# Why is an IV used in Merkle–Damgård transform?

In Merkle–Damgård transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next block x2 at the very beginning.

-
–  figlesquidge Nov 9 '13 at 9:52

In most Merkle–Damgård hash functions, it uses a block cipher in the compression function, with the inputs being the padded message blocks and the IV.

The IV is the fixed width input plaintext to the cipher, and the message becomes the key. The hashing of the input block x1 works by expanding it (using a key expansion) so that there are as many subkeys as there are rounds (for SHA at least, this may/will vary with other hash functions). Then the IV is encrypted over $N$ rounds using the compression function. Wikipedia has a nice image that gives a general high level overview of this.

In SHA2 hashes, the compression function is an unbalanced Feistel network that encrypts 2 of the 8 words of the IV using a single subkey and a round constant during each round. Once all the rounds have completed, the output of the block cipher becomes the plaintext input for the next block x2, and so forth until all blocks have been used. The output of the cipher then becomes the hash value, truncated if necessary.

SHA256 uses 32-bit words and 64 rounds, with 512-bits of message being expanded to 2048-bits of subkeys. SHA512 uses 64-bit words and 80 rounds, with 1024-bits of message being expanded to 5120-bits of subkeys.

Without a specified IV, the block cipher may output results that follow a pattern, since it is not an ideal cipher. Most hash functions use IVs based on irrational numbers, which generally have a fairly balanced hamming weight, while also not being part of a defined pattern. SHA1 uses the initial values from MD4, which are not irrational or random, and are built from a very specific pattern, but have an average hamming weight of $1/2$ per bit.

-