing candidates, checking an answer, and solving an open problem are distinct accomplishments.

Sources and reproduction

Prime lists, tests, counts, SHA-256 constants, and intermediate states are regenerated from public code. Constants use exact integer arithmetic rather than floating-point approximations. Tests compare digests against known NIST values and Node.js crypto. Finite tests do not prove the algorithm’s overall security.

Read the code used for these calculations

Open the local reproduction instructions

Save the code above as math-analysis.mts and run the command below in the same directory. Verified with Node.js 22.23.0; no additional packages are needed. It checks the prime count and compares four SHA-256 inputs with a separate crypto implementation.

node --experimental-strip-types --input-type=module -e '
import { strict as assert } from "node:assert";
import { createHash } from "node:crypto";
import { sha256Trace, primesUpTo } from "./math-analysis.mts";
assert.equal(primesUpTo(100).length, 25);
for (const text of ["", "abc", "素数", "a".repeat(55)]) {
  assert.equal(sha256Trace(text).digest,
    createHash("sha256").update(text).digest("hex"));
}
console.log("Prime count and 4 SHA-256 cases passed");
'

Read our editorial policy