SHA-256 requires that the input data can be split into 512-bit blocks. If the input data doesn't fulfill this requirement, SHA-256 will first add padding.
The input message is padded so its length becomes a multiple of 512 bits. The padding consists of a 1 bit, followed by enough 0 bits, followed by a 64-bit representation of the original message length.
For example, the string "hello" (40 bits) is padded to a full 512-bit block:
After padding, the message is parsed into \(N\) 512-bit blocks, denoted \(M^{(1)}, \ldots, M^{(N)}\).
Each block can be split into sixteen 32-bit words. We denote the \(t\)-th 32-bit word in block \(i\) as \(M_t^{(i)}\) with \(t \in \{0, \ldots, 15\}\).
Before the hashing process, we have to initialize the required constants.
\(H^{(0)}\) consists of eight 32-bit hexadecimal words. These words were obtained by taking the first thirty-two bits of the fractional parts of the square roots of the first eight prime numbers.
These are the first 32 bits of the fractional parts of the cube roots of the first 64 prime numbers.
As a prerequisite, we will be using the following helper functions in our hashing.
For each bit position, if the corresponding bit of \(e\) is 1, the bit from \(f\) is selected. If it's 0, the bit from \(g\) is selected. So \(e\) acts as a selector between \(f\) and \(g\).
For each bit position, output whichever value (0 or 1) appears in at least two of the three inputs. It's a bitwise vote.
Used in the compression loop. They rotate a word by three different amounts and XOR the results together, spreading each bit's influence across the entire word.
Used in the message schedule to expand 16 input words into 64. They combine rotations and shifts of a word, then XOR the results together.
All additions in SHA-256 are performed modulo \(2^{32}\) (i.e., wrap around at 32 bits).
Hashing consists of 4 steps.
The message schedule takes the 16 words from the current block and mixes them into 64 words. This ensures that every bit of the original input influences many rounds of the compression function, not just one.
For each block \(M^{(i)}\), where \(i \in \{1, \ldots, N\}\), expand the 16 input words \(M^{(i)}_t\) where \(t \in \{0, \ldots, 15\}\) into 64 words \(W_t\) where \(t \in \{0, \ldots, 63\}\):
The compression function is the core of SHA-256. It takes the current hash state and the 64 scheduled words and repeatedly mixes them over 64 rounds. Each round combines the working variables with a scheduled word and a round constant, creating a complex dependency chain that makes the output unpredictable from the input.
Initialize eight working variables from the previous block's hash output:
Then for each round \(t = 0\) to \(63\):
After the compression function finishes, its output is added back to the previous hash value. This is the Davies–Meyer construction. It ensures the function is non-invertible, meaning even if an attacker knows the output, they cannot recover the input. Without this step, the compression function could simply be run in reverse.
After processing all \(N\) blocks, concatenate the eight 32-bit words:
This produces the final 256-bit (32-byte) hash digest.
Log in to leave a comment.