CDP: Cyclic Digit-sum Projection — Structural Analysis of SHA-256 Output Distribution and Ergodic Basin Pressure

We introduce CDP (Cyclic Digit-sum Projection), a structural analysis frameworkfor SHA-256 that reveals previously undocumented mathematical properties of thehash function's output distribution. The core observation is that the hex-digitsum W(H) of any SHA-256 output H, when iteratively re-hashed throughf(w) = W(SHA256(str(w))), converges deterministically into exactly two closedcycles. This cyclic structure, combined with a multi-component fingerprint,yields a bijective mapping over constrained input spaces enabling O(1) preimagelookup. Beyond the lookup application, we prove two theorems about SHA-256's internalstructure: (1) a complement nibble sum invariant (sum = 38 for all complementbyte pairs), and (2) an ergodic Markov property of SHA-256's compressionfunction under the CDP projection. The Markov chain has transition matrixP = [[0.1812, 0.8188], [0.1677, 0.8323]] with stationary distributionpi_B = 0.1700, independently of round constants K[i], initial values H0, andinput class. Two additional regularities — a 20% universal M-rate constant anda universal collapse rule at padding word boundaries — are presented as empiricalobservations. We further identify a mathematical connection between SHA-256'soutput structure and AES GF(2^8) arithmetic via the LFSR xtime operation. Version 2 additions: Extended basin topology analysis reveals the true C1 basinof attraction spans 84 values (16.8% of domain) against C2's 416 values (83.2%),with maximum convergence depths of 8 and 16 respectively. W(H0) = 502 is +22.2units above equilibrium, creating a measurable round-0 basin-membership deficitof 16.9%. CDP rainbow chain merge behavior is empirically quantified: 1.81×improvement over random reduction, with 66.7% unique chains at saturation. Version 3 correction: Section 6.2 (Complement Symmetry) is corrected. hw_7C1% = 21.9% (elevated, +2.4%) and hw_1 C1% = 14.1% (suppressed, −5.4%).All other quantitative claims from v2 remain intact. v4 — July 2026: Four new CDP projections (mod4_weighted, word_sigma, t1t2,xor_fold) with compound lookup index achieving 42.55× speedup oversingle-projection baseline (literature best: 2.56×, CDP is 16.6× better).Round-by-round TVD diffusion profile: non-zero residual [0.03, 0.06] throughRound 64. H0 imprinting ablation: Round 3 spike +88.74, sign reversal atRound 4. Period-4 mechanism attributed to message schedule W[i-16] feedback,confirmed K[i]-independent. v5 — September 2026:- wvec16 standalone bijection: zero collisions at N=100,000; key size reduced 30→17 bytes (43% smaller table entries).- Message schedule–output independence: r(S_64, W(H)) = −0.0045 (p=0.16), conditional narrowing 0.60% — one-way function statistical signature.- Cross-hash CDP comparison: SHA-512 fixed point w*=972, SHA3-256 fixed point w*=444 verified. SHA-256 has no fixed point in [100, 5000]. Encoding dependence of cycle structure explicitly noted.- Length estimation retraction: prior r=0.885 claim corrected to r=+0.0068 (p=0.337). W(H) ~ N(480, 37) regardless of input length or charset.- Theorem 2 (M-rate) and Theorem 3 (collapse rule) reclassified as empirical observations pending broader verification. CDP does not break SHA-256's preimage or collision resistance; it revealsstructural properties of the output distribution under a novel projection. SHA-256 Output Distribution Analysis: Deterministic Cycles, Basin Topology & 42x Rainbow Chain Speedup via CDP | Netacoding | Cybersecurity, Assembly & Network Research