SHA256MSG1

SHA256MSG1 does the first part of extending SHA-256’s message schedule, four words at a time. FIPS 180-4 builds the 64 words W[0] to W[63] of a block from its 16 message words, each new one as

W[t] = sigma1(W[t-2]) + W[t-7] + sigma0(W[t-15]) + W[t-16]

where sigma0(x) is the XOR of x rotated right by 7, x rotated right by 18 and x shifted right by 3. SHA256MSG1 adds the last two terms for four consecutive t: its first operand holds W[t-16] to W[t-13], dword 0 the oldest, and dword 0 of its second operand supplies W[t-12], the one word beyond them that sigma0 needs. The four sums replace the first operand.

One step of the schedule#

The other terms come from elsewhere. With the last sixteen words in four registers, oldest first, as m0 to m3:

1. _mm_sha256msg1_epu32(m0, m1) gives W[t-16] + sigma0(W[t-15]) for the four new words.
2. _mm_alignr_epi8(m3, m2, 4) picks W[t-7] to W[t-4] out of the registers, and a PADDD adds them.
3. _mm_sha256msg2_epu32(sum, m3), SHA256MSG2, adds the sigma1 terms, which for the last two words depend on the first two being finished, and so has to come last.

GCC 14 and Clang 23 at -O2 (-msha -mssse3) compile these three lines to the same five instructions: SHA256MSG1, a MOVDQA and PALIGNR, PADDD and SHA256MSG2. The four words go to the rounds of SHA256RNDS2 after adding their round constants; the first 16 words of a block need no schedule step, and the other 48 take twelve.

Behaviour#

Each dword of the result depends only on two input words, so SHA256MSG1 is easy to check: Zen 5 turned four words of all ones into 1FFFFFFEH each, FFFFFFFFH plus sigma0 of all ones, 1FFFFFFFH, with the carry dropped. The legacy form, the only one, leaves bits 128 and up of the destination alone, as the recorded cases show. AMD’s Zen 5 instruction table lists SHA256MSG2 and SHA256RNDS2 but has no line for SHA256MSG1.

In the optimization guide

What the optimization guide says about SHA256MSG1, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

• Vectors and cryptography: Goldmont is the first Atom core with the SHA extensions and RDSEED.

Tremont

• Vectors and cryptography: Intel improved the SHA extensions on Tremont: the round instructions run on port 20 and the message instructions on port 21, so the two can overlap.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# xmm1: W[t-16] to W[t-13]; src2.d[0]:
# W[t-12]; each dword of the result is
# W[i-16] + sigma0(W[i-15]) for i from t
src1 = xmm1.read()
for i in range(4):
    if i < 3:
        w = src1.d[i + 1]  # W[i-15]
    else:
        w = src2.d[0]
    xmm1.d[i] = src1.d[i] + sigma0(w, 32)
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SHA256MSG1, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA instructions

• SHA1MSG1
• SHA1MSG2
• SHA1NEXTE
• SHA1RNDS4
• SHA256MSG2
• SHA256RNDS2