# What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick

F1(B, C, D) = (B & C) | (~B & D)

as their first function instead of another function like

F1(B, C, D) = (B & D) | (C ^ (D & ~B))

• As a plus, if you have source for this reasoning, that would be greatly appreciated. Thanks! – BonBon Aug 27 '15 at 1:35
• Well, one obvious distinction between their F1 and yours is that their F1 has evenly distributed output (assuming the inputs are evenly distributed); yours has a distinct bias towards 1 bits. – poncho Aug 27 '15 at 3:28
• I just used that as an example, but thanks for your reply. – BonBon Aug 27 '15 at 4:02
• These functions were also used in MD4 and MD5, which predate SHA-1. So I guess the best person to ask would be Ron Rivest. I think one of the biggest factors was performance. The F1 function above can be evaluated by a single "select bits" instruction on processors that have one, as F1 can be interpreted as "if B then C else D". – user13741 Aug 27 '15 at 19:52

F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their image). If you further require that each input, as well as the order of inputs, matters for the output, you are left with only 36.
The only other options they had were biased functions like the one in the question, ones where some input doesn't matter (so they are actually one or two input functions), and ones where the argument order doesn't matter, like B ^ C ^ D.