SHA1MSG1

SHA1MSG1 does the first part of extending SHA-1’s message schedule, four words at a time. FIPS 180-4 builds each word W[t] of a block, from t = 16 to 79, as

W[t] = ROTL1(W[t-3] XOR W[t-8] XOR W[t-14] XOR W[t-16])

and SHA1MSG1 computes W[t-16] XOR W[t-14] for four consecutive t. As in SHA1RNDS4, the oldest word sits in the highest dword: the first operand holds W[t-16] in dword 3 down to W[t-13] in dword 0, and dwords 3 and 2 of the second operand supply W[t-12] and W[t-11], the two words beyond them that the XORs need; its dwords 1 and 0 are not read. The four XORs replace the first operand, and nothing is rotated or added.

The rest of the step#

With the last sixteen words in four registers, oldest first, as m0 to m3:

1. _mm_sha1msg1_epu32(m0, m1) gives W[t-16] XOR W[t-14];
2. an XOR with m2 adds W[t-8], which sits in the register whole;
3. _mm_sha1msg2_epu32(x, m3), SHA1MSG2, adds W[t-3] and rotates. The last of the four words needs W[t-3] = W[t], the first new word, so this part works in order and comes last.

GCC 14 and Clang 23 at -O2 (-msha) compile the three lines to SHA1MSG1, a PXOR (Clang an XORPS) and SHA1MSG2. Each step yields the words for one SHA1RNDS4, whose page covers the rounds; 64 of a block’s 80 words come from sixteen steps.

Behaviour#

Every bit of the result is the XOR of two input bits, so SHA1MSG1 is the simplest of the SHA instructions to check. Zen 5 turned a zero first operand and a second of all ones into ones in dwords 1 and 0, from the two words of the second operand, and zeros above. The legacy form, the only one, leaves bits 128 and up of the destination alone. AMD’s Zen 5 guide lists SHA1MSG1, like the other SHA-1 instructions, as microcoded.

In the optimization guide

What the optimization guide says about SHA1MSG1, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

• Vectors and cryptography: Goldmont is the first Atom core with the SHA extensions and RDSEED.

Tremont

• Vectors and cryptography: Intel improved the SHA extensions on Tremont: the round instructions run on port 20 and the message instructions on port 21, so the two can overlap.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# xmm1: W[t-16] to W[t-13]; src2: W[t-12]
# to W[t-9]; each dword of the result is
# W[i-16] ^ W[i-14] for i from t to t + 3
src1 = xmm1.read()
xmm1.d[3] = src1.d[3] ^ src1.d[1]
xmm1.d[2] = src1.d[2] ^ src1.d[0]
xmm1.d[1] = src1.d[1] ^ src2.d[3]
xmm1.d[0] = src1.d[0] ^ src2.d[2]
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SHA1MSG1, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA instructions

• SHA1MSG2
• SHA1NEXTE
• SHA1RNDS4
• SHA256MSG1
• SHA256MSG2
• SHA256RNDS2