diff --git a/lib/acl_hash/src/acl_hash.c b/lib/acl_hash/src/acl_hash.c
index 0de90fa6..343f474f 100644
--- a/lib/acl_hash/src/acl_hash.c
+++ b/lib/acl_hash/src/acl_hash.c
@@ -213,13 +213,25 @@ static void l_close(acl_hash_sha1_context_t *c, char *digest_buf) {
   digest_buf[40] = 0;
 }
 
-static uint32_t l_leftrotate(uint32_t v, unsigned bits) {
-  uint64_t both = ((uint64_t)v) << bits;
-  uint32_t hi = both >> 32;
-  uint32_t lo = both & 0xffffffff;
-  return hi | lo;
+#ifdef _MSC_VER
+#pragma warning(push)
+// The MSVC /sdl flag turns this false-positive warning into an error:
+// C4146: unary minus operator applied to unsigned type, result still unsigned
+// https://developercommunity.visualstudio.com/t/c4146-unary-minus-operator-applied-to-unsigned-typ/884520
+#pragma warning(disable : 4146)
+#endif
+
+// See Safe, Efficient, and Portable Rotate in C/C++ by John Regehr.
+// https://blog.regehr.org/archives/1063
+static uint32_t l_leftrotate(uint32_t v, uint32_t bits) {
+  assert(bits < 32);
+  return (v << bits) | (v >> ((-bits) & 31));
 }
 
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
+
 static uint32_t l_read_bigendian_i32(const unsigned char *buf) {
   // Need to cast to uchar so we don't sign extend when widening out to 32 bits.
   uint32_t byte3 = buf[0];
diff --git a/lib/acl_hash/test/CMakeLists.txt b/lib/acl_hash/test/CMakeLists.txt
index 18dc1555..d244fc4c 100644
--- a/lib/acl_hash/test/CMakeLists.txt
+++ b/lib/acl_hash/test/CMakeLists.txt
@@ -1,8 +1,9 @@
 # Copyright (C) 2021 Intel Corporation
 # SPDX-License-Identifier: BSD-3-Clause
 
-add_executable(acl_hash_test acl_test.cpp acl_hash_test.cpp )
-target_link_libraries(acl_hash_test PRIVATE acl_hash CppUTest)
+add_executable(acl_hash_test acl_test.cpp acl_hash_test.cpp)
+target_include_directories(acl_hash_test PUBLIC ../include ../src)
+target_link_libraries(acl_hash_test PRIVATE CppUTest)
 target_compile_definitions(acl_hash_test PRIVATE
   "ACL_TARGET_BIT=${ACL_TARGET_BIT}"
 )
diff --git a/lib/acl_hash/test/acl_hash_test.cpp b/lib/acl_hash/test/acl_hash_test.cpp
index fd872a67..e29d506b 100644
--- a/lib/acl_hash/test/acl_hash_test.cpp
+++ b/lib/acl_hash/test/acl_hash_test.cpp
@@ -6,7 +6,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "acl_hash/acl_hash.h"
+#include "acl_hash.c"
 #include "acl_test.h"
 
 TEST_GROUP(Hash) {
@@ -177,3 +177,40 @@ TEST(Hash, hexdigest_str129) {
   CHECK_EQUAL(0, strcmp(m_digest, "7bcbe82f22dcf896409dd4759fc45ea83e4c05d2"));
   CHECK_EQUAL(0, m_ctx.is_open);
 }
+
+TEST_GROUP(Internal){};
+
+TEST(Internal, Rotate) {
+  CHECK_EQUAL(0x12345678, l_leftrotate(0x12345678, 0));
+  CHECK_EQUAL(0x2468acf0, l_leftrotate(0x12345678, 1));
+  CHECK_EQUAL(0x48d159e0, l_leftrotate(0x12345678, 2));
+  CHECK_EQUAL(0x91a2b3c0, l_leftrotate(0x12345678, 3));
+  CHECK_EQUAL(0x23456781, l_leftrotate(0x12345678, 4));
+  CHECK_EQUAL(0x468acf02, l_leftrotate(0x12345678, 5));
+  CHECK_EQUAL(0x8d159e04, l_leftrotate(0x12345678, 6));
+  CHECK_EQUAL(0x1a2b3c09, l_leftrotate(0x12345678, 7));
+  CHECK_EQUAL(0x34567812, l_leftrotate(0x12345678, 8));
+  CHECK_EQUAL(0x68acf024, l_leftrotate(0x12345678, 9));
+  CHECK_EQUAL(0xd159e048, l_leftrotate(0x12345678, 10));
+  CHECK_EQUAL(0xa2b3c091, l_leftrotate(0x12345678, 11));
+  CHECK_EQUAL(0x45678123, l_leftrotate(0x12345678, 12));
+  CHECK_EQUAL(0x8acf0246, l_leftrotate(0x12345678, 13));
+  CHECK_EQUAL(0x159e048d, l_leftrotate(0x12345678, 14));
+  CHECK_EQUAL(0x2b3c091a, l_leftrotate(0x12345678, 15));
+  CHECK_EQUAL(0x56781234, l_leftrotate(0x12345678, 16));
+  CHECK_EQUAL(0xacf02468, l_leftrotate(0x12345678, 17));
+  CHECK_EQUAL(0x59e048d1, l_leftrotate(0x12345678, 18));
+  CHECK_EQUAL(0xb3c091a2, l_leftrotate(0x12345678, 19));
+  CHECK_EQUAL(0x67812345, l_leftrotate(0x12345678, 20));
+  CHECK_EQUAL(0xcf02468a, l_leftrotate(0x12345678, 21));
+  CHECK_EQUAL(0x9e048d15, l_leftrotate(0x12345678, 22));
+  CHECK_EQUAL(0x3c091a2b, l_leftrotate(0x12345678, 23));
+  CHECK_EQUAL(0x78123456, l_leftrotate(0x12345678, 24));
+  CHECK_EQUAL(0xf02468ac, l_leftrotate(0x12345678, 25));
+  CHECK_EQUAL(0xe048d159, l_leftrotate(0x12345678, 26));
+  CHECK_EQUAL(0xc091a2b3, l_leftrotate(0x12345678, 27));
+  CHECK_EQUAL(0x81234567, l_leftrotate(0x12345678, 28));
+  CHECK_EQUAL(0x02468acf, l_leftrotate(0x12345678, 29));
+  CHECK_EQUAL(0x048d159e, l_leftrotate(0x12345678, 30));
+  CHECK_EQUAL(0x091a2b3c, l_leftrotate(0x12345678, 31));
+}