<p>probably the single most "i am about to give up" moment was me concluding that i need to do a first preimage attack on a cryptographic function with nontrivial diffusion properties (flipping one bit anywhere changes basically the entire 16 byte output), i went to study and found out that basically no serious hash function has ever had a practical first preimage attack executed on it</p>
