444 字

1 分钟

sha256从原理到实现

2026-09-15

摘要算法

密码学

/

sha256

/

逆向

sha256从原理到cpp实现#

一、原理#

我们直接来看流程图

flowchart TD %% 样式定义 classDef default fill:#f9fafb,stroke:#6b7280,stroke-width:2px,color:#1f2937,rx:8,ry:8; classDef input fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a8a,rx:10,ry:10; classDef preprocess fill:#e0f2fe,stroke:#0284c7,stroke-width:2px,color:#0c4a6e; classDef init fill:#fef3c7,stroke:#d97706,stroke-width:2px,color:#78350f; classDef condition fill:#fce7f3,stroke:#db2777,stroke-width:2px,color:#831843; classDef compress fill:#dcfce7,stroke:#16a34a,stroke-width:2px,color:#14532d; classDef update fill:#f3e8ff,stroke:#9333ea,stroke-width:2px,color:#581c87; classDef final fill:#d1fae5,stroke:#059669,stroke-width:2px,color:#064e3b,rx:10,ry:10; classDef output fill:#ede9fe,stroke:#7c3aed,stroke-width:2px,color:#4c1d95,rx:10,ry:10; A["输入消息 M"]:::input B["步骤1: 消息填充 Padding"]:::preprocess C["步骤2: 分块 512 bit"]:::preprocess D["步骤3: 初始化 8 个 32bit 寄存器 H0 ~ H7"]:::init E{"还有 512bit 块吗?"}:::condition F["步骤4: 消息扩展 16 → 64 字"]:::compress G["步骤5: 64 轮压缩"]:::compress H["步骤6: 更新 H0 ~ H7"]:::update I["步骤7: 拼接 H0 ~ H7"]:::final J["输出 256bit 摘要"]:::output A --> B B --> C C --> D D --> E E -- 是 --> F F --> G G --> H H --> E E -- 否 --> I I --> J %% 连线样式 linkStyle default stroke:#6b7280,stroke-width:2px;

我们从图中可以直观对比一下sha256与md5和sha1

对比项	MD5	SHA-1	SHA-256
寄存器数量	4 个 32 位 (A, B, C, D)	5 个 32 位 (A, B, C, D, E)	8 个 32 位 (H0 ~ H7)
消息扩展	无	有	有
扩展后字数	16 字 (不扩展)	80 字 (W0 ~ W79)	64 字 (W0 ~ W63)
压缩轮数	64 轮 (4 轮 × 16 步)	80 轮 (4 轮 × 20 步)	64 轮 (64 步)
最终输出位数	128 位	160 位	256 位

填充#

flowchart LR A["原始消息 M (L bits)"] --> B["追加 1 bit"] B --> C["追加 k 个 0 使 L+1+k ≡ 448 mod 512"] C --> D["追加 64 bit 大端 L"] D --> E["总长是 512 的倍数"]

这里和sha1完全一样，追加的八字节也是大端序。

初始化寄存器#

这个跟之前不同了。这些是前 8 个素数（2,3,5,7,11,13,17,19）平方根小数部分的前 32 位。

1
H0 = 0x6a09e667    H1 = 0xbb67ae85
2
H2 = 0x3c6ef372    H3 = 0xa54ff53a
3
H4 = 0x510e527f    H5 = 0x9b05688c
4
H6 = 0x1f83d9ab    H7 = 0x5be0cd19

消息扩展#

flowchart TD %% 样式定义 classDef default fill:#f9fafb,stroke:#6b7280,stroke-width:2px,color:#1f2937,rx:8,ry:8; classDef input fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a8a,rx:10,ry:10; classDef loop fill:#fef3c7,stroke:#d97706,stroke-width:2px,color:#78350f; classDef sigma0 fill:#e0f2fe,stroke:#0284c7,stroke-width:2px,color:#0c4a6e; classDef sigma1 fill:#dcfce7,stroke:#16a34a,stroke-width:2px,color:#14532d; classDef formula fill:#ede9fe,stroke:#7c3aed,stroke-width:2px,color:#4c1d95; classDef output fill:#d1fae5,stroke:#059669,stroke-width:2px,color:#064e3b,rx:10,ry:10; A["W0..W15 = 大端读入的 16 个 32bit 字"]:::input B["for t = 16..63"]:::loop C["σ0 = rotr(Wt-15, 7) ^ rotr(Wt-15, 18) ^ shr(Wt-15, 3)"]:::sigma0 D["σ1 = rotr(Wt-2, 17) ^ rotr(Wt-2, 19) ^ shr(Wt-2, 10)"]:::sigma1 E["Wt = Wt-16 + σ0 + Wt-7 + σ1"]:::formula F["得到 W0..W63"]:::output A --> B B --> C C --> D D --> E E --> B B -->|结束| F %% 连线样式 linkStyle default stroke:#6b7280,stroke-width:2px;

