diff --git a/pem.go b/pem.go
index 6cf3763..3eb84e4 100644
--- a/pem.go
+++ b/pem.go
@@ -38,7 +38,7 @@ import (
 type Method *C.EVP_MD
 
 var (
-	SHA256 Method = C.EVP_sha256()
+	SHA256_Method Method = C.EVP_sha256()
 )
 
 type PublicKey interface {
diff --git a/sha256.go b/sha256.go
new file mode 100644
index 0000000..5297ae4
--- /dev/null
+++ b/sha256.go
@@ -0,0 +1,79 @@
+// Copyright (C) 2014 Space Monkey, Inc.
+// +build cgo
+
+package openssl
+
+/*
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "openssl/evp.h"
+*/
+import "C"
+
+import (
+	"errors"
+	"runtime"
+	"unsafe"
+)
+
+type SHA256Hash struct {
+	ctx    C.EVP_MD_CTX
+	engine *Engine
+}
+
+func NewSHA256Hash() (*SHA256Hash, error) { return NewSHA256HashWithEngine(nil) }
+
+func NewSHA256HashWithEngine(e *Engine) (*SHA256Hash, error) {
+	hash := &SHA256Hash{engine: e}
+	C.EVP_MD_CTX_init(&hash.ctx)
+	runtime.SetFinalizer(hash, func(hash *SHA256Hash) { hash.Close() })
+	if err := hash.Reset(); err != nil {
+		return nil, err
+	}
+	return hash, nil
+}
+
+func (s *SHA256Hash) Close() {
+	C.EVP_MD_CTX_cleanup(&s.ctx)
+}
+
+func (s *SHA256Hash) Reset() error {
+	if 1 != C.EVP_DigestInit_ex(&s.ctx, C.EVP_sha256(), engineRef(s.engine)) {
+		return errors.New("openssl: sha256: cannot init digest ctx")
+	}
+	return nil
+}
+
+func (s *SHA256Hash) Write(p []byte) (n int, err error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if 1 != C.EVP_DigestUpdate(&s.ctx, unsafe.Pointer(&p[0]),
+		C.size_t(len(p))) {
+		return 0, errors.New("openssl: sha256: cannot update digest")
+	}
+	return len(p), nil
+}
+
+func (s *SHA256Hash) Sum() (result [32]byte, err error) {
+	if 1 != C.EVP_DigestFinal_ex(&s.ctx,
+		(*C.uchar)(unsafe.Pointer(&result[0])), nil) {
+		return result, errors.New("openssl: sha256: cannot finalize ctx")
+	}
+	return result, s.Reset()
+}
+
+func SHA256(data []byte) (result [32]byte, err error) {
+	hash, err := NewSHA256Hash()
+	if err != nil {
+		return result, err
+	}
+	defer hash.Close()
+	if _, err := hash.Write(data); err != nil {
+		return result, err
+	}
+	return hash.Sum()
+}
diff --git a/sha256_test.go b/sha256_test.go
new file mode 100644
index 0000000..338d0a4
--- /dev/null
+++ b/sha256_test.go
@@ -0,0 +1,96 @@
+// Copyright (C) 2014 Space Monkey, Inc.
+// +build cgo
+
+package openssl
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"io"
+	"testing"
+)
+
+func TestSHA256(t *testing.T) {
+	for i := 0; i < 100; i++ {
+		buf := make([]byte, 10*1024-i)
+		if _, err := io.ReadFull(rand.Reader, buf); err != nil {
+			t.Fatal(err)
+		}
+
+		expected := sha256.Sum256(buf)
+		got, err := SHA256(buf)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if expected != got {
+			t.Fatal("exp:%x got:%x", expected, got)
+		}
+	}
+}
+
+func TestSHA256Writer(t *testing.T) {
+	ohash, err := NewSHA256Hash()
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash := sha256.New()
+
+	for i := 0; i < 100; i++ {
+		if err := ohash.Reset(); err != nil {
+			t.Fatal(err)
+		}
+		hash.Reset()
+		buf := make([]byte, 10*1024-i)
+		if _, err := io.ReadFull(rand.Reader, buf); err != nil {
+			t.Fatal(err)
+		}
+
+		if _, err := ohash.Write(buf); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := hash.Write(buf); err != nil {
+			t.Fatal(err)
+		}
+
+		var got, exp [32]byte
+
+		hash.Sum(exp[:0])
+		got, err := ohash.Sum()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if got != exp {
+			t.Fatal("exp:%x got:%x", exp, got)
+		}
+	}
+}
+
+func benchmarkSHA256(b *testing.B, length int64, fn shafunc) {
+	buf := make([]byte, length)
+	if _, err := io.ReadFull(rand.Reader, buf); err != nil {
+		b.Fatal(err)
+	}
+	b.SetBytes(length)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		fn(buf)
+	}
+}
+
+func BenchmarkSHA256Large_openssl(b *testing.B) {
+	benchmarkSHA256(b, 1024*1024, func(buf []byte) { SHA256(buf) })
+}
+
+func BenchmarkSHA256Large_stdlib(b *testing.B) {
+	benchmarkSHA256(b, 1024*1024, func(buf []byte) { sha256.Sum256(buf) })
+}
+
+func BenchmarkSHA256Small_openssl(b *testing.B) {
+	benchmarkSHA256(b, 1, func(buf []byte) { SHA256(buf) })
+}
+
+func BenchmarkSHA256Small_stdlib(b *testing.B) {
+	benchmarkSHA256(b, 1, func(buf []byte) { sha256.Sum256(buf) })
+}