SHA256MSG2

SHA256MSG2 finishes four new words of SHA-256’s message schedule. FIPS 180-4 builds each word W[t] of a block as

W[t] = sigma1(W[t-2]) + W[t-7] + sigma0(W[t-15]) + W[t-16]

with sigma1(x) the XOR of x rotated right by 17, x rotated right by 19 and x shifted right by 10. Its first operand holds the other three terms for W[t] to W[t+3], dword 0 first, as SHA256MSG1 and a PADDD of W[t-7] to W[t-4] leave them; SHA256MSG1’s page shows that step whole. SHA256MSG2 adds the sigma1 terms, and the four finished words replace the first operand.

The words it makes itself#

W[t] and W[t+1] need sigma1 of W[t-2] and W[t-1], the two newest words already known, which come from dwords 2 and 3 of the second operand; its dwords 0 and 1 are not read. W[t+2] and W[t+3] need sigma1 of W[t] and W[t+1], which only exist once the instruction has computed them, so SHA256MSG2 works through the four words in order, feeding each result into the word two places later. That chain is why it comes last in a schedule step, after the additions that work on all four words at once.

Zen 5’s recorded case with a zero first operand and a second of all ones shows the chain: dwords 0 and 1 became 003FFFFFH, sigma1 of FFFFFFFFH, and dwords 2 and 3 became 00006FE7H, sigma1 of 003FFFFFH. The additions wrap at 32 bits, as the standard’s do.

In a block#

The first 16 words of a block are the message itself, byte-swapped with PSHUFB since SHA-256 reads them big-endian; the other 48 come from twelve schedule steps, each ending in a SHA256MSG2. Each group of four goes to two SHA256RNDS2 after its round constants are added. With _mm_sha256msg2_epu32(sum, m3) (-msha), GCC 14 and Clang 23 at -O2 emit one SHA256MSG2.

There is no VEX form; the legacy form keeps bits 128 and up of its destination. AMD’s Zen 5 instruction table lists SHA256MSG2 as four macro-ops with a latency of five cycles, a new one every two cycles, while it has no line for SHA256MSG1.

In the optimization guide

What the optimization guide says about SHA256MSG2, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

• Vectors and cryptography: Goldmont is the first Atom core with the SHA extensions and RDSEED.

Tremont

• Vectors and cryptography: Intel improved the SHA extensions on Tremont: the round instructions run on port 20 and the message instructions on port 21, so the two can overlap.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# xmm1: W[i-16] + sigma0(W[i-15]) + W[i-7]
# for i from t to t + 3; src2: W[t-4] to
# W[t-1]; the result: W[t] to W[t+3]
src1 = xmm1.read()
u = src2.d[2]              # W[t-2]
v = src2.d[3]              # W[t-1]
for i in range(4):
    w = low(src1.d[i] + sigma1(u, 32), 32)
    xmm1.d[i] = w          # W[t+i]
    u = v
    v = w
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SHA256MSG2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA instructions

• SHA1MSG1
• SHA1MSG2
• SHA1NEXTE
• SHA1RNDS4
• SHA256MSG1
• SHA256RNDS2