Cryptocurrency · 2015

Secure Hash Standard (SHS): SHA-256

National Institute of Standards and Technology

Excerpt · FIPS PUB 180-4 · August 2015

Information Technology Laboratory · Gaithersburg, MD 20899-8900

Source: nvlpubs.nist.gov
Retrieved: 27 September 2026
License: Public domain (U.S. Government work)
Rights holder: National Institute of Standards and Technology, 2015
Language: English

About this edition and its rights

Edition

FIPS PUB 180-4, Secure Hash Standard (SHS), August 2015 (https://doi.org/10.6028/NIST.FIPS.180-4), the PDF published by NIST (36 pages, 833315 bytes, SHA-256 0455b406d89648d20cbde375561e19c245b9815e894164c2670772e3d54deb82). Excerpt: the abstract (its two sentences, without the key words) in the header, then the sections that define SHA-256, complete and in their order: 2.2.1 Parameters, 2.2.2 Symbols and Operations, 4.1.2 SHA-224 and SHA-256 Functions, 4.2.2 SHA-224 and SHA-256 Constants, 5.1.1 (padding), 5.2.1 (parsing), 5.3.3 (initial hash value of SHA-256), 6.2 SHA-256 with 6.2.1 and 6.2.2; the other sections, and the headings of sections 2.2, 5, 5.1, 5.2 and 5.3 with their introductions, are left out. The prose comes from pdftotext and was checked word for word against the pages; four words split at a line end are rejoined with the hyphen of the printed page (w-bit, 32-bit, right-most, SHA-256). Formulas, the padding example and the hash computation, which pdftotext cannot read, are set in KaTeX from the page scans, with the symbols of the Standard (the assignments of 6.2.2 are “=” as printed). The 64 constants of 4.2.2 are set eight to a row as printed; they and the initial hash value were checked against the cube and square roots of the first primes. Superscript ordinals (ith, jth, tth, (i-1)st) and the italics and bold of the page are kept.

Rights

In the United States, a work of the federal government (17 U.S.C. 105): the Standard was prepared and issued by the National Institute of Standards and Technology, an agency of the U.S. Department of Commerce, and carries no copyright notice. In France, the rule of the shorter term (article L. 123-12 of the Code de la propriété intellectuelle, after article 7(8) of the Berne Convention): for a work whose country of origin is outside the European Union and whose author is not a national of a member state, the protection lasts as long as in the country of origin, which grants none.

NIST, Copyrights and Disclaimers (https://www.nist.gov/oism/copyrights, read on 27 September 2026): “With the exception of material marked as copyrighted, information presented on NIST sites are considered public information and may be distributed or copied. Use of appropriate byline/photo/image credits is requested.” The PDF has no copyright mark.

Abstract This standard specifies hash algorithms that can be used to generate digests of messages. The digests are used to detect whether messages have been changed since the digests were generated.

2.2.1 Parameters#

The following parameters are used in the secure hash algorithm specifications in this Standard.

$a, b, c, \dots, h$ Working variables that are the $w$ -bit words used in the computation of the hash values, $H^{(i)}$ .

$H^{(i)}$ The i^th hash value. $H^{(0)}$ is the initial hash value; $H^{(N)}$ is the final hash value and is used to determine the message digest.

$H_{j}^{(i)}$ The j^th word of the i^th hash value, where $H_{0}^{(i)}$ is the left-most word of hash value $i$ .

$K_{t}$ Constant value to be used for the iteration $t$ of the hash computation.

$k$ Number of zeroes appended to a message during the padding step.

$ℓ$ Length of the message, $M$ , in bits.

$m$ Number of bits in a message block, $M^{(i)}$ .

$M$ Message to be hashed.

$M^{(i)}$ Message block $i$ , with a size of $m$ bits.

$M_{j}^{(i)}$ The j^th word of the i^th message block, where $M_{0}^{(i)}$ is the left-most word of message block $i$ .

$n$ Number of bits to be rotated or shifted when a word is operated upon.

$N$ Number of blocks in the padded message.

$T$ Temporary $w$ -bit word used in the hash computation.

$w$ Number of bits in a word.

$W_{t}$ The t^th $w$ -bit word of the message schedule.

2.2.2 Symbols and Operations#

The following symbols are used in the secure hash algorithm specifications; each operates on $w$ -bit words.

$\land$ Bitwise AND operation.

$\lor$ Bitwise OR (“inclusive-OR”) operation.

$\oplus$ Bitwise XOR (“exclusive-OR”) operation.

$\neg$ Bitwise complement operation.

$+$ Addition modulo $2^{w}$ .

