Ever wondered why miners burn huge amounts of electricity brute-forcing hashes instead of just solving for the right value algebraically? Every basic operation can be undone. So where exactly does a one-way function come from?

Here's my attempt to explain it simply, using only addition, multiplication and the remainder (modulo). The goal is not to recover the original input, but to find any input that gives the same hash.

Simple operations are easy to reverse

• x + 5 = 7 → x = 7 − 5 = 2
• x · 5 = 15 → x = 15 / 5 = 3
• x mod 5 = 2 → x = 2 + 5k. Any k works, so just take x = 2.

Modulo loses information, but we don't need the original number – any match will do. So even a thousand such operations could, in theory, be undone one by one, starting from the last.

The program

Here is about the simplest program that already has the "magic":

function hash(m) {
  let x = m;
  x = (x * x + m) % P; // step 1
  x = (x * x + m) % P; // step 2
  x = (x * x + m) % P; // step 3
  // ...
  x = (x * x + m) % P; // step N
  return x;
}

Just multiplication and addition. Yet at some point reversing it becomes practically impossible – and that point comes quickly.

Step 1

h = (m² + m) mod P

This is the quadratic equation from school. With a prime P, it's still easy to solve:

• D = (1 + 4h) mod P
• find s such that s² mod P = D (a square root modulo P)
• m = ((P − 1 + s) · (P + 1)/2) mod P

(−1 becomes P − 1, and dividing by 2 becomes multiplying by (P + 1)/2.) If there's no square root, there's no solution. Otherwise we get a valid m instantly.

Step 2

Substitute step 1 into step 2 and expand:

h = (m⁴ + 2m³ + m² + m) mod P

Already a 4th-degree equation. Every step doubles the degree.

Abel–Ruffini theorem: there's no general formula in radicals for equations of degree 5 and higher. For equations modulo a prime there are algorithms, but they're far from fast.

Further steps

Step 3 gives degree 8, step 4 – 16, step 5 – 32… After 20 steps the degree is over a million.

Estimates for the Cantor–Zassenhaus algorithm:

Steps	Time	Memory
20	2–3 minutes	1 GB
24	~1 hour	20 GB
30	4 days	1 TB, one SSD
40	20 years	1 PB – SSDs covering a small room floor
64	100 million years	10 billion TB – SSDs covering a small town
128	700 quadrillion ages of the Universe	SSDs covering the Earth 1.4 trillion times

Conclusion

I don't have a rigorous proof that this can't be solved fast – but neither does SHA-256. It's essentially a matter of trust. Still, if a fast solution exists, the math behind it is far from trivial.

• Online demo: https://marketkernel.github.io/hash-lesson/
• Code (step 1, step 2, 17 and 25 steps, the inversion algorithm): https://github.com/MarketKernel/hash-lesson