What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did? I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another.
For example, why did they pick


  F1(B, C, D) = (B &amp; C) | (~B &amp; D)


as their first function instead of another function like


  F1(B, C, D) = (B &amp; D) | (C ^ (D &amp; ~B))
What choice did they have?

F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their image). If you further require that each input, as well as the order of inputs, matters for the output, you are left with only 36.

However, those 36 are all basically equivalent. If you change the order of arguments for F1 and/or add some initial negations to any of the arguments, you will be able to construct them all. So they could have added some initial not-operations (making it more complex) or changed the argument order, but that's it.

The only other options they had were biased functions like the one in the question, ones where some input doesn't matter (so they are actually one or two input functions), and ones where the argument order doesn't matter, like B ^ C ^ D.