Judging from the source code[1] in the author's repository, it is the latter. (what I see is: perform 96 instructions, then subtract 64 from the message length,

Judging from the source code[1] in the author's repository, it is the latter. (what I see is: perform 96 instructions, then subtract 64 from the message length, and repeat until the message length is 0) Intel seems to be the same way [2](2013) - i.e. looping over multiple instructions per 64 byte block. [1] https://github.com/minio/sha256-simd/blob/master/sha256block_arm64.s https://github.com/minio/sha256-simd/blob/master/sha256block... [2] https://software.intel.com/en-us/articles/intel-sha-extensions https://software.intel.com/en-us/articles/intel-sha-extensio...