SHA-1 has an operation within round j in stage t, where the functions $f_t$ and $K_t$ change depending on the stage.

diagram of sha-1 round function

Is there a specific reason why the variable $A$ is rotated by 5? How does this improve security? And why not rotate the variable by 30 like $B$ is?

I have the same question about $B$: why is the variable rotated and why isn't it rotated by a different amount?


1 Answer 1


Most the other operations you see in the round – XORs and $f_t$ – are bitwise functions. Without rotations every bit would only affect the corresponding bits in the other words and the higher bits in some words due to carry propagation. That means the low order bit would be affected by only the low order bits of the inputs $W_j$ and $K_t$, allowing simple inversion in the case of SHA-0 (where $W_j$ themselves are straight up combinations of input words) and significantly weaken SHA-1 (where $W_j$ are rotated).

So you need some rotations – or other operations like right shifts – to allow bits at different positions to mix completely.

The particular numbers (rotation constants) are not quite as important, but 5 and 30 are are different enough and not large factors of the word size (e.g. consider 16). There are some possibly better ones (pdf), but 5 and 30 (= -2) are also small, which at least used to matter in some low performance computational units.

  • $\begingroup$ Thanks! Do you also know why the variable $B$ was chosen to rotate over, for example, $C$ or $D$? $\endgroup$
    – Cartman123
    Aug 28, 2016 at 8:33
  • $\begingroup$ @Cartman123, the paper and presentation that I linked mention that possibility but do not show any results. I don't know if it makes any difference, but I doubt it since all of the middle three words are treated similarly. $\endgroup$
    – otus
    Aug 28, 2016 at 8:48
  • 1
    $\begingroup$ It is also noteworthy that intra-word bits are also related to each other through the carry propagation of modular additions in each round (the plus boxes). $\endgroup$
    – saeedn
    Aug 28, 2016 at 18:42
  • 1
    $\begingroup$ @saeedn, yes, I should have been clearer, since that does propagate bits, but only to the left. $\endgroup$
    – otus
    Aug 29, 2016 at 5:57
  • 1
    $\begingroup$ @fgrieu, thanks, I added something to that effect. $\endgroup$
    – otus
    Aug 29, 2016 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.