hi,
where the message padding is done in sha1?

I guess the question is related to my other post?

The message padding is supposedly done in the last round of the last block.

For SHA-1 (and SHA-256) after splitting the full message in 512 bits blocks, a 1 (the bit) is added to the message, and then 0s (many bits) are added to complete a block of 448 bits, and then, in the 512-448=64 remaining bits, the length of the original message (in bits) is appended to complete a 512 bits block (the padding is always done no matter how few bits are left in the last block, so you may end up adding more than 512 bits for "padding").

This is described in some detail in 5.1.1 of FIPS-180 (http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf). And is part of all software SHA-1 implementations (take python's for example).

The same padding is used in MD5 (RFC1321).

To verify the FPGA implementation I took a pure python implementation (https://codespeak.net/pypy/dist/lib_pypy/_sha.py) and removed the padding step, provided as input a few test patterns, and manually verified the output.

To realize that it was actually the padding missing I started looking the internal states in the waves, and as soon as I conjectured the padding was missing I jumped to the FPGA code to see if it was there, and it was not.

However, I understand that all this FPGA SHA-1 implementations may very well be thought to be used by some other layer which breaks the message down in words and adds the padding. Documentation would be a bless here :)

I'm in the process of writing a sort of testbench to automatically test the implementation (kind of test cases), but haven't done it yet... As I'm new to fpgas, all contributions are welcome, specially sample code (even if it's for other tests and algorithms)

thanks a lot
gera