Feedforward in SHA-256 compression

Feedforward in SHA-256 compression adds the incoming chaining state to the final working words after the 64 rounds of a message block. The addition is componentwise modulo $2^{32}$. It is a specified part of the hash compression function, separate from the round updates.^[ref]

Write $H^{(i-1)}=(H_0^{(i-1)},\dots ,H_7^{(i-1)})$ for the incoming state. Initialize the working words $(a,b,c,d,e,f,g,h)$ from that state, execute all 64 rounds with the block's message schedule, then formThe right-hand working words are their values after the rounds. These eight sums become the input state for the next block, or contribute to the final digest when the padded message is complete.^[ref]

For an original single-word arithmetic example, suppose an incoming word is hexadecimal fffffff0 and its final working word is 00000030. Their ordinary sum is 100000020; reducing modulo $2^{32}$ retains 00000020. The carry beyond the 32-bit word is discarded. This example illustrates the addition rule, not an actual round output for a chosen message.

Returning only the working words omits feedforward and computes a different function. Using the fixed initial constants after every block also changes the function: after the first block, feedforward uses the immediately incoming chaining state. Compliance with these operations is a correctness requirement; the existence of feedforward alone is not a proof of collision resistance.