注意这里 σ0/σ1 用的是 rotr（循环右移） 和 shr（逻辑右移） 的组合，与 SHA-1 的简单 rotl 不同。

64轮压缩#

1
用到的辅助函数
2
Ch(x,y,z)  = (x & y) ^ (~x & z)
3
Maj(x,y,z) = (x & y) ^ (x & z) ^ (y & z)
4
Σ0(x) = rotr(x,2) ^ rotr(x,13) ^ rotr(x,22)
5
Σ1(x) = rotr(x,6) ^ rotr(x,11) ^ rotr(x,25)
6
σ0(x) = rotr(x,7) ^ rotr(x,18) ^ shr(x,3)
7
σ1(x) = rotr(x,17) ^ rotr(x,19) ^ shr(x,10)
8

9
每一轮的公式：
10
T1 = h + Σ1(e) + Ch(e,f,g) + K[t] + W[t]
11
T2 = Σ0(a) + Maj(a,b,c)
12
h = g
13
g = f
14
f = e
15
e = d + T1
16
d = c
17
c = b
18
b = a
19
a = T1 + T2

flowchart TD %% 样式定义 classDef default fill:#f9fafb,stroke:#6b7280,stroke-width:2px,color:#1f2937,rx:8,ry:8; classDef init fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a8a,rx:10,ry:10; classDef t1 fill:#e0f2fe,stroke:#0284c7,stroke-width:2px,color:#0c4a6e; classDef t2 fill:#dcfce7,stroke:#16a34a,stroke-width:2px,color:#14532d; classDef update fill:#f3e8ff,stroke:#9333ea,stroke-width:2px,color:#581c87; classDef condition fill:#fce7f3,stroke:#db2777,stroke-width:2px,color:#831843; classDef final fill:#d1fae5,stroke:#059669,stroke-width:2px,color:#064e3b,rx:10,ry:10; A["a, b, c, d, e, f, g, h"]:::init B["T1 = h + Σ1(e) + Ch(e,f,g) + Kt + Wt"]:::t1 C["T2 = Σ0(a) + Maj(a,b,c)"]:::t2 D["h = g g = f f = e e = d + T1"]:::update E["d = c c = b b = a a = T1 + T2"]:::update F{"还有轮次?"}:::condition G["H0 += a H1 += b ... H7 += h"]:::final A --> B A --> C B --> D C --> D D --> E E --> F F -->|是| A F -->|否| G %% 连线样式 linkStyle default stroke:#6b7280,stroke-width:2px;

累加#

1
H0 += a; H1 += b; ... H7 += h

可以看到，大体上和前两个没啥区别，但是细看的话，内部实现确实一套新的逻辑，正所谓只可远观而不可亵玩焉。

二、实现#

依旧从应用层入手，结构完全一样，我们直接看主要函数。

1
// ============================================================
2
// 一次性接口
3
// ============================================================
4
std::string sha256(const std::string& input) {
5
    SHA256Context ctx;
6
    sha256Update(ctx, reinterpret_cast<const uint8_t*>(input.data()), input.size());
7

8
    uint8_t digest[32];
9
    sha256Final(ctx, digest);
10

11
    std::ostringstream oss;
12
    for (int i = 0; i < 32; i++) {
13
        oss << std::hex << std::setw(2) << std::setfill('0')
14
            << (int)digest[i];
15
    }
16
    return oss.str();
17
}

1.context#

1
// ============================================================
2
// SHA-256 上下文
3
// ============================================================
4
struct SHA256Context {
5
    uint32_t state[8];      // H0..H7
6
    uint64_t bitCount;      // 已处理比特数
7
    uint8_t  buffer[64];    // 未处理完的块
8
    size_t   bufferLen;
9

10
    SHA256Context() { init(); }
11

12
    void init() {
13
        // 前 8 个素数平方根小数部分前 32 位（FIPS 180-4）
14
        state[0] = 0x6a09e667;
15
        state[1] = 0xbb67ae85;
16
        state[2] = 0x3c6ef372;
17
        state[3] = 0xa54ff53a;
18
        state[4] = 0x510e527f;
19
        state[5] = 0x9b05688c;
20
        state[6] = 0x1f83d9ab;
21
        state[7] = 0x5be0cd19;
22
        bitCount = 0;
23
        bufferLen = 0;
24
    }
25
};

2.update#

1
// ============================================================
2
// 更新
3
// ============================================================
4
static void sha256Update(SHA256Context& ctx, const uint8_t* data, size_t len) {
5
    ctx.bitCount += (uint64_t)len * 8;//计算已经处理的字节数，第一次调用就是原始消息长度
6

7
    while (len > 0) {
8
        size_t space = 64 - ctx.bufferLen;  //计算缓冲区剩余空间
9
        size_t copy  = (len < space) ? len : space;
10

11
        std::memcpy(ctx.buffer + ctx.bufferLen, data, copy);
12
        ctx.bufferLen += copy;
13
        data += copy;  //移动指针
14
        len  -= copy;
15

16
        if (ctx.bufferLen == 64) {
17
            sha256Transform(ctx.state, ctx.buffer);
18
            ctx.bufferLen = 0;
19
        }
20
    }
21
}

