Can a combinatorial hardware circuit with no inputs solve a crypto problem?

Question

I am noob at electronics but in short I am interested in stable states of circuit with no inputs which represents a boolean formula.

Let \$f\$ be some hash function, say md5. Restrict the size of input to be equal to the output (128 bits for md5).

Cryptographer told be it is open problem if there is solution to \$f(x)=x\$ (treated as sequence of bits).

Implement \$f\$ as pure combinatorial circuit (NO CLOCK), with 128 \$i_k\$ inputs and 128 outputs \$o_k\$.

For all \$j\$, connect \$i_j\$ with \$o_j\$ so the circuit doesn't have inputs(basically loop the circuit \$f\$).

Power on.

Measure (possibly with oscilloscope) \$i_j=o_j\$.

If you are lucky to hit stable state (logically consistent), you have solved \$f(x)=x\$.

In an unstable stable (no solution), maybe one will measure very high frequency.

Probably this is well studied, though an engineer couldn't find reference for the general case.

1. Are there references for this?

2. If it fails why will it fail?

3. If a solution exists is it known for how long it will be found?

4. If this makes sense, would please someone try it on something simple, though not entirely trivial?

---

Partial experimental results:

It wasn't easy, but me convinced an engineer to test it on bare metal.

Take \$n\$ inverters (logical negation) and loop them in a cycle (basically this corresponds to the cycle graph \$C_n\$).

There are no input and no outputs.

For even \$n\$ the circuit has exactly 2 stable states.

For odd \$n\$, there is no stable state since the boolean formula is unsatisfiable.

The engineer worked with NAND gates on a stand.

Experimentally, for \$n=4\$, the engineer reached stable state. Depending on which NAND gates he chose, the stable state differed.

For \$n=3\$ there was no stable state. The voltage was in the middle between logical 0-1, possibly with high frequency which his oscilloscope couldn't measure.

I wouldn't trust a software simulation for this, might be wrong.

The experiments were too trivial, so it is possible electric current to solve easy problems and not solve hard problems.

Someone suggested this is "adiabatic bruteforce", though still can't find the right search terms.

Answer 1

The general field of digital logic without a clock is asynchronous logic. Research has been done in this area but it hasn't really been commercialised.

Your cryptographic example might fail for two reasons:

• it may find a cycle, possibly a long one, that produces a sequence of values but does not converge on the desired solution. This is a mathematical aspect of the problem rather than an implementation detail.

• If you use regular logic and don't have some system for keeping signal propagation in sync, you won't compute the right thing at all, as some parts of the answer will be ready before others, which in turn will perturb the input. See the "Muller C-element" for a solution to this.

Your engineer should have told you that you were reinventing the "ring oscillator". These are often used in conjunction with phase-locked-loops to produce high frequency digital clocks that are some multiple of an input clock without using a high-frequency crystal.

Answer 2

You're wrongly assuming that such a machine would always loop through all the possible inputs; this isn't the case. You might enter a loop that does not span through the entire input space.

For example, let's try to solve this cryptographical problem:

Let H(n) be a hash function, defined thus: H(n) = n + 2. This function takes four bits in and returns four bits. Any carry bit (eg. 15 + 2 = 17 = 10001) is ignored (in our case, H(17) = 1 = 0001)
Find x such that H(x) = 3.

You build a circuit representing the behaviour of H(n): it takes four inputs, and four outputs. Its current output is 0000. Now, you wire the inputs I1, I2, I3, I4 to the outputs O1, O2, O3, O4. What happens?

Instant 0: the output is 0000 [0].
Instant 1: the output is 0010 [2].
Instant 2: the output is 0100 [4].
Instant 3: the output is 0110 [6].
Instant 4: the output is 1000 [8].
Instant 5: the output is 1010 [10].
Instant 6: the output is 1100 [12].
Instant 7: the output is 1110 [14].

Instant 8: the output is 0000 [0].
Instant 9: the output is 0010 [2].
...

See where this is going? The circuit will loop through only a few states, and may never reach the solution.

Now, I thought of a trivial example to illustrate this concept, but this also works for real hashing functions like MD5 or SHA1.

---

Let I = {0x00...01, 0x00...02, ... 0xff...ff} be the list of 256-bit unsigned integers, and let S(x): I -> I be the SHA256 hashing function.

Apply S(x) to each element in I. You are extremely likely to find collisions: that is, two values that hash to the same value (say H(0x00...01) = H(0xEE...EE)). If a collision exists, then the set I is larger than its image with respect to S: that is, there are elements in I which don't have a counterimage, meaning they can't be obtained by hashing a 256-bit value.

TLDR: It might be mathematically impossible to solve a problem using your method.