SHA-2 and SHA-3

SHA-2 replaced SHA-1 with three variants distinguished by output size: SHA-256, SHA-384 and SHA-512, with SHA-224, SHA-512/224 and SHA-512/256 added as shorter-digest options built on the same internal machinery. SHA-3, the newest member, followed in 2015 with SHA3-224, SHA3-256, SHA3-384 and SHA3-512, and is built on a completely different construction from SHA-2, discussed below.

SHA-512’s structure. SHA-512 takes an input message shorter than $2^{128}$ bits and produces a 512-bit digest, processing the input in 1024-bit blocks.

Padding: the original $L$-bit message is padded with a single 1 bit, then enough 0 bits to bring the total length to $896 \pmod{1024}$, leaving room at the end. A 128-bit encoding of $L$ is then appended, bringing the padded message to an exact multiple of 1024 bits.

The padded message splits into $N$ blocks of 1024 bits each, $M_1, \dots, M_N$. $H^{(IV)}$ is a fixed, publicly-specified 512-bit constant defined in the standard: not secret, not random, just the starting state fed into the first block.

Inside the compression function $F$: the previous state $H_{i-1}$ is unpacked into eight 64-bit working registers $a$ through $h$, transformed across 80 rounds. A message schedule expands the 1024-bit block $M_i$ into 80 round words $W_0, \dots, W_{79}$, the same role AES’s key schedule plays in turning one key into many round keys. Each round mixes in one $W_t$ and one public round constant $K_t$; six of the eight registers just shift along unchanged, so only two new register values are actually computed per round. After round 79, the Davies-Meyer feedforward adds the final $a$ through $h$, mod $2^{64}$, back onto the original $H_{i-1}$. The result of those eight additions is $H_i$, passed on to the next block, or output as the digest after the last one.

SHA-3’s sponge construction is a different design entirely. Instead of eight separate working registers, SHA-3 keeps one unified state of $r + c$ bits, repeatedly transformed by a single permutation $f$.

Absorbing phase. Each message block is XORed into the top $r$ bits of the state, then $f$ scrambles the entire state. The bottom $c$ bits are never touched directly by the message input, which is what protects the security margin.

Squeezing phase. Output is read from the top $r$ bits of the state, with $f$ applied again between each read. Squeezing can continue for as many bits as the caller needs, which makes SHA-3 naturally an extendable output function, not just a fixed-length digest.

Rate versus capacity. $r$ (the rate) and $c$ (the capacity) trade off against each other: a larger $r$ absorbs and squeezes more bits per application of $f$, meaning faster hashing, but a smaller $c$ means a smaller security margin. The different SHA-3 variants change only where this split falls.

No length-extension vulnerability. In SHA-2, an attacker who knows $H(m)$ can compute $H(m \| \text{extra})$ without ever knowing $m$ itself, because $H(m)$ is the full internal state after the last block, and the compression function can simply resume from there. SHA-3’s sponge eliminates this: squeezing only ever exposes the $r$ rate bits, never the $c$ capacity bits, so the full state needed to resume the permutation is never recoverable from the output alone.