Lion Cipher Lab
Implement SHA-256 from scratch, and verify it against the FIPS 180-4 test vectors
- Foundations
- Advanced
- ~90 min
- Free · no account required
Why it matters
SHA-256 is everywhere: file checksums, TLS certificates, Git, code signing, blockchains, password reset tokens. Most people treat it as a magic box. This lab opens the box. You build SHA-256 yourself in about 100 lines of plain Python, following the official US standard (FIPS 180-4) section by section, and you compute its strange-looking constants from prime numbers instead of copying them. Then you prove it is right the way professionals do. You check it against NIST's published examples, and you compare it byte for byte against Python's built-in version on thousands of inputs. The most…
What you'll learn
- reading a real cryptographic standard (FIPS 180-4) and turning its sections into code: padding (5.1.1), the six logical functions (4.1.2), the message schedule and 64 rounds (6.2.2)
- deriving SHA-256's 64 round constants and 8 initial hash words from the cube and square roots of primes with exact integer arithmetic, and checking all 72 against the FIPS tables (72/72)
- checking an implementation against published intermediate values (W[0]=61626380, W[15]=00000018, round 0 a=5D6AEBCD) and full test vectors ('abc', the 448-bit two-block message, one million 'a')
- differential testing against hashlib: every length 0 to 200 bytes plus 2,000 seeded random inputs, all matching
- catching a planted off-by-one padding bug that passes all three NIST vectors but fails at lengths 55, 119 and 183 in the length sweep
- measuring the avalanche effect (one flipped input bit changes about 128 of 256 output bits, standard deviation about 8) and watching it collapse when SHA-256 is cut to 1, 2, 4 or 8 rounds
- measuring why you never ship your own: pure Python ran thousands of times slower than hashlib, and its integer arithmetic is not constant-time
- explaining why a correct SHA-256 is still the wrong tool for passwords (it is built to be fast) and for secret-prefix MACs (the digest IS the final internal state)
Steps in this lab
- What you are building, and the words you need
- Set up: a terminal, Python, and a lab folder
- Write SHA-256, one FIPS section at a time
- Check the constants you computed against the FIPS tables
- Verify against the NIST vectors, down to round 0
- Differential test against hashlib: every length, then random inputs
- Plant a padding bug: the NIST vectors pass, the length sweep catches it
- Measure the avalanche effect, and watch it collapse with fewer rounds
- Honest negative: why your SHA-256 must never ship (speed and timing)
- A correct SHA-256 is still the wrong tool for passwords and for MACs
- Do it better: how a professional tests crypto code