SHA-256 over a block state of its own, so that two independent messages
can be compressed together (see update_pair); blocks go through the
sha2 compression function otherwise.
OS-backed RNG: the kernel’s generator through getrandom(3) on Linux
(served without a system call where the C library and kernel support it),
/dev/urandom elsewhere, the hardware RNG on ESP-IDF.