Does SHA-1 meet the strict avalanche criterion? Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one.

It's something that seems to be easy to check (in "On the Design of S-Boxes", Webster &amp; Tavares lay out how it can be done), so it is surprising to not find a paper on it.  Has it been put down as a small result in some other paper?  Or has the SAC been discarded as a useful metric?  Or have I somehow missed the relevant paper (accept my apologies if so!)?  Any pointers would be gratefully appreciated.

Edit: is Hash function balance and its impact on birthday attacks relevant?  Is the "balance" metric simply a better/different way of expressing the SAC?
There is a paper "SHA-1 and the Strict Avalanche Criterion."

From the abstract:


  This work provides a working definition of the SAC, describes an experimental methodology that can be used to statistically evaluate whether a cryptographic hash meets the SAC, and uses this to investigate the degree to which compression function of the SHA-1 hash meets the SAC. The results (P&lt;0.01) are heartening: SHA-1 closely tracks the SAC after the first 24 rounds, and demonstrates excellent properties of confusion and diffusion throughout.