# SHA-256 in binary-circuit-based MPC

For a binary-circuit-based MPC, the multiparty will provide its inputs to calculate the result, which indicated the function $$f(x_1, x_2, \dots,x_n)$$ needs to accept $$2$$ or more inputs.

1. Why do there exist circuits e.g, SHA-$$256$$, which takes only one input?
1. When I check the SHA-256.txt files, it takes $$2$$ inputs, one input for $$512$$ bits and the other input for $$256$$ bits, I assume the first one is the message, how about the other? What does it stand for?

This is the link where I check the SHA-256.txt file.

1. I don't see any SHA circuit there with only one input.

2. It explains right there on the page:

For SHA-256 and SHA-512 we give a circuit which maps an input buffer and an input chaining state to the next chaining state.

The SHA-256 round function takes a 512-bit block of the input data and a 256-bit chaining value, and outputs a new 256-bit chaining value. This allows the creators of this page to just give one SHA circuit (which otherwise would not be possible since SHA takes in strings of any length but a circuit has a single fixed input length). This also means that in order to use these circuits you must orchestrate the rest of the Merkle-Damgård chaining yourself and invoke this circuit possibly many times.

edit: SHA-256 is a Merkle-Damgård hash function, so its hashes are computed in the following way (image from Wikipedia):

The entire picture shows the SHA-256 computation on a long input of $$n$$ blocks (a block is 512 bits in SHA-256). The circuit files you found describe a circuit only for the yellow box labeled "$$f$$". The "chaining value" is the horizontal arrow connecting $$f$$-boxes.

• For 1st point, I'm not clear what is a chainning value (chaning state)? So far as I know, the input is always the input data no matter long the text is. Could you please elaborate a little bit about changing aluemore or give some references? Mar 15 at 16:55
• Please see my edits and let me know if things are still unclear. Mar 15 at 21:50
• thanks! It's clear for me now. Mar 16 at 9:20
• All of the SHA circuits on that site have 2 inputs (see the first number on the second line of those files). Mar 18 at 14:12
• Well, read the comment on that page: they only implement 1 block of SHA with fixed IV and not the general SHA round function. The circuit indeed only has one formal input, but it would be a trivial matter to modify this circuit so that each party has half of the input bits, or they have xor shares of the input bits, etc. Mar 18 at 18:21