Repository: RustCrypto/hashes (language: rust)

Issue:
Strange quirk in SHA256 impl
https://github.com/RustCrypto/hashes/blob/74dcc278daabd787ed9ec30c66616aa729ae6bbc/sha2/src/sha256/soft.rs#L46-L51

The code appears to be doing `rotate_left(x, 7) ^ rotate_left(x, 18) ^ shift_left(x, 3)`, whereas the specification has these flipped:

![Screenshot_2024-01-05-08-25-21-55_3aea4af51f236e4932235fdada7d1643](https://github.com/RustCrypto/hashes/assets/6625462/6e7a99f6-f2fb-49bb-bd31-e9bd33a15b22)

This turns out to be ok because the `shl` and `shr` functions are also flipped:

https://github.com/RustCrypto/hashes/blob/74dcc278daabd787ed9ec30c66616aa729ae6bbc/sha2/src/sha256/soft.rs#L5-L13

So, nothing is broken, just a weird quirk. Should probably be renamed


Discussion / hints:
The labels for these do appear to be swapped

Fix patch:
diff --git a/sha2/src/sha256/soft.rs b/sha2/src/sha256/soft.rs
index 34826a7e8..69eb48894 100644
--- a/sha2/src/sha256/soft.rs
+++ b/sha2/src/sha256/soft.rs
@@ -3,12 +3,12 @@ use crate::consts::BLOCK_LEN;
 use core::convert::TryInto;
 
 #[inline(always)]
-fn shl(v: [u32; 4], o: u32) -> [u32; 4] {
+fn shr(v: [u32; 4], o: u32) -> [u32; 4] {
     [v[0] >> o, v[1] >> o, v[2] >> o, v[3] >> o]
 }
 
 #[inline(always)]
-fn shr(v: [u32; 4], o: u32) -> [u32; 4] {
+fn shl(v: [u32; 4], o: u32) -> [u32; 4] {
     [v[0] << o, v[1] << o, v[2] << o, v[3] << o]
 }
 
@@ -44,9 +44,9 @@ fn sha256msg1(v0: [u32; 4], v1: [u32; 4]) -> [u32; 4] {
     // sigma 0 on vectors
     #[inline]
     fn sigma0x4(x: [u32; 4]) -> [u32; 4] {
-        let t1 = or(shl(x, 7), shr(x, 25));
-        let t2 = or(shl(x, 18), shr(x, 14));
-        let t3 = shl(x, 3);
+        let t1 = or(shr(x, 7), shl(x, 25));
+        let t2 = or(shr(x, 18), shl(x, 14));
+        let t3 = shr(x, 3);
         xor(xor(t1, t2), t3)
     }
 


Test patch: