# What is a SHA1_Compress() function?

I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the function identical to a normal SHA-1 hash function? Or it is a totally different thing? I tried to search the term with Google but found nothing.

• By the way, you know the algorithm you quoted is not scrypt, right? It's another key derivation called HEKS, an early attempt in the late '90s to make a memory-hard algorithm which apparently nobody ever used. – Squeamish Ossifrage Feb 17 '19 at 21:47
• @SqueamishOssifrage Oops, actually I haven't finished reading the paper. And implementing the wrong algorithm... – JasonHK Feb 18 '19 at 4:33
• You might find it easier to start from the RFC: tools.ietf.org/html/rfc7914 It should be more or less self-contained, and includes test vectors for the whole algorithm and the various subroutines. – Squeamish Ossifrage Feb 18 '19 at 5:08

## 1 Answer

The function SHA-1 is defined on a message $$m$$ that is a sequence of bits. It works as follows—this form is named Merkle–Damgård after the people who suggested it in days of yore:

1. Let $$m' = m \mathbin\| 1 \mathbin\| 0^p \mathbin\| \operatorname{length}(m)$$ be the result of padding $$m$$ with a one bit, $$p$$ zero bits, and a 64-bit message length, so that the length of $$m'$$ is an integral multiple of 512 bits.
2. Break $$m'$$ into 512-bit blocks $$m_1, m_2, \dots, m_n$$.
3. Compute $$f(\cdots f(f(\mathit{iv}, m_1), m_2)\cdots, m_n)$$.

Here $$f\colon \{0,1\}^{160} \times \{0,1\}^{512} \to \{0,1\}^{160}$$ is the compression function which compresses a 160-bit starting state and a 512-bit block into a 160-bit subsequent state, and $$\mathit{iv}$$ is the standard initialization vector.

In the case of SHA-1, the compression function is $$f(h, m) := E_m(h) + h$$ where $$E_k$$ is the SHACAL-1 block cipher—building $$f$$ out of a block cipher this way is called the Davies–Meyer construction.

The procedure SHA1_Compress computes $$f$$, the compression function that SHA-1 is built out of. Since the $$w_i$$ are initialized as an output of SHA-1 itself, another way to look at the procedure described here is as an incremental computation of SHA-1—you might use a typical init/update/finalize style of API for this—which periodically treats the current state as a hash itself, which works because SHA-1 has no output filter.