Module sha_ops 

The four Intel SHA-1 (SHA-NI) operations, in SOFTWARE — the exact bit-for-bit semantics of sha1rnds4 / sha1msg1 / sha1msg2 / sha1nexte. These are the spec the tree-walker runs so that SHA-1 written in LOGOS over these ops produces the identical result whether it is interpreted (software here) or AOT-compiled to the real hardware instruction (core::arch::x86_64). Same idea as the scalar-lane spec behind Lanes8Word32 → AVX2.

A 128-bit value is a [u32; 4] in LANE order: index i is lanes bits [32i+31 : 32i], so index 0 is the low dword (SRC[31:0]) and index 3 is the high dword (SRC[127:96]) — matching how _mm_loadu_si128/_mm_storeu_si128 move an array to/from an __m128i. The tests below load the same array into an __m128i and assert the software op equals the hardware intrinsic on random inputs, so the spec is validated against silicon, not just against itself.

Functions

sha1msg1

sha1msg1(a, b) — the first half of the message-schedule recurrence (the XOR mixing before the rotate). dest = { W2^W0, W3^W1, W4^W2, W5^W3 } per Intel, in lane order.

sha1msg2

sha1msg2(a, b) — completes the schedule: the final XOR with the previous words and the ROL-1, including the intra-vector dependency of W19 on W16.

sha1nexte

sha1nexte(a, b) — fold the next E (the previous block-round’s A, rotated) into the high dword of the next message group. dest[127:96] = b[127:96] + (a[127:96] ROL 30); the low 96 bits pass b.

sha1rnds4

sha1rnds4(abcd, msg, func) — four rounds of SHA-1. abcd is the working state (A in lane 3 … D in lane 0), msg the four message dwords with the round’s E already folded into its high dword (via sha1nexte / the initial add), and func ∈ 0..=3 selects the round function + constant (0 = Ch/K0, 1 = Parity/K1, 2 = Maj/K2, 3 = Parity/K3). Returns the new state.