The reference crosses from the crypto rotate family (packw, rev8, rol/rolw/ror/rori/roriw/rorw — all bitmanip, the raw material of every ARX cipher and hash) into the SHA-256 transforms, where the ARX pattern gets fused into single constant-time instructions.
| Computation | Algorithm role | |
|---|---|---|
| sha256sig0 | ror(x,7) ^ ror(x,18) ^ (x >> 3) | Message-schedule σ0 — expands the 16-word block to 64 words (runs 48× per block). |
| sha256sig1 | ror(x,17) ^ ror(x,19) ^ (x >> 10) | Message-schedule σ1. |
| sha256sum0 | ror(x,2) ^ ror(x,13) ^ ror(x,22) | Compression-round Σ0 (three rotates — the round diffusion). |
| sha256sum1 | ror(x,6) ^ ror(x,11) ^ ror(x,25) | Compression-round Σ1. |
Four instructions capture SHA-256’s entire non-linear diffusion. Each replaces a ~5-7 instruction rotate-XOR sequence and — the security point — runs in data-independent time, so the hash of a secret (HMAC keys, password hashing) leaks nothing through cycle counts.
Hardware Designer Notes
The SHA transforms are the cheapest instructions in the whole crypto chapter — pure wiring, a few dozen gates, no ALU. The value is entirely in collapsing the software rotate-XOR chain and guaranteeing constant time. For a Linux TLS/IPsec box, Zknh is high throughput-per-gate; combine with clmul (GCM) and AES for the full record-layer accelerator.
Minimal Linux-boot hart MUST
- Implement each SHA transform as fixed-rotate wirings into an XOR tree — no barrel shifter needed, the amounts are constants
- Sign-extend the 32-bit result to XLEN and keep latency data-independent
MAY simplify / trap-and-emulate
- Share the XOR tree across the four functions with a constant-select mux (they differ only in rotation amounts and the shift-vs-rotate third term)
- Fuse consecutive sig/sum instructions in the message schedule if your decoder recognizes the SHA loop
Check yourself — rotates & SHA-256
1.sha256sig0 computes ror32(x,7) ^ ror32(x,18) ^ (x >> 3). Without this instruction, how many operations would that take?
2.What distinguishes the sig (sigma) instructions from the sum (Sigma) instructions in SHA-256?
3.Why does RV32 split SHA-512 into high/low half-instructions (sha512sig0h, sha512sig0l, …) while RV64 has native sha512sig0?