# Explanation of CAVP format for NIST Test Vectors for SHA-2 and 3

I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page: http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2

I don't quite understand how the test vectors are encoded. For example, if I run the SHA2-256 algorithm on an empty string as so:

import hashlib
sha2_256_test_str = b""
sha2_standard = hashlib.sha256(sha2_256_test_str).hexdigest()


I obtain the hash:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855


Which is correct. However, if I look at the first test vector in the NIST zip file it says that:

#  CAVS 11.0
#  "SHA-256 ShortMsg" information
#  SHA-256 tests are configured for BYTE oriented implementations
#  Generated on Tue Mar 15 08:23:38 2011

[L = 32]

Len = 0
Msg = 00
MD = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855


This would seem to indicate to me that for a message of "00", I should receive the hash above. However, this is the hash I obtain for an empty string. So for instance, the way that I interpret to run this test vector in Python is:

import hashlib
sha2_256_test_str = b"00"
sha2_standard = hashlib.sha256(sha2_256_test_str).hexdigest()


But this gives the hash

f1534392279bddbf9d43dde8701cb5be14b82f76ec6607bf8d6ad557f60f304e


What key point am I missing here? How would I be able to convert the messages in the NIST zip files to a message for my Python script?

• Well, actually they are specifying the length of the input string you should consider and in your case it is 0 bit long, so it is not the string "00", which is 8 bits long, but the empty string "", which is the only one of length 0. – Lery Jun 14 '17 at 14:47
• Not sure why they used Msg = 00, but Len = 0 clearly means that they're hashing the empty string. – CodesInChaos Jun 14 '17 at 14:47
• That still doesn't make sense to me. For instance, what about the next test vector that has Len = 1 and Msg = 00. The hash they give isn't obtained for that message nor for anything obvious. How can I interpret these vectors more generally? – Vincent Russo Jun 14 '17 at 14:54
• You will likely need a bit aligned hash function. – Q-Club Jun 14 '17 at 15:29
• A bit aligned hash implementation is one that can hash arbitrary bit strings, such as a string that consists of 1 bit; that's what Len=1 is asking for. If your implementation can only hash byte strings, then you'll want to look at the 'byte oriented' test vectors. – poncho Jun 14 '17 at 16:18

All of your questions are answered in the Validation System documents that are linked to by the algorithm test pages. In this case, look at http://csrc.nist.gov/groups/STM/cavp/documents/shs/SHAVS.pdf

For this case, the message length is expressed in bits not bytes. The fact that the message is also encoded as value of 00 should be ignored in the test vectors smaller than one byte; this just adds confusion to the reader.

Len = The length of a message in bits

Your hash is f1534392279bddbf9d43dde8701cb5be14b82f76ec6607bf8d6ad557f60f304e because b'00' is parsed as a string.

The NIST specification is correct: SHA256 with a zero length argument should always result in e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

It may also help to know that with one single byte set to zero, the hash is 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

• Listing the test vectors here is not really what was asked for, it asked for an explanation why the tests failed and how the CAVP test vectors are formatted. The question title may have misled you. – Maarten Bodewes Sep 22 '19 at 10:06