$≪$ Left-shift operation, where $x ≪ n$ is obtained by discarding the left-most $n$ bits of the word $x$ and then padding the result with $n$ zeroes on the right.

$≫$ Right-shift operation, where $x ≫ n$ is obtained by discarding the right-most $n$ bits of the word $x$ and then padding the result with $n$ zeroes on the left.

The following operations are used in the secure hash algorithm specifications:

$ROTL^{n} (x)$ The rotate left (circular left shift) operation, where $x$ is a $w$ -bit word and $n$ is an integer with $0 \leq n < w$ , is defined by $ROTL^{n} (x) = (x ≪ n) \lor (x ≫ w - n)$ .

$ROTR^{n} (x)$ The rotate right (circular right shift) operation, where $x$ is a $w$ -bit word and $n$ is an integer with $0 \leq n < w$ , is defined by $ROTR^{n} (x) = (x ≫ n) \lor (x ≪ w - n)$ .

$SHR^{n} (x)$ The right shift operation, where $x$ is a $w$ -bit word and $n$ is an integer with $0 \leq n < w$ , is defined by $SHR^{n} (x) = x ≫ n$ .

4.1.2 SHA-224 and SHA-256 Functions#

SHA-224 and SHA-256 both use six logical functions, where each function operates on 32-bit words, which are represented as $x$ , $y$ , and $z$ . The result of each function is a new 32-bit word.

Ch (x, y, z) Maj (x, y, z) \sum_{0}^{{256}} (x) \sum_{1}^{{256}} (x) σ_{0}^{{256}} (x) σ_{1}^{{256}} (x) = (x \land y) \oplus (\neg x \land z) = (x \land y) \oplus (x \land z) \oplus (y \land z) = ROTR^{2} (x) \oplus ROTR^{13} (x) \oplus ROTR^{22} (x) = ROTR^{6} (x) \oplus ROTR^{11} (x) \oplus ROTR^{25} (x) = ROTR^{7} (x) \oplus ROTR^{18} (x) \oplus SHR^{3} (x) = ROTR^{17} (x) \oplus ROTR^{19} (x) \oplus SHR^{10} (x) (4.2) (4.3) (4.4) (4.5) (4.6) (4.7)

4.2.2 SHA-224 and SHA-256 Constants#

SHA-224 and SHA-256 use the same sequence of sixty-four constant 32-bit words, $K_{0}^{{256}}, K_{1}^{{256}}, \dots, K_{63}^{{256}}$ . These words represent the first thirty-two bits of the fractional parts of the cube roots of the first sixty-four prime numbers. In hex, these constant words are (from left to right)

428a2f9871374491b5c0fbcfe9b5dba53956c25b59f111f1923f82a4ab1c5ed5d807aa9812835b01243185be550c7dc372be5d7480deb1fe9bdc06a7c19bf174e49b69c1efbe47860fc19dc6240ca1cc2de92c6f4a7484aa5cb0a9dc76f988da983e5152a831c66db00327c8bf597fc7c6e00bf3d5a7914706ca63511429296727b70a852e1b21384d2c6dfc53380d13650a7354766a0abb81c2c92e92722c85a2bfe8a1a81a664bc24b8b70c76c51a3d192e819d6990624f40e3585106aa07019a4c1161e376c082748774c34b0bcb5391c0cb34ed8aa4a5b9cca4f682e6ff3748f82ee78a5636f84c878148cc7020890befffaa4506cebbef9a3f7c67178f2

5.1.1 SHA-1, SHA-224 and SHA-256#

Suppose that the length of the message, $M$ , is $ℓ$ bits. Append the bit “1” to the end of the message, followed by $k$ zero bits, where $k$ is the smallest, non-negative solution to the equation $ℓ + 1 + k \equiv 448 mod 512$ . Then append the 64-bit block that is equal to the number $ℓ$ expressed using a binary representation. For example, the (8-bit ASCII) message “abc” has length $8 \times 3 = 24$ , so the message is padded with a one bit, then $448 - (24 + 1) = 423$ zero bits, and then the message length, to become the 512-bit padded message

“a” 01100001 “b” 01100010 “c” 01100011 1 00 \dots 00 423 00 \dots 0 ℓ = 24 11000 64

The length of the padded message should now be a multiple of 512 bits.

5.2.1 SHA-1, SHA-224 and SHA-256#

For SHA-1, SHA-224 and SHA-256, the message and its padding are parsed into $N$ 512-bit blocks, $M^{(1)}, M^{(2)}, \dots, M^{(N)}$ . Since the 512 bits of the input block may be expressed as sixteen 32-bit words, the first 32 bits of message block $i$ are denoted $M_{0}^{(i)}$ , the next 32 bits are $M_{1}^{(i)}$ , and so on up to $M_{15}^{(i)}$ .

