= Feedforward in SHA-256 compression
\b[Feedforward in SHA-256 compression] adds the incoming chaining state to the final working words after the 64 rounds of a message block. The addition is componentwise modulo $2^{32}$. It is a specified part of the <hash compression function>, separate from the round updates.<Secure Hash Standard by National Institute of Standards and Technology>[§6.2.2, initialization, rounds and step 4]{ref}
Write $H^{(i-1)}=(H_0^{(i-1)},\ldots,H_7^{(i-1)})$ for the incoming state. Initialize the working words $(a,b,c,d,e,f,g,h)$ from that state, execute all 64 rounds with the block's message schedule, then form
$$
H^{(i)}=H^{(i-1)}+(a,b,c,d,e,f,g,h)\pmod{2^{32}}.
$$
The right-hand working words are their values \i[after] the rounds. These eight sums become the input state for the next block, or contribute to the final digest when the padded message is complete.<Secure Hash Standard by National Institute of Standards and Technology>[§6.2.2, steps 1–4]{ref}
For an original single-word arithmetic example, suppose an incoming word is hexadecimal `fffffff0` and its final working word is `00000030`. Their ordinary sum is `100000020`; reducing modulo $2^{32}$ retains `00000020`. The carry beyond the 32-bit word is discarded. This example illustrates the addition rule, not an actual round output for a chosen message.
Returning only the working words omits feedforward and computes a different function. Using the fixed initial constants after every block also changes the function: after the first block, feedforward uses the immediately incoming chaining state. Compliance with these operations is a correctness requirement; the existence of feedforward alone is not a proof of <collision resistance>.
Back to article page
