SHA-256 ROUND TRIP
One round as a reversible circuit
FWD BWD FIPS POWER
INPUT
TRANSPORT
LOAD
RUN
STEP
STEP
RUN
ROUND BOARD Each gate y ← y ⊞ f(x) leaves x unchanged, so y ← y ⊟ f(x) undoes it. Read right to left, the board is the inverse of the paper, (2.8)–(2.12).
INSPECTOR the last step, worked out
EQUATIONS numbers as in the paper
LEFT TO RIGHT · THE FORWARD ROUND
  • 1–4T₁ = h ⊞ Σ₁(e) ⊞ Ch(e, f, g) ⊞ Kt ⊞ Wt(1.5)
  • 5e′ = d ⊞ T₁(1.7)
  • 6–7a′ = T₁ ⊞ Σ₀(a) ⊞ Maj(a, b, c) = T₁ ⊞ T₂(1.6, 1.7)
  • 8b′ = a, c′ = b, d′ = c, f′ = e, g′ = f, h′ = g(1.7)
RIGHT TO LEFT · THE INVERSE
  • 8a = b′, b = c′, c = d′, e = f′, f = g′, g = h′(2.8)
  • 7–6T̂₁ = a′ ⊟ Σ₀(b′) ⊟ Maj(b′, c′, d′)(2.9, 2.10)
  • 5d = e′ ⊟ T̂₁(2.11)
  • 4–1h = T̂₁ ⊟ Σ₁(f′) ⊟ Ch(f′, g′, h′) ⊟ Kt ⊟ Wt(2.12)
GATE LEVEL BITS = WORDS SCRATCH = 0 REVERSES

SHA-256 ROUND TRIP

Each of the 64 rounds of SHA-256 is an exactly invertible map of its eight 32-bit registers, once the round constant Kt and the schedule word Wt are known. This machine builds one round from seven in-place gates y ← y ⊞ f(x) and a renaming of wires. A gate never changes the wires it reads, so y ← y ⊟ f(x) undoes it. Run from right to left, the board is the closed-form inverse derived in The Reversible Rounds of SHA-256.

CONTROLS

GATE LEVEL

The scope shows the same round as CNOT and Toffoli gates, each of which is its own inverse. Every ⊞ is a ripple-carry adder [2] that adds one 32-bit register into another and uses one carry bit. Σ₁, Ch, Σ₀ and Maj are first computed into a 32-bit scratch register s, added into h, and then uncomputed, so s and the carry start and end at 0: the compute–copy–uncompute pattern of §5 of the paper, with an addition in place of the copy. Each column of pixels is the state of every wire after one layer of gates that act on different wires; white pixels are the targets of that layer's gates. Hover over the scope to see each gate. The construction is chosen to be easy to follow, not to be small.

WHAT IT DOES NOT DO

Running a round backward needs Wt. For the whole hash, the 64 schedule words are the message itself, so the inverse rounds are no shortcut to a preimage (§4 of the paper).

REFERENCES

  1. T. Samshuijzen, The Reversible Rounds of SHA-256, 2026.
  2. S. A. Cuccaro, T. G. Draper, S. A. Kutin and D. P. Moulton, “A new quantum ripple-carry addition circuit”, 2004, arXiv:quant-ph/0410184. Its MAJ and UMA blocks, without the carry-out.
  3. NIST, Secure Hash Standard (SHS), FIPS PUB 180-4, 2015, doi:10.6028/NIST.FIPS.180-4.