SHA1RNDS4

SHA1RNDS4 runs four of the 80 rounds of SHA-1’s compression function (FIPS 180-4). The first operand holds the working variables A, B, C and D, A in dword 3 down to D in dword 0, and receives them after the four rounds. The second holds the message words for those rounds, W[t] in dword 3 to W[t+3] in dword 0, with the fifth variable, E, already added to W[t]. Bits 1:0 of the immediate pick the round group, and with it the function and the constant of FIPS 180-4:

A block therefore takes 20 SHA1RNDS4s, five with each immediate. Zen 5 ignored bits 7:2: its recorded cases with FEH, 83H and E9H ran as 2, 3 and 1. GCC 14 and Clang 23 reject any _mm_sha1rnds4_epu32 immediate above 3, and a variable one, at compile time (-msha).

Where E comes from#

SHA-1 keeps five variables, but the register holds four. After four rounds the new E is the old A rotated left by 30, so the program keeps a copy of the state before each SHA1RNDS4, and SHA1NEXTE turns that copy’s A into the E of the next four rounds and adds it to their first message word: GCC 14 and Clang 23 at -O2 compile the pair to sha1nexte and sha1rnds4. For the first four rounds of a block, E is the fifth word of the hash value, added with PADDD; at the end of the block, SHA1NEXTE also forms the final E, and a PADDD adds A to D back to the hash value.

The message schedule#

FIPS 180-4 extends a block’s 16 words to 80, each the XOR of four earlier ones rotated left by 1. SHA1MSG1, a PXOR and SHA1MSG2 compute four at a time, and the 16 words of a block are byte-swapped first with PSHUFB, since SHA-1 reads them big-endian.

Like SHA256RNDS2, its SHA-256 counterpart, SHA1RNDS4 has no VEX form and keeps bits 128 and up of its destination. AMD’s Zen 5 guide lists it, and SHA1NEXTE and the message instructions, as microcoded.

In the optimization guide

What the optimization guide says about SHA1RNDS4, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

• Vectors and cryptography: Goldmont is the first Atom core with the SHA extensions and RDSEED.

Tremont

• Vectors and cryptography: Intel improved the SHA extensions on Tremont: the round instructions run on port 20 and the message instructions on port 21, so the two can overlap.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

f = imm8 & 3               # rounds 20f to
if f == 0:                 # 20f + 19, and
    k = 0x5A827999         # their constant
elif f == 1:
    k = 0x6ED9EBA1
elif f == 2:
    k = 0x8F1BBCDC
else:
    k = 0xCA62C1D6
a = xmm1.d[3]              # the state
b = xmm1.d[2]
c = xmm1.d[1]
d = xmm1.d[0]
e = 0                      # in src2.d[3]
for i in range(4):
    if f == 0:
        x = choose(b, c, d)
    elif f == 2:
        x = majority(b, c, d)
    else:
        x = b ^ c ^ d      # parity
    t = rol(a, 5, 32) + x + e + k
    e = d
    d = c
    c = rol(b, 30, 32)
    b = a
    a = low(t + src2.d[3 - i], 32)  # W
xmm1.d[3] = a
xmm1.d[2] = b
xmm1.d[1] = c
xmm1.d[0] = d
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SHA1RNDS4, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA instructions

• SHA1MSG1
• SHA1MSG2
• SHA1NEXTE
• SHA256MSG1
• SHA256MSG2
• SHA256RNDS2