Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

SHA-1 is initialize with a specific buffer:

h0 = 0x67452301
h1 = 0xEFCDAB89
h2 = 0x98BADCFE
h3 = 0x10325476
h4 = 0xC3D2E1F0?

Why?

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

The initial values to a Merkle–Damgård type hash function are essentially the plaintext to a block cipher, with the input to the hash function becoming the key. The maximum length of the hash is determined by the amount of bits of initial value. Five 32-bit words gives SHA1 a state size and maximum output of 160 bits. In order for an MD type hash function to output a consistent value, the initial values must be constant.

The first 4 values are those used in MD4 and MD5. They are represented in big-endian format. If represented in little-endian, it can be seen it is a simple 4-bit counter starting at 0000, maxing out at 1111, then stepping back in reverse, in groups of 32 bits:

0111 0110 0101 0100 0011 0010 0001 0000 = LE 0x76543210 = BE 0x67452301
1111 1110 1101 1100 1011 1010 1001 1000 = LE 0xFEDCBA98 = BE 0xEFCDAB89
1000 1001 1010 1011 1100 1101 1110 1111 = LE 0x89ABCDEF = BE 0x98BADCFE
0000 0001 0010 0011 0100 0101 0110 0111 = LE 0x01234567 = BE 0x10325476

The final big-endian value is an incrementing counter from 1100 for odd 4-bit groups, and a decrementing counter from 0011 for even groups.

These are called Nothing Up My Sleeve numbers, and are chosen as a way of proving the constants are not specially chosen, such as to provide a backdoor to the algorithm.

The round constants for SHA-1 were also chosen not to be "special", but are generated quite differently. They take the square root of a number in binary, then the first 32 bits, including those before the decimal place, become the round constant. This is the same method used to generate the two round constants for MD4.

0x5A827999 = $\sqrt2$
0x6ED9EBA1 = $\sqrt3$
0x8F1BBCDC = $\sqrt5$
0xCA62C1D6 = $\sqrt10$

The design criteria for the first 2 round constants was specified in the original MD4 paper as well as the RFC. The initial value choice was never defined nor explained, most likely because of the obviousness of the pattern. The choices of initial values and round constants were not explained in FIPS-180-1 and later revisions. It is interesting that they chose 10 to generate the final round constant rather than 7, as it is not prime.

SHA-2 (256 and 512 bit digests) in comparison uses the fractional component (after the decimal place only) of the square root of sequential primes 2 to 19 for initial values, and the fractional component of the cube roots of sequential primes 2 to 311 for round constants.

share|improve this answer
    
Why are they not simply zero'd? –  figlesquidge Oct 25 '13 at 15:26
    
@user8911 I suppose they wanted an equal distribution of 1 and 0 bits, which is what they got. Algorithms with better key variability or larger states probably do not have this requirement. SHA256 has 53.1% of IV bits set, SHA224 = 50.8%, SHA384 = 49.8%, SHA512 = 53.9%. –  Richie Frame Oct 29 '13 at 5:25
    
Thanks. I turned my comment into its own question here –  figlesquidge Oct 29 '13 at 10:04
add comment

If the question is 'why are those variables initialized at all', well, that's because those values will be used as inputs to the initial SHA-1 compression function; they must be consistent values; otherwise, the resulting hash will be different (depending on what values were used).

If the question is 'why are those specific values used (rather than other values)', I don't believe NIST ever formally published that reasoning. However, those values in hexadecimal follow a pattern; this implies that they were unlikely to be chosen with some special property in mind.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.