SHA-256 (source code)
= SHA-256
{c}
{title2=$H(m)\in\{0,1\}^{256}$}
\b[SHA-256] is a <SHA-2> <cryptographic hash function> producing a 256-bit digest. It processes a padded message in 512-bit blocks, with eight 32-bit state words and 64 processing rounds per block. The specified additions use <modular arithmetic> modulo $2^{32}$.<Secure Hash Standard by National Institute of Standards and Technology>[§§5.1.1–5.3.3 and §§6.2.1–6.2.2]{ref}
Padding is part of the function. For input bit length $\ell<2^{64}$, append a one bit, then the smallest nonnegative number $k$ of zero bits satisfying
$$
\ell+1+k\equiv448\pmod{512},
$$
then append the 64-bit representation of $\ell$. This makes the complete length a multiple of 512 bits.<Secure Hash Standard by National Institute of Standards and Technology>[§5.1.1, padding; §5.2.1, block parsing]{ref}
For an original byte-count example, the three ASCII bytes `61 62 63` have length 24 bits. Here $k=423$, and
$$
24+1+423+64=512.
$$
The padded block consists of the original three bytes, byte `80`, 52 zero bytes and an eight-byte length field representing 24. The padded input occupies 64 bytes; the final digest occupies 32 bytes. Computing SHA-256 gives
`ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`.
Adding a newline changes the byte sequence and the digest. Displayed text, its character encoding and its line terminator must therefore be specified when comparing hash values.
The padding boundary is also visible without computing a digest. A 55-byte input fits its padding into one 64-byte block, whereas a 56-byte input requires two blocks because the length field no longer fits. Both still produce a 256-bit output. Digest length is not the padded-message length or a reversible compressed representation of the input.
Finite output size necessarily allows collisions over a larger input set; <collision resistance> concerns the difficulty of finding them. <SHA-256> also supplies the hash operation used inside common <HMAC> and <HKDF> instantiations, whose keyed constructions and security properties differ from an ordinary unkeyed digest.
Back to article page
