SHA-256 is defined for inputting and outputting binary data using bits. Most libraries only perform calculations based on byte input instead of bit input though. So in general, SHA-256 operates on bytes, not on characters.
You need to explicitly encode your characters to to bytes using character encoding such as UTF-8 to use SHA-256. Some platforms have an implicit conversion to bytes, or even equate characters with bytes (the char
type in C/C++), but it is better to use explicit conversion none-the-less.
Never confuse characters and bytes, it's the source of about half of the problems with cryptography on stackoverflow (as well as countless bugs on system in the field, not just concerning cryptography).
When comparing the implementation of your library, don't test against random sites on the internet; they usually get encoding/decoding wrong as well. Instead compare with test vectors that do make clear which bytes are actually processed.
After you succeed with the official test vectors, you could perform string comparison with known good libraries (Java, OpenSSL etc.) using code for which the string encoding is explicitly specified.
K^ipad
is an XOR, which will not change the length ofK
. That said, SHA-256 can input of arbitrary length (for practical intents and purposes). $\endgroup$ – Stephen Touset Oct 21 '15 at 19:47