3.transform#

工具函数

1
// ============================================================
2
// SHA-256 常数 K[0..63]
3
// 来源：前 64 个素数立方根小数部分的前 32 位（FIPS 180-4）
4
// ============================================================
5
static const uint32_t K[64] = {
6
    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
7
    0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
8
    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
9
    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
10
    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
11
    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
12
    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
13
    0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
14
    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
15
    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
16
    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
17
    0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
18
    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
19
    0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
20
    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
21
    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
22
};
23

24
// ============================================================
25
// 大端序读写工具（SHA-256 规定大端）
26
// ============================================================
27
static inline uint32_t read_be32(const uint8_t* p) {
28
    return ((uint32_t)p[0] << 24)
29
         | ((uint32_t)p[1] << 16)
30
         | ((uint32_t)p[2] << 8)
31
         |  (uint32_t)p[3];
32
}
33

34
static inline void write_be32(uint8_t* p, uint32_t v) {
35
    p[0] = (uint8_t)((v >> 24) & 0xff);
36
    p[1] = (uint8_t)((v >> 16) & 0xff);
37
    p[2] = (uint8_t)((v >> 8)  & 0xff);
38
    p[3] = (uint8_t)( v        & 0xff);
39
}
40

41
// 循环右移
42
static inline uint32_t rotr(uint32_t x, uint32_t n) {
43
    return (x >> n) | (x << (32 - n));
44
}
45

46
// ============================================================
47
// 6 个辅助函数
48
// ============================================================
49
static inline uint32_t Ch (uint32_t x, uint32_t y, uint32_t z) {
50
    return (x & y) ^ (~x & z);
51
}
52
static inline uint32_t Maj(uint32_t x, uint32_t y, uint32_t z) {
53
    return (x & y) ^ (x & z) ^ (y & z);
54
}
55
static inline uint32_t Sigma0(uint32_t x) {   // 大写 Σ0
56
    return rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);
57
}
58
static inline uint32_t Sigma1(uint32_t x) {   // 大写 Σ1
59
    return rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);
60
}
61
static inline uint32_t sigma0(uint32_t x) {   // 小写 σ0
62
    return rotr(x, 7) ^ rotr(x, 18) ^ (x >> 3);
63
}
64
static inline uint32_t sigma1(uint32_t x) {   // 小写 σ1
65
    return rotr(x, 17) ^ rotr(x, 19) ^ (x >> 10);
66
}

1
// ============================================================
2
// 处理一个 512bit 块
3
// ============================================================
4
static void sha256Transform(uint32_t state[8], const uint8_t block[64]) {
5
    uint32_t W[64];
6

7
    // 1. 前 16 字：大端读入
8
    for (int i = 0; i < 16; i++) {
9
        W[i] = read_be32(block + i * 4);
10
    }
11

12
    // 2. 扩展到 64 字
13
    for (int i = 16; i < 64; i++) {
14
        W[i] = sigma1(W[i - 2]) + W[i - 7]
15
             + sigma0(W[i - 15]) + W[i - 16];
16
    }
17

18
    // 3. 加载工作变量
19
    uint32_t a = state[0], b = state[1], c = state[2], d = state[3];
20
    uint32_t e = state[4], f = state[5], g = state[6], h = state[7];
21

22
    // 4. 64 轮
23
    for (int i = 0; i < 64; i++) {
24
        uint32_t T1 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];
25
        uint32_t T2 = Sigma0(a) + Maj(a, b, c);
26

27
        h = g;
28
        g = f;
29
        f = e;
30
        e = d + T1;
31
        d = c;
32
        c = b;
33
        b = a;
34
        a = T1 + T2;
35
    }
36

37
    // 5. 累加回 state
38
    state[0] += a; state[1] += b; state[2] += c; state[3] += d;
39
    state[4] += e; state[5] += f; state[6] += g; state[7] += h;
40
}

4.dofinal#

最后再看看

1
// ============================================================
2
// 收尾：填充 + 长度 + 输出 32 字节
3
// ============================================================
4
static void sha256Final(SHA256Context& ctx, uint8_t digest[32]) {
5
    uint8_t padding[64];
6
    std::memset(padding, 0, sizeof(padding));
7
    padding[0] = 0x80;
8

9
    uint64_t bits = ctx.bitCount;
10

11
    size_t padLen = (ctx.bufferLen < 56)
12
                  ? (56 - ctx.bufferLen)
13
                  : (120 - ctx.bufferLen);
14

15
    sha256Update(ctx, padding, padLen);
16

17
    uint8_t lenBytes[8];
18
    for (int i = 0; i < 8; i++) {
19
        lenBytes[i] = (uint8_t)((bits >> (8 * (7 - i))) & 0xff);
20
    }
21
    sha256Update(ctx, lenBytes, 8);
22

23
    for (int i = 0; i < 8; i++) {
24
        write_be32(digest + i * 4, ctx.state[i]);
25
    }
26
}