An Empirical Evaluation of SHA-256 on the Efficacy of Random Oracle for Forestalling the Security Threats of Blockchain-Based Cyber-Physical Systems

The security of the blockchain-based cyber-physical system rivets around the collision resistance property of the hash function employed. These systems primarily use the SHA-256 digest function to inspect the integrity of the blocks used in the distributed P2P Network. To perform the task, the digest function uniquely maps the data in the blocks to a 256-bit number and the mapping is expected to be one-to-one. However, this assumption is unrealistic as these algorithms will undoubtedly produce collisions following the pigeonhole principle when they are examined with brute-force or birthday attacks. Nevertheless, such approaches are computationally infeasible and these algorithms claim one-to-one mapping just with their random behaviour. This work to evaluates the efficacy of the Random Oracle (RO) by measuring the hash distance of MACs produced by the individual variant of SHA-256 with more than 2 million distinct hashes. The results prove that the hash distribution of SHA2-256 and SHA3-256 is not uniform and the mapping is biased to the left segment of the reference hash with a 91.45:8.55 left:right distribution ratio. The results also prove the hash distribution of SHA3-256 is completely biased to the right segment of the mid-point with a 0:100 left:right distribution ratio. This serious structural flaw would certainly make the SHA3-256 vulnerable to pre-image collision with fewer trials than the birthday epitome, i.e. < 2128 trials. As follows, the comprehensive analysis of this work would help to choose the right 256-bit digest function for blockchain-based cyber-physical systems (CPSs) against differential attacks.