# Why is an IV used in Merkle–Damgård transform?

In Merkle–Damgård transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next block x2 at the very beginning.

-
–  figlesquidge Nov 9 '13 at 9:52

The IV is the fixed width input plaintext to the cipher, and the message becomes the key. The hashing of the input block x1 works by expanding it (using a key expansion) so that there are as many subkeys as there are rounds (for SHA at least, this may/will vary with other hash functions). Then the IV is encrypted over $N$ rounds using the compression function. Wikipedia has a nice image that gives a general high level overview of this.
Without a specified IV, the block cipher may output results that follow a pattern, since it is not an ideal cipher. Most hash functions use IVs based on irrational numbers, which generally have a fairly balanced hamming weight, while also not being part of a defined pattern. SHA1 uses the initial values from MD4, which are not irrational or random, and are built from a very specific pattern, but have an average hamming weight of $1/2$ per bit.