## 3 Results
### The SHA-256  
The SHA-256 hash function has a similar structure as well as the MD5 (see Section 3.2) and also has 64 rounds of the similar transformation; see Figure 3. However, there are some differences (for more details, see [20]), namely the following:  
1. Each intermediate hash value has 256 bits, which is divided into 8 blocks with 32 bits. 2. A round has four nonlinear functions (Ch, Ma, \(\Sigma 1,\Sigma 2\)). 3. The input message has 512 bits (16 blocks with 32 bits), and it is extended to 64 blocks using right circular shift and XOR. Nevertheless, we can convert the SHA256 into MILP (QUBO) as well. In Table 3, we specified all nonlinear functions used in SHA256 and the relevant linear equation. All the MILPs were built by the method from Section 2.1. The same is with the section about the MD5 (Section 3.2), where we can write the MILP for one round as follows:  
\[ \begin{cases}L_{\text{CH}}(E_{k-1},F_{k-1},G_{k-1},CH_{k},\alpha_{k,1})=0,\\ L_{\Sigma_{1}}(E_{k-1},SIG_{k,1},\alpha_{k,2})=0,\\ L_{\Sigma_{0}}(A_{k-1},SIG_{k,0},\alpha_{k,3})=0,\\ L_{Ma}(A_{k-1},B_{k-1},C_{k-1},MA_{k},\alpha_{k,4})=0,\\ \Sigma(H_{k-1},SIG_{k,1},CH_{k},W_{k},K_{k},S_{k,1},\xi_{k,1})=0,\\ \Sigma(D_{k-1},S_{k,1},E_{k},\xi_{k,2})=0,\\ \Sigma(S_{k,1},MA_{k},A_{k},\xi_{k,3})=0,\\ B_{k}=A_{k-1},C_{k}=B_{k-1},D_{k}=C_{k-1},F_{k}=E_{k-1},G_{k}=F_{k-1},H_{k}=G_{ k-1}\,\end{cases}  \tag{44}\]  
where \(L_{\text{CH}},L_{\Sigma_{1}},L_{\Sigma_{0}},L_{Ma}\) are linear systems for nonlinear functions from Table 3, \(\Sigma\) is a system for the addition modulo operation, all \(\alpha\) and \(\xi\) are vectors of binary ancillas for nonlinear and addition transformations, respectively, \(W_{k}\) is a block of extended an input message, \(K_{k}\) is a given round constant, and \(A_{k-1},B_{k-1},C_{k-1},D_{k-1},E_{k-1},F_{k-1},G_{k-1}\) and \(H_{k-1}\) are blocks of intermediate hash values from the previous round, whereas \(A_{k},B_{k},C_{k},D_{k},E_{k},F_{k},G_{k}\) and \(H_{k}\) are hash values of the current round. \begin{table}
\begin{tabular}{c c} \hline \hline
**Boolean Formula** & **Linear Equation** \\ \hline \(\text{Ch}(\text{E},\text{F},\text{G})=(\text{E}\wedge\text{F})\oplus(\
eg E \wedge\text{G})\) & \(\text{E}+3\text{ F}+2\text{G}-6\text{Ch}+2a_{0}-3a_{1}+2a_{2}=0\) \\ \(\Sigma_{0}(A_{2},A_{13},A_{22})=A_{2}\oplus A_{13}\oplus A_{22}\) & \(A_{2}+A_{13}-A_{22}+\Sigma_{0}-2a_{0}=0\) \\ \(\Sigma_{1}(A_{-6},A_{-11},A_{-25})=A_{-6}\oplus A_{-11}\oplus A_{-25}\) & \(A_{-6}+A_{-11}-A_{-25}+\Sigma_{1}-2a_{0}=0\) \\ \(\text{Ma}(\text{A},\text{B},\text{C})=(\text{A}\wedge\text{B})\oplus(\text{A} \wedge\text{C})\oplus(\text{B}\wedge\text{C})\) & \(\text{A}+\text{B}+\text{C}-2\text{Ma}-a_{0}=0\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Non-linear functions in SHA-256 and relevant linear equations. Figure 3: Schematic round of SHA-256 hash function. For extending an input message SHA-256, we use the iterative process, where the first 16 blocks are the same as the input message \(W_{k}=M_{k}\) (\(k\in 1\ldots 16\)), and the next \(W_{k}\) (\(k\in 17\ldots 64\)) is computed as follows:  
\[\beta_{k,0}=(W_{k-15}>>>7)\oplus(W_{k-15}>>>18)\oplus(W_{k-15}>>3) \tag{45}\] \[\beta_{k,1}=(W_{k-2}>>>17)\oplus(W_{k-2}>>>19)\oplus(W_{k-2}>>10)\] (46) \[W_{k}=W_{k-16}+\beta_{k,0}+W_{k-7}+\beta_{k,1}\big{(}\text{mod }2^{32} \big{)} \tag{47}\]  
Denote by \(L_{\omega_{0}}\) and \(L_{\omega_{1}}\) the linear system for operation in Equations (45) and (46), respectively. They are built as \(\Sigma_{0}\) or \(\Sigma_{1}\) in Table 3. \(\gamma_{k,0}\) and \(\gamma_{  
**KeyExpansion--**round keys are derived from the cipher key using the AES key schedule. AES requires a separate 128-bit round key block for each round plus one more. Initial round key addition:  
**AddRoundKey--**each byte of the state is combined with a byte of the round key using bitwise XOR. 9, 11 or 13 rounds:  
**SubBytes--**a non-linear substitution step where each byte is replaced with another according to a lookup table.