<essential_principles>

RFC 6234 specifies SHA-224, SHA-256, SHA-384, SHA-512 (the SHA-2 family), plus HMAC and HKDF based on them. IETF Informational (May 2011). Obsoletes RFC 4634.

What an Implementer Must Know

SHA-256: 32-bit words, 512-bit blocks, 64 rounds. State = 8 × 32-bit words. Message schedule: first 16 words from block, expand to 64 via Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(W(t-15)) + W(t-16). Each round: T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt, T2 = BSIG0(a) + MAJ(a,b,c), then rotate a-h. Add working variables back to state. All mod 2^32. Padding: 1-bit + zeros + 64-bit length, aligned to 512 bits. Output: all 8 words (256 bits).

SHA-512: Same structure as SHA-256 but 64-bit words, 1024-bit blocks, 80 rounds. Different rotation constants. All mod 2^64. Padding: 1-bit + zeros + 128-bit length, aligned to 1024 bits.

SHA-224 = SHA-256 with different IV, output first 7 words. SHA-384 = SHA-512 with different IV, output first 6 words.

Initial values: fractional parts of square roots of primes (first 8 for 256/512, 9th-16th for 224/384). Round constants: fractional parts of cube roots of primes (64 for 256, 80 for 512).

Six functions: CH(x,y,z) = (x AND y) XOR ((NOT x) AND z), MAJ(x,y,z) = (x AND y) XOR (x AND z) XOR (y AND z), plus BSIG0/BSIG1 (big sigma with rotations) and SSIG0/SSIG1 (small sigma with rotations+shift). Rotation amounts differ between SHA-256 (2/13/22, 6/11/25, 7/18/3, 17/19/10) and SHA-512 (28/34/39, 14/18/41, 1/8/7, 19/61/6).

Big-endian byte order throughout (unlike ChaCha20/Ed25519 which are little-endian).

</essential_principles>

sha2-rfc6234

What an Implementer Must Know