Step 1 of 5 · Reading · ~1 min
Read
Putting It Together
Putting It All Together
You've built every piece:
| Layer | Where you built it |
|---|---|
| ROTR, Ch, Maj, the four sigma functions | Bit Operations Refresher |
| Bytes to 32-bit words and back | Big-Endian Word Packing |
| K[0..63] and the initial H | The Round Constants |
| W[0..63] from a 64-byte block | Message Schedule |
| The 64-round state update | The Compression Function |
| 0x80, zeros, 64-bit bit length | Message Padding |
| Chaining blocks into one digest | Merkle-Damgard Construction |
| Why the chain leaks a resumable state | Length-Extension Attack |
| Checking yourself against NIST | Test Vectors |
| Turning the hash into a keyed MAC | HMAC-SHA256 |
| Same machinery, new IV, truncated output | SHA-224 Variant |
What we glossed over:
- SHA-512: same structure but 64-bit words, 80 rounds, different constants.
- SHA-3 / Keccak: completely different (sponge construction).
- BLAKE2/3: faster than SHA-256, similar security; tree mode for parallelism.
- Hardware acceleration: the x86 SHA-NI instructions (
sha256rnds2,sha256msg1/2) and ARMv8's SHA-2 extension do several compression rounds in silicon, worth roughly a 3-6x speedup on bulk hashing. They are not universal — SHA-NI shipped on AMD from Zen and on Intel from Goldmont, but several Intel desktop generations after it lack the instructions, so portable code still keeps a software path. - Side-channel hardening: SHA itself is constant-time, but key-dependent code paths around it must also be.
Where SHA-256 is used:
- Bitcoin (block headers, mining proof-of-work, transaction IDs)
- Git (object IDs)
- TLS certificates (signature, fingerprint)
- HMAC for API request signing
- Password hashing (NEVER use bare SHA — use bcrypt/scrypt/argon2)
You now understand the function used trillions of times per second worldwide.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…