Yes, it would take days. I am not in a rush, nor trying to solve any problem...I just like Maths.

There is a video floating around (citation/source to come) of someone doing the first round of SHA-256 by hand. It seems straight forward, but I have no idea what the second round looks like. Do I use the old values from the last round? Do I use more chunks of the plaintext?

Please don't just quote Wikipedia pseudocode at Me...I already read it. Did. Not. Help.

I'll update when I find a link to the video. Thanks.

  • $\begingroup$ @fgrieu As I understand it, the first round involves initialization of all the registers using the plaintext...so the second round would just be running the same operations using the new values for the registers I just set in the last round? $\endgroup$
    – That Guy
    Aug 21, 2017 at 2:12
  • 1
    $\begingroup$ the wikipedia pseudocode was rewritten by me a few years back to be extremely readable, if it is still not helpful, read the FIPS $\endgroup$ Aug 23, 2017 at 0:20
  • $\begingroup$ @Richie Frame ...It's a fine job, but I am not remotely clever enough to understand it. That's on Me, not you. $\endgroup$
    – That Guy
    Aug 23, 2017 at 1:16
  • $\begingroup$ Here's the video: youtube.com/watch?v=y3dqhixzGVo $\endgroup$
    – mti2935
    May 21, 2020 at 1:08

1 Answer 1


Yes, the next round use the old values from the last round.

For the first 16 out of 64 rounds, the next round does use the next 32-bit chunk of plaintext (message to hash) when that is 512-bit or more; but things are more complex in general, because what's processed in a round is a block of the padded message rather than the actual message, and that block undergoes transformations that matter for the next 48 out of 64 rounds.

SHA-256 can be described as follows:

  • setup a vector of 8 32-bit registers $S[\,]$ to an certain initial value
  • for each of $\lceil(L+65)/512\rceil$ 512-bit block(s) of the padded message to hash (consisting of the message of length $L$ bit(s), a single 1 bit, $511-(L+65\bmod 512)$ 0 bit(s), and the 64-bit representation in big-endian binary of $L$ )
    • copy that padded block of plaintext into a vector of 16 32-bit registers $W[\,]$ per big-endian binary
    • copy the whole of $S[\,]$ into $T[\,]$
    • for each of 64 rounds $r$ from $0$ to $63$
      • if $r\ge16$
        • transform $W[\,]$ in a certain way involving 4 rotations, 2 shifts, 4 XOR, and 3 additions modulo $2^{32}$ (all over 32-bit quantities)
      • transform $S[\,]$ in a certain way involving the 32-bit value $W[r\bmod16]$ (thus coinciding with padded message for the first 16 out of 64 rounds), a 32-bit constant $K[r]$, 6 rotations, 4 XOR, 7 additions modulo $2^{32}$, and the evaluation of the choice and majority ternary bitwise functions (all over 32-bit quantities)
    • add each of the 8 components of $T[\,]$ into $S[\,]$, modulo $2^{32}$
  • the hash is $S[\,]$ with each 32-bit register expressed per big-endian binary, forming a 256-bit bitstring.
  • $\begingroup$ I'm beginning to think I asked a question I can not possibly understand the answer too. But thanks for taking the time to try. :) $\endgroup$
    – That Guy
    Aug 23, 2017 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.