The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a message block. For example, in SHA-256 (using 32-bit words) $$\begin{align*} \Sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 2}(x)\oplus\operatorname{ROTR}^{13}(x)\oplus\operatorname{ROTR}^{22}(x)\\ \Sigma_1^{\{256\}}(x)&=\operatorname{ROTR}^{ 6}(x)\oplus\operatorname{ROTR}^{11}(x)\oplus\operatorname{ROTR}^{25}(x)\\ \sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 7}(x)\oplus\operatorname{ROTR}^{18}(x)\oplus\operatorname{SHR}^{ 3}(x)\\ \sigma_1^{\{256\}}(x)&=\operatorname{ROTR}^{17}(x)\oplus\operatorname{ROTR}^{19}(x)\oplus\operatorname{SHR}^{10}(x)\end{align*}$$ with $\sigma$ functions used in $$W_t=\sigma_1^{\{256\}}(W_{t-2})\boxplus W_{t-7}\boxplus \sigma_0^{\{256\}}(W_{t-15})\boxplus W_{t-16}\;\text{ for }16\le t\le63$$ Notations:
- $\operatorname{ROTR}^k$ is right-rotation by $k$; it could be implemented in the C language as
uint32_t ROTR(int k, uint32_t x) { return x>>k | x<<(32-k); } - $\operatorname{SHR}^k$ is right-shift by $k$ with introduction of as many 0 on the left; in C
uint32_t SHR(int k, uint32_t x) { return x>>k; } - $\oplus$ is bitwise EXclusive-OR (C's operator
^). - $\boxplus$ is addition with truncation to word size (C's operator
+).
There are similar $\Sigma_i^{\{512\}}$ and $\sigma_i^{\{512\}}$ functions for SHA-512, using 64-bit words and different constants.
Question: Is there a reason for the use of $\operatorname{SHR}$ rather than $\operatorname{ROTR}$ in the $\sigma$ functions of SHA-2?
Note: if we used $\operatorname{ROTR}$ rather than $\operatorname{SHR}$, it would still hold that $\sigma$ functions are bijections.
