Computing only one byte of a cryptographically secure hash function Let $H$ be a cryptographically secure hash function, like SHA256. The output of $H$ is $N$ bytes long, with $N$ usually in the order of $32$ for commonly used hash functions.

Now, be $X$ a string, I can compute $Y = H(X)$, which is a sequence $Y_0, \ldots, Y_{N-1}$ of bytes. Now, I was wondering: is there any way to have some $H^{(i)}$ so that $\forall X,\; H^{(i)}(X) = H(X)_i$ (i.e., a function that extracts the $i$-th byte of $H(X)$) but so that computing $H^{(i)}$ is faster than computing $H$, then extracting the $i$-th byte?

In other words, if I want to just compute one byte of $H$, can I avoid carrying out some computations and save some CPU?

(I hope not. If not, is there a proof for this?)
For SHA-256, given its structure, the savings achievable when computing a single byte of the output is small. Argument: the computation consists of 64 rounds in cascade (or several times that for input of at least 56 bytes); full diffusion is achieved after 8 rounds, therefore all but the last 7 rounds must be computed in full (and then a large fraction of the rest, varying with which byte is kept), therefore savings are (much) less than 7/64 on the rounds, and a little extra operation on the output (worth less than 8 32-bit additions). Thanks to tylo for reporting that diffusion is much slower than I stated.

This is largely true for all common hash functions, but we can not generalize to any hash function. It is easy to construct a hash function of cost about proportional to the width needed (but somewhat inefficient, or insecure).