5.3.3 SHA-256#

For SHA-256, the initial hash value, $H^{(0)}$ , shall consist of the following eight 32-bit words, in hex:

H_{0}^{(0)} H_{1}^{(0)} H_{2}^{(0)} H_{3}^{(0)} H_{4}^{(0)} H_{5}^{(0)} H_{6}^{(0)} H_{7}^{(0)} = 6a09e667 = bb67ae85 = 3c6ef372 = a54ff53a = 510e527f = 9b05688c = 1f83d9ab = 5be0cd19

These words were obtained by taking the first thirty-two bits of the fractional parts of the square roots of the first eight prime numbers.

6.2 SHA-256#

SHA-256 may be used to hash a message, $M$ , having a length of $ℓ$ bits, where $0 \leq ℓ < 2^{64}$ . The algorithm uses 1) a message schedule of sixty-four 32-bit words, 2) eight working variables of 32 bits each, and 3) a hash value of eight 32-bit words. The final result of SHA-256 is a 256-bit message digest.

The words of the message schedule are labeled $W_{0}, W_{1}, \dots, W_{63}$ . The eight working variables are labeled $a$ , $b$ , $c$ , $d$ , $e$ , $f$ , $g$ , and $h$ . The words of the hash value are labeled $H_{0}^{(i)}, H_{1}^{(i)}, \dots, H_{7}^{(i)}$ , which will hold the initial hash value, $H^{(0)}$ , replaced by each successive intermediate hash value (after each message block is processed), $H^{(i)}$ , and ending with the final hash value, $H^{(N)}$ . SHA-256 also uses two temporary words, $T_{1}$ and $T_{2}$ .

6.2.1 SHA-256 Preprocessing#

Set the initial hash value, $H^{(0)}$ , as specified in Sec. 5.3.3.
The message is padded and parsed as specified in Section 5.

6.2.2 SHA-256 Hash Computation#

The SHA-256 hash computation uses functions and constants previously defined in Sec. 4.1.2 and Sec. 4.2.2, respectively. Addition (+) is performed modulo $2^{32}$ .

Each message block, $M^{(1)}, M^{(2)}, \dots, M^{(N)}$ , is processed in order, using the following steps:

For $i$ =1 to $N$ :

{

1. Prepare the message schedule, ${W_{t}}$ :

W_{t} = {M_{t}^{(i)} σ_{1}^{{256}} (W_{t - 2}) + W_{t - 7} + σ_{0}^{{256}} (W_{t - 15}) + W_{t - 16} 0 \leq t \leq 15 16 \leq t \leq 63

2. Initialize the eight working variables, $a$ , $b$ , $c$ , $d$ , $e$ , $f$ , $g$ , and $h$ , with the (i-1)^st hash value:

a b c d e f g h = H_{0}^{(i - 1)} = H_{1}^{(i - 1)} = H_{2}^{(i - 1)} = H_{3}^{(i - 1)} = H_{4}^{(i - 1)} = H_{5}^{(i - 1)} = H_{6}^{(i - 1)} = H_{7}^{(i - 1)}

3. For $t$ =0 to 63:

{T_{1} = h + \sum_{1}^{{256}} (e) + Ch (e, f, g) + K_{t}^{{256}} + W_{t} T_{2} = \sum_{0}^{{256}} (a) + Maj (a, b, c) h = g g = f f = e e = d + T_{1} d = c c = b b = a a = T_{1} + T_{2}}

4. Compute the i^th intermediate hash value $H^{(i)}$ :

H_{0}^{(i)} H_{1}^{(i)} H_{2}^{(i)} H_{3}^{(i)} H_{4}^{(i)} H_{5}^{(i)} H_{6}^{(i)} H_{7}^{(i)} = a + H_{0}^{(i - 1)} = b + H_{1}^{(i - 1)} = c + H_{2}^{(i - 1)} = d + H_{3}^{(i - 1)} = e + H_{4}^{(i - 1)} = f + H_{5}^{(i - 1)} = g + H_{6}^{(i - 1)} = h + H_{7}^{(i - 1)}

}

After repeating steps one through four a total of $N$ times (i.e., after processing $M^{(N)}$ ), the resulting 256-bit message digest of the message, $M$ , is

H_{0}^{(N)} ∥ H_{1}^{(N)} ∥ H_{2}^{(N)} ∥ H_{3}^{(N)} ∥ H_{4}^{(N)} ∥ H_{5}^{(N)} ∥ H_{6}^{(N)} ∥ H_{7}^{(N)}