32.3.19-26Scalar Crypto IV: Rotates & SHA-256

Part III Linux boot: optional Vol. I (Unprivileged) pp. 406–413 · ~2 min read

The reference crosses from the crypto rotate family (packw, rev8, rol/rolw/ror/rori/roriw/rorw — all bitmanip, the raw material of every ARX cipher and hash) into the SHA-256 transforms, where the ARX pattern gets fused into single constant-time instructions.

The SHA-256 transforms (Zknh; all unary rd, rs1; sign-extended; serve SHA-224 identically)
ComputationAlgorithm role
sha256sig0ror(x,7) ^ ror(x,18) ^ (x >> 3)Message-schedule σ0 — expands the 16-word block to 64 words (runs 48× per block).
sha256sig1ror(x,17) ^ ror(x,19) ^ (x >> 10)Message-schedule σ1.
sha256sum0ror(x,2) ^ ror(x,13) ^ ror(x,22)Compression-round Σ0 (three rotates — the round diffusion).
sha256sum1ror(x,6) ^ ror(x,11) ^ ror(x,25)Compression-round Σ1.
Dotted-underlined cells have explanations — click one.

Four instructions capture SHA-256’s entire non-linear diffusion. Each replaces a ~5-7 instruction rotate-XOR sequence and — the security point — runs in data-independent time, so the hash of a secret (HMAC keys, password hashing) leaks nothing through cycle counts.

Hardware Designer Notes

The SHA transforms are the cheapest instructions in the whole crypto chapter — pure wiring, a few dozen gates, no ALU. The value is entirely in collapsing the software rotate-XOR chain and guaranteeing constant time. For a Linux TLS/IPsec box, Zknh is high throughput-per-gate; combine with clmul (GCM) and AES for the full record-layer accelerator.

Minimal Linux-boot hart MUST

  • Implement each SHA transform as fixed-rotate wirings into an XOR tree — no barrel shifter needed, the amounts are constants
  • Sign-extend the 32-bit result to XLEN and keep latency data-independent

MAY simplify / trap-and-emulate

  • Share the XOR tree across the four functions with a constant-select mux (they differ only in rotation amounts and the shift-vs-rotate third term)
  • Fuse consecutive sig/sum instructions in the message schedule if your decoder recognizes the SHA loop

Check yourself — rotates & SHA-256

1.sha256sig0 computes ror32(x,7) ^ ror32(x,18) ^ (x >> 3). Without this instruction, how many operations would that take?

2.What distinguishes the sig (sigma) instructions from the sum (Sigma) instructions in SHA-256?

3.Why does RV32 split SHA-512 into high/low half-instructions (sha512sig0h, sha512sig0l, …) while RV64 has native sha512sig0?

